Privacy Policy

The controller of data processed for the platform’s own purposes is KAVO CAR LTDA, CNPJ 68.967.106/0001-00, headquartered at Avenida Brigadeiro Faria Lima, 2369, conj. 1102, Jardim Paulistano, CEP 01452-922, São Paulo/SP, Brazil ("Kavo").

Data protection officer (DPO): [PREENCHER: DPO name]. DPO contact: [PREENCHER: DPO e-mail]. Until then, privacy requests are received at suporte@kavocar.com.

It applies to visitors, buyers, private sellers, stores and their teams, commercial partners, Raio-X Kavo customers and people who talk to a store through channels integrated with Kavo, even without an account. Processing follows the Brazilian General Data Protection Law (Law 13,709/2018 – LGPD), the Brazilian Internet Civil Framework (Law 12,965/2014) and, for people using Kavo in other countries, the local law listed in section 15.

• Kavo as controller: user sign-up and access data, security, fraud prevention, billing of Kavo plans, support, the Marketplace, Raio-X Kavo and service communications.
• The store as controller and Kavo as processor: data the store records or receives in the panel about its own customers, suppliers, leads, conversations, contracts and charges. The store sets the purposes, must have a legal basis and inform data subjects; Kavo processes this data only to provide the service, following the store’s instructions and this Policy.

If you are a store customer and want to exercise rights over that data, contact the store first. You may also write to Kavo: we will forward the request to the responsible store without exposing other people’s data.

• Identity and contact: name, e-mail, phone, tax or ID number, date of birth when required, profile photo and role in the store.
• Account and access: protected credentials, authentication factors, sessions, device, IP address, access date and time and security logs.
• Store data: legal name, address, team, permissions, subscribed plan and billing history.
• Vehicles and listings: plate, VIN and technical data, photos, price, approximate location and listing text. Plate and VIN are not shown publicly unless chosen for publication.
• Negotiation and service: chat messages, integrated WhatsApp and Instagram messages, offers, contracts and e-signatures.
• Payments: amount, payment method and status. Card data is entered and stored by the payment provider, not by Kavo.
• Store customer data: whatever the store decides to record in the panel (section 3).
• Browsing: cookies and similar technologies described in the Cookie Policy.

We do not ask for sensitive data (such as health, religion or biometrics) to use the platform. Please do not send such data in messages or attachments.

We receive data from you; from the store that records customers, invites team members or talks to you; from sign-in providers (Google); from Meta (WhatsApp and Instagram) when the store authorizes the integration; from vehicle and registry databases queried for Raio-X and vehicle appraisals; and from the payment provider about the status of charges.

• Create and maintain your account, provide the contracted service, bill plans and give support: performance of a contract (LGPD art. 7, V).
• Issue invoices, keep tax documents and access logs for the legal period and answer authorities: legal or regulatory obligation (art. 7, II).
• Protect accounts, prevent fraud, spam and abuse, and measure technical performance: legitimate interest (art. 7, IX), limited to what is necessary.
• Show listings on the Marketplace and rank results: performance of a contract with the advertiser and legitimate interest.
• Send Kavo news and offers: consent (art. 7, I) or legitimate interest for customers, with an unsubscribe option in every message.
• Advertising cookies and campaign measurement: consent, which you can withdraw at any time.
• Defend rights in legal proceedings: regular exercise of rights (art. 7, VI).

We share only what each purpose needs, with providers contractually bound to protect the data:

• Supabase: database, authentication and file storage.
• Vercel: application hosting and execution.
• Resend: transactional e-mails (access codes, notices and invitations).
• Asaas: billing and payments.
• NFe.io: Brazilian electronic invoices.
• Clicksign: electronic contract signatures, when the store uses them.
• Meta (WhatsApp and Instagram) and Z-API or WAHA on infrastructure operated by Kavo: messages from integrations authorized by the store.
• OpenRouter, OpenAI and the configured model provider: AI features such as SYO, audio transcription and vehicle appraisal.
• APIBrasil, Consultar Placa and FIPE price table sources: vehicle lookups by plate or VIN.
• Google: Sign in with Google and, only with your consent, ad measurement (Google Ads).
• hCaptcha and Cloudflare Turnstile: checking that access is human.
• Sentry and Vercel Speed Insights: error and performance diagnostics, with personal data removed or minimized.
• WAHA infrastructure VPS: [PREENCHER: VPS provider and country].

We may also share data with authorities when the law requires it, with the store you negotiate with (what you send to it) and with the public (what you choose to publish in a listing). We do not sell personal data.

Several of these providers are based in, or provide support from, the United States and other countries. The database and application preferably run in São Paulo, but remote access or processing may happen outside Brazil and outside your country. These transfers follow LGPD art. 33 and applicable local rules, with contractual data protection clauses. [PREENCHER: mechanism adopted with each provider, e.g. ANPD Resolution CD/ANPD 19/2024 standard clauses]. You can ask for more information through the privacy channel.

We use essential cookies for sign-in, security and preferences, and advertising cookies only with your consent. You can accept, decline or change your choice at any time in the Cookie Policy.

We use automated rules to block suspicious access and rank listings, and AI to suggest replies, transcribe audio and estimate vehicle values. AI results are suggestions and may be wrong; decisions with a relevant effect on you can be reviewed by a person. You can ask for information about the criteria used and for review of a decision made solely by automated means (LGPD art. 20), subject to trade secrets.

• Account and store data: while the account or contract is active and, after closure, for the time needed to finish the export and scheduled deletion.
• Application access logs: at least 6 months (art. 15 of the Brazilian Internet Civil Framework) or the local period, if longer.
• Tax and billing documents: for the period required by tax law.
• Proof of acceptance, contracts and security logs: for the applicable limitation period, to defend rights.
• Consent cookie: 12 months.

When the period ends, data is deleted or anonymized. Backups are overwritten on their own cycle. [PREENCHER: internal periods per category].

We apply risk-appropriate controls: data isolation per organization, encryption in transit, two-factor authentication, identity confirmation for sensitive actions, audit logs and least-privilege staff access. If an incident may cause relevant risk or harm, we will notify the ANPD, competent local authorities and affected data subjects as required by LGPD art. 48, ANPD Resolution CD/ANPD 15/2024 and local law. We never ask for passwords, access codes or card data by message.

You can request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or unlawfully processed data; portability; information about who we share it with; information about the option not to consent; withdrawal of consent; objection; and review of automated decisions.

• In your account: under My account › Data and privacy you correct data, generate a copy and follow your requests.
• By e-mail: write to suporte@kavocar.com with the subject "Privacy – data subject rights". [PREENCHER: DPO e-mail, once defined].

For your security we may ask for proportionate identity confirmation. We reply within 15 days, or the local deadline if shorter. If the request concerns data controlled by a store, we will let you know and forward it to the store. You can also complain to the data protection authority in your country.

Kavo is not intended for people under 18 and does not allow them to sign up. If we find data of minors registered improperly, we will delete it, unless the law requires us to keep it.

When you use Kavo in Argentina, Chile, Colombia, Mexico or another country we serve, we also apply local data protection law, such as Law 25,326 (Argentina), Laws 19,628 and 21,719 (Chile), Law 1581 of 2012 (Colombia) and the Federal Law on the Protection of Personal Data Held by Private Parties (Mexico). Access, rectification, cancellation, objection and portability rights are exercised through the same channel. [PREENCHER: local agent or database registration, if required in any country].

When an organization authorizes a connection, we process WhatsApp business account and phone number identifiers, contacts, message content and media, timestamps, sending, delivery and read statuses and the assigned agent's identity. If history synchronization is authorized and available, we also receive the data Meta provides through that flow. We use this information to operate customer service, assign conversations, show their history and protect the integration. Conversations are private to the organization and authorized team, are not published in the Marketplace by connecting the integration, and may contain data about people without a Kavo account. The store determines its customer service purposes and Kavo processes conversations to provide the service; account, security and support data follow the other purposes in this Policy. In the official Meta option, history depends on the authorization and availability of Meta’s flow. With WAHA, infrastructure operated by Kavo maintains the linked session and processes messages, media, identifiers and events needed for customer service. We use Supabase for database and storage, Vercel for the published application and our VPS infrastructure for WAHA. During the local pilot, part of the application may run in the authorized development environment. If SYO AI is enabled separately, content needed for customer service may be processed by OpenRouter and the configured model provider. The dealership must inform customers about this processing and respect applicable purposes and permissions. These services may involve processing in other countries; information about recipients and processing is available through our privacy contact. Credentials remain on the server, are not shown to agents and become unusable through the integration when authorization is revoked. Disconnecting does not automatically erase existing records. To request access, correction or deletion, including without a Kavo account, follow the data deletion instructions or email suporte@kavocar.com.

Each version is dated and identified at the top of this page. When a change is relevant, we will notify you in the platform or by e-mail before it takes effect and, when the law requires, ask for a new acceptance. We keep a record of which version each user accepted and when.