Privacy Policy

This Privacy Policy describes how Habbitus, with its products Habbitus OS and Chat HB, collects, uses, stores and protects personal data of visitors to our website, leads, business customers (owners and staff), students of the clinics that use the platform, and people who talk to those businesses on WhatsApp or Instagram, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018, the LGPD).

Habbitus OS is a management system built for Pilates, Yoga and fitness studios and for health and movement clinics. Our goal is to take the studio owner out of spreadsheets, notebooks and WhatsApp groups when managing schedules, students and monthly fees, and give that time back so they can look after what matters: the people who train there.

We handle the organization and billing side of the clinic's business. The relationship between the clinic and its students remains the clinic's own; we act as the processor of the data the clinic entrusts to us for this work, and the clinic remains the controller of its own students' data.

Chat HB is our customer-service hub: a business serves its own customers on WhatsApp and Instagram in one place, with the help of an automated assistant that asks the first questions and routes the conversation to the right team. Here too, the business customer is the controller of the conversation data and Habbitus is the processor.

We may collect the following categories of personal data:

• Identification and contact data: name, e-mail, phone number.
• Document data: CPF or CNPJ (Brazilian tax IDs).
• Registration data: date of birth, sex, address and, optionally, a photo.
• Business data: type of business and the message sent in a contact form.
• Source data: how you heard about Habbitus and campaign data (UTM).
• Service data (Chat HB): name, phone number or WhatsApp/Instagram profile, the content of messages and files exchanged with the business, and the answers given to the automated assistant (for example, the product, size and quantity of a quote request).
• Scheduling data (Chat HB): when you book a time on WhatsApp with a business that uses automated scheduling, the full name, e-mail and phone number you provide, and the service and time you chose.
• Integration data: when the business customer connects Google Calendar or its WhatsApp and Instagram accounts, we process only what is needed for the integration to work, as described in sections 7 and 8.

When a student is a minor, registration and consent to the processing of this data are given by the parents or legal guardian, through the clinic. Each clinic is responsible for formalizing that consent with the student's family.

Habbitus never receives or storescredit card numbers, security codes or any raw payment data. This information is entered directly into secure fields of our payment processor and travels only between the payer's browser and that processor. What remains in our system are reference identifiers (for example, customer, subscription and invoice IDs) and the status of each charge.

Directly from you, when you fill in a form on our website or on a clinic's sign-up page, or when a clinic registers its own students and employees in the system. In Chat HB, we receive the messages you send to the business on WhatsApp or Instagram through Meta's official platforms.

We use the data we collect to:

• Enable commercial contact with people interested in Habbitus.
• Allow a clinic to manage its schedule, billing and students.
• Allow a business to serve its own customers through Chat HB (receive, organize and answer conversations, and route each one to the right team).
• Book, reschedule and cancel appointments on the business's calendar, at the request of the person talking to it on WhatsApp.
• Process payments.
• Send operational communications (verification codes, class reminders, billing notices).
• Protect the system against abuse and fraud.

Each of these purposes rests on a legal basis provided for in the LGPD, such as performance of a contract, compliance with a legal obligation or legitimate interest, depending on the case.

The business customer can connect its own Google account to Chat HB. The connection is made by the owner of the Google account, on Google's own authorization screen, and allows two things: the automated assistant can tell customers which times the business has free and, for businesses that have the scheduling module, it can book, reschedule and cancel appointments on the business's calendar.

What we access, and what Google asks you to authorize:

• See availability (free/busy) of the primary calendar. This shows only the busy time ranges. We do not read the title, description, location or attendees of events that we did not create.
• Create, change and delete the events that Chat HB created (requested only from businesses that have the scheduling module). Every event we create carries an internal marker, and we only touch events that have this marker: all other events on the calendar are never read, changed or deleted by us.
• Your Google e-mail address, only to show the business which account is connected.

What data goes to the calendar:when a person books a time on WhatsApp, the event created on the business's calendar contains the full name, e-mail and phone number that person provided, the chosen service and the time. We do not send a Google invitation to that e-mail address, and Google does not notify it.

What we use it for: only to serve the business itself: answering whether it has a free time and booking, rescheduling or cancelling the time the customer asked for.

How we store it:we store the access authorization granted by Google (the refresh token is stored encrypted). Free/busy ranges are queried on the spot and are not stored. Booking data lives in the event, on the business's own calendar; in Chat HB we keep only what is needed for the conversation to proceed and for the team to see what was agreed.

Sharing:we do not share, sell or transfer Google user data to third parties; we do not use it for advertising or to train artificial intelligence models, and no one at Habbitus reads calendar data, nor does any other application of ours beyond the business's own automated assistant, except when the business itself asks for support or when required for security or by law.

Habbitus's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

How to revoke access: at any time, at myaccount.google.com/permissions, or by asking us to disconnect through the contact in section 15. If you revoke access at Google, the connection is deactivated and the stored authorization is deleted in the next automatic check (run daily). If you ask us to disconnect, we notify Google and delete the authorization immediately. Events already created stay on the business's calendar, and the business can delete them whenever it wants.

The business customer connects to Chat HB its business WhatsApp number (through Meta's official WhatsApp Business platform) and its Instagram professional account.

What we process: the messages and files exchanged between the business and the people who contact it, the name and phone number (on WhatsApp) or username and ID (on Instagram) of the sender, and the technical information needed to send and receive those messages.

What we use it for: only so the business can serve the people who contacted it: showing the conversation to the team, answering through the automated assistant and routing to the right team. We do not use these messages for advertising, we do not sell them and we do not use them to train artificial intelligence models.

Number also used in the WhatsApp Business app:if the business keeps the same number in the WhatsApp Business app on its phone and in Chat HB, the messages it sends from the phone also appear in Chat HB, and we may import the app's contact list. Earlier chat history is imported only if the business authorizes it on Meta's connection screen.

Instagram (Chat HB):the business's manager signs in with the business Instagram account and authorizes the Habbitus-IG app to read the account's basic profile (ID and username) and to receive and reply to direct messages. We do not request access to comments, posts, followers or other accounts' messages. We keep the access token, used only to talk to Instagram, and renew it automatically while the connection exists. Under Instagram's rules, we only reply within 24 hours of the sender's last message. If the business removes the app in its Instagram settings, Meta notifies us and the connection becomes "Disconnected"; conversations are kept until the business deletes the connection. When the connection is deleted in Chat HB, we permanently erase its inbox, conversations, messages and attachments.

Ads (Habbitus OS): a clinic may connect its own Meta ad account by logging in with Facebook and authorizing the ad read permission (ads_read). We process the ad account ID and name, campaign names, daily spend and performance figures, and an access token, which we store in protected form and renew while the account stays connected. We use this data only to show the clinic how much each campaign cost and how many students it brought in. We only read this data: we do not create or change ads. We do not use it for advertising and we do not sell it.

How to revoke access:the business or clinic can disconnect WhatsApp, Instagram and the ad account at any time, by asking through the contact in section 15 or by removing the app's access in its own Meta account settings (on Facebook or Instagram, Settings, "Apps and Websites"). People who talked to a business can request deletion of their own data as explained on the data deletion page.

Use of WhatsApp and Instagram is also subject to Meta's own policies.

We share personal data only with the service providers needed to run the platform, such as payment processing, transactional e-mail and protection against malicious automation on public forms. In Chat HB, messages travel through Meta's official platforms (WhatsApp and Instagram), which is where the conversation itself takes place. Each provider receives only the data strictly necessary to perform its function and may not use that data for any other purpose.

We do not sell, rent or share personal data with third parties for advertising or for any purpose other than operating the system itself.

Some of these providers, such as Meta, Google and payment processors, may process data on servers outside Brazil. In those cases the transfer follows the grounds set out in Article 33 of the LGPD.

Our website does not use tracking or advertising cookies. The management platform uses one strictly necessary cookie to keep the admin panel's login session secure (marked HttpOnly, not accessible to browser scripts).

We adopt technical measures to protect the data we process:

• Data isolation between different clinics.
• Encrypted connections (HTTPS).
• Permission-based access control within each clinic.
• Automatic masking of personal data in our internal error-monitoring tools.

We keep data while the clinic is active on the platform and for as long as needed to meet legal obligations (for example, tax). A clinic may request complete deletion of its account and associated data at any time.

In Chat HB, when the business customer stops using the service, we delete its account in the service hub, with the conversations, and the Google and Meta authorizations. We keep, for a limited time, an internal copy of the account configuration only (without the conversations), in case of a deletion made by mistake.

To request deletion of your data, see the data deletion page.

We are still formalizing exact retention periods by type of data. Until then, we follow the general rule: we keep data only as long as needed to fulfil the purpose or the applicable legal obligation, and delete it when it is no longer needed.

Under the LGPD, you may request:

• Confirmation that processing exists and access to your data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, portability or deletion of your personal data.
• Information about whom we share your data with.
• Withdrawal of consent, where applicable.

We may update this policy from time to time. Significant changes will be announced by a notice on this page.

Questions about this policy or your personal data can be sent to contato@habbitus.com.br. Deletion requests follow the instructions on the data deletion page.