Privacy policy
Last updated: October 24, 2026
This Privacy Policy explains which personal data Turbo Notify processes, for what purposes, with whom it is shared, how long it is kept and how you can exercise your rights, under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and Brazil's Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014). It complements our Terms of Service.
This English version is a translation. The Portuguese version prevails in case of conflict.
1. Who is responsible for your data
Turbo Notify is a product of MENUR Tecnologia LTDA, registered under CNPJ 48.215.931/0001-33, State Registration (Inscrição Estadual) 199.786.492 ME, with its registered office at Avenida Tancredo Neves, 2539, Sala 2609, CEO Salvador Shopping, Torre Londres, Caminho das Árvores, Salvador, BA, Brazil ("MENUR", "Turbo Notify", "we", "us").
Contact channel of our data protection officer (encarregado): privacy@turbonotify.com. Use this address for any privacy or data protection matter.
2. Who this policy applies to
- Visitors to the turbonotify.com website.
- Customers and users who create an account and use the dashboard, the API or the MCP server.
- People who chat on WhatsApp with our customers, whose data goes through Turbo Notify when the customer sends or receives messages.
- End customers of those who resell Turbo Notify numbers, and their contacts.
3. Turbo Notify's two roles
The LGPD distinguishes who decides about the data (controller) from who processes data on someone else's behalf (processor). Turbo Notify plays both roles, in different situations:
- We are the controller of website data, your account, billing, support and security records (section 4).
- We are the processor of the data that goes through the Service at our customers' request: messages, contacts, groups and numbers (section 5). In that case the customer, as controller, decides why and how that data is processed. When a customer resells numbers, the customer is the controller of its end customers' data and their contacts' data, and Turbo Notify remains the processor.
4. Data we process as controller
On the website
- Browsing events, such as pages viewed, clicks on plans, on frequently asked questions, on code examples and on the menu, and technical errors on the page, recorded with the page address, the IP address and the browser. They are linked to a random identifier that applies only to the open tab and that the browser deletes when the tab is closed.
- Measurement data collected by Google Analytics and Microsoft Clarity (section 10).
- What you enter in the contact form: name, e-mail, WhatsApp number, company and message. The message is also forwarded by e-mail to our sales team.
In your account
- Name, e-mail, password (stored only in an irreversible encrypted form, as a hash), organization name and country. The country sets the subscription currency; at sign-up it is pre-filled from the approximate location of the connection, and when you sign up with Google or GitHub that location sets it.
- If you sign in with Google or GitHub, we receive from the chosen provider your name and the e-mail address it has verified. We never receive your password for those services. The provider may also send your profile picture, which we do not store.
- The profile picture shown in the dashboard comes from Gravatar, looked up with an encoded form of your e-mail. We do not upload or store pictures.
- IP address and browser of each dashboard sign-in and each session renewal, and authentication records (successful and failed sign-ins, accepted invitations).
- IP address and browser of each request, in the services' technical records (logs).
- Team members you invite (name and e-mail).
- API keys (we keep only an irreversible encrypted form and the visible start of the key, so you can recognize it), linked numbers, webhook settings and integrations.
- Connected apps: when you sign in with your account to connect an AI assistant to the MCP server, we keep the app's name and address, the permissions you approved, the organization you chose, and when you approved it and last used it.
- Your e-mail choices (whether you want account activity notices and product reminders and guidance) and a record of which notices we sent to each person and when, without the text of the e-mail.
In billing
- Plan, invoices, amounts, currency and payment status.
- Card details are entered directly with Stripe. We do not receive or store the full card number: we keep only the card brand and its last 4 digits, so you can recognize the card.
In support
- The content of your conversations with our support by e-mail, WhatsApp or the dashboard support form.
5. Data we process on behalf of customers
When a customer uses Turbo Notify, we process on its behalf:
- Messages: content (text, caption, media reference, location, contact cards and similar), a short preview of the text and, if the customer turns it on, audio transcriptions.
- The record of each message: sender, recipient, times, delivery and read status, reactions and answers to event invitations (who answered and whether they are going, not going or maybe).
- Contacts and groups: phone number, WhatsApp profile name, group participants and details, and profile pictures (kept only in the customer's own storage).
- Linked numbers: technical connection data of the linked device, needed to keep the number connected.
We process this data only to provide the Service to the customer, following the customer's instructions. We do not use message content for advertising, we do not sell it and we do not use it to train AI models. The dashboard does not show message content: it can only be retrieved through the API or the MCP server, with one of the customer's keys or with access the customer approved when connecting an app, within the retention period.
6. Why we use data and on what legal basis
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Create and maintain the account, provide the Service, bill and support | Performance of a contract (item V) |
| Keep access records, issue tax documents and comply with orders from authorities | Compliance with a legal obligation (item II) |
| Protect the Service, prevent fraud, spam and abuse, and investigate incidents | Legitimate interest (item IX) |
| Measure website use and improve the Service | Legitimate interest (item IX) |
| Send product reminders and guidance, which can be turned off | Legitimate interest (item IX) |
| Defend rights in judicial, administrative or arbitration proceedings | Regular exercise of rights (item VI) |
| Process messages, contacts and groups on behalf of the customer | Legal basis defined by the customer, as controller |
We send security notices (such as a changed password, an API key created or revoked, or a team member removed), billing notices and service health notices (such as a disconnected number or a storage that stopped responding) by e-mail, and some billing notices also by WhatsApp from Turbo Notify's own number. These notices are part of the Service and are always sent. Account activity notices (such as an extra number added or a webhook created) and product reminders and guidance (such as the next step of a setup left halfway) are on by default and can be turned off at any time in the dashboard, under Profile. Reminders also carry a link to stop receiving them with one click, and we send at most 3 of them every 14 days for each organization, never two within 72 hours.
7. Media and transcription stay in the customer's services
- We do not store media files. Images, audio, video and documents received pass through our servers' memory only to be processed, and are kept only when the customer connects its own S3-compatible storage (Amazon S3, Cloudflare R2 or Supabase Storage). Files go straight to that storage, which the customer contracts and controls, including its region and how long files are kept. Without it, the file is discarded and we keep only basic information, such as type and size. Profile pictures are downloaded only when that storage is connected.
- Audio transcription, when turned on, uses a provider chosen and contracted by the customer (currently Groq or OpenAI), with the customer's key. The audio is sent to the provider to be transcribed even when no storage is connected.
- The credentials for these services are stored encrypted and used only for this purpose. Data sent to those providers is governed by the agreement between the customer and them.
8. How long we keep data
| Data | Period |
|---|---|
| Message content (text, caption, media reference, transcription, preview) | 1 hour on Free; 1 or 7 hours on Lone Wolf; 1, 7, 24 or 72 hours on Business and Custom, chosen by the customer (default: 1 hour). Deleted within 15 minutes after the deadline |
| Content copy in a webhook delivery not yet completed | Until delivered or retries end, at most 72 hours |
| Content copy in a completed webhook delivery and in events for polling | Same period as message content |
| Technical processing copies (internal message queues) | Expire within 6 hours |
| Database backups | Rotating, kept for 30 days, used only for disaster recovery and never to return content to a customer |
| Message record without content (status, dates, participants, reactions and answers to event invitations) | 12 months, the same on every plan; the message stays available through the API during that period, marked as content expired |
| Event history for polling, without content | 90 days |
| Webhook delivery attempt records (status, attempts, times) | 60 days |
| Media files | Not stored by Turbo Notify; they live in the customer's own storage, under the customer's rules |
| Contacts and groups | While the customer's account exists, or until the customer asks for deletion |
| Storage and transcription credentials | Until the customer removes the integration |
| Account and user data | While the account exists |
| Dashboard sign-in sessions | 90 days |
| Apps connected to the MCP server (app name, approved permissions, approval and last use dates) | Up to 30 days after the approval ends; an approval lasts at most 90 days and ends earlier if you disconnect the app |
| Record of notices sent by e-mail (which notice went to which person and when, without the text or the address) | 90 days |
| Dashboard sign-in and authentication records (with IP and browser) | 12 months, which meets the 6-month minimum required by the Marco Civil da Internet |
| The services' technical records (logs), with the IP address and browser of each request, without message content and with phone numbers masked | 7 days |
| Invoices and billing data | For the period required by tax and accounting law |
| Conversations with support | While the account exists; deleted when the account is closed |
| Contact form messages | For as long as needed to reply and maintain the business relationship |
| Website browsing events | 12 months |
| Requests received by the Webhook Inspector (webhook.turbonotify.com), the webhook testing tool | 1 hour, at most 100 per address |
Periods in days and months are met by deleting records in monthly batches (quarterly, for sign-in and authentication records): a record may last up to one month longer than the stated period (three months, for those records).
Message content is deleted by automatic routines within 15 minutes after the period ends. Only the content expires: the message stays on record, and through the API you can still check its status and receipts, reply, react or delete it, within the time limits WhatsApp itself accepts for each action. Extending the period or changing plans does not recover content that has already been deleted. When moving to a plan with shorter periods, the choice moves to the longest period of the new plan that does not exceed it (72 hours on Business becomes 7 hours on Lone Wolf), and content beyond the new period is deleted.
Brazil's Marco Civil da Internet requires Turbo Notify to keep its own application access records for 6 months (we keep them for 12). That duty does not cover message content, which we keep only for the period above.
When an account is closed, we delete or anonymize its data, except what the law requires us to keep, for as long as that obligation lasts.
9. Who we share data with
We do not sell personal data. We share data only with providers that help us deliver the Service (sub-processors), to the extent necessary:
| Provider | Purpose |
|---|---|
| Stripe | Process card payments |
| Resend | Send security, billing, service health and account activity e-mails and product reminders, and forward contact form messages to our team |
| Sentry | Record technical errors on the website and the dashboard |
| Cloudflare | Network, DNS and traffic routing for the website and the dashboard |
| Google (Google Analytics) | Measure visits to the website and the dashboard |
| Microsoft (Clarity) | Understand how visitors use the website and the dashboard |
| Gravatar (Automattic) | Show your profile picture in the dashboard, if you have one |
| Infrastructure providers | Servers and network where the Service runs |
There are also services that you choose to use, which are not our providers:
- WhatsApp (Meta): messages travel through WhatsApp's infrastructure, subject to the WhatsApp terms and privacy policy that apply to your account.
- Google and GitHub, if you sign in with them.
- Storage and transcription the customer connects (section 7), and the AI provider used by the customer's agent.
We may also share data when required by law, by order of a competent authority, to defend rights or in a corporate reorganization, always with the same level of protection.
10. Cookies and measurement on the website and the dashboard
- Necessary: one cookie stores the language you chose on the website, and another the dashboard language. The dashboard uses cookies and browser storage to keep you signed in securely.
- Measurement: the website and the dashboard use Google Analytics and Microsoft Clarity, which may use cookies and similar technologies to measure visits and understand navigation. They are not loaded when your browser sends the "Do Not Track" signal.
- Errors: Sentry records technical errors and page performance on the website and the dashboard, without recording visits.
- The browsing events in section 4 are recorded by the website itself, with or without the "Do Not Track" signal.
- You can block or delete cookies in your browser settings. Some dashboard features may stop working without the necessary cookies.
11. International transfers
Some providers in section 9 are located outside Brazil, mainly in the United States. These transfers take place under article 33 of the LGPD, when necessary to perform the contract with you or to comply with a legal obligation, and based on the contractual data protection safeguards offered by those providers. The region of the customer's media storage is chosen by the customer.
12. How we protect data
We apply technical and administrative measures proportionate to the risk, including:
- communication with the website, the dashboard, the API and the MCP server over HTTPS (TLS) only;
- passwords and API keys stored only in an irreversible encrypted form;
- customers' storage and transcription credentials, and the connection credentials of linked numbers, encrypted (AES-256-GCM);
- data separated by organization: each customer accesses only its own account's data;
- message content kept out of technical records (logs), and phone numbers masked in them;
- automatic deletion of message content at the end of the plan's period;
- internal access limited to the people who need it to operate the Service.
WhatsApp conversations are encrypted between devices. Because Turbo Notify works as a device linked to the customer's number, messages are decrypted on our servers so they can reach the customer's integration. No system is entirely free from failures. If a security incident occurs that may cause relevant risk or harm, we will notify Brazil's National Data Protection Authority (ANPD) and the people affected, as the LGPD requires. If the incident involves data we process for a customer, we will notify that customer.
13. Your rights
Under the LGPD (art. 18), you may request:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
- portability of your data, as regulated;
- deletion of data processed with your consent, and withdrawal of that consent;
- information about who we share your data with and about the option of not giving consent and its consequences;
- objection to processing carried out unlawfully.
How to request: write to privacy@turbonotify.com, preferably from your account's e-mail address. We may ask for information to confirm your identity. We reply within 15 days, free of charge. If you are not satisfied, you can file a complaint with the ANPD at gov.br/anpd.
If you are outside Brazil, the law of your country may give you additional rights. Write to the same address and we will respond under the applicable law.
14. If you received messages from a Turbo Notify customer
If a company talked to you on WhatsApp using Turbo Notify, that company is the controller of your data and is the one responsible for your requests. Contact it first. If you write to us, we will forward your request to the responsible customer and help it respond. You can also block the number in WhatsApp at any time. To report spam or abuse sent through Turbo Notify, write to support@turbonotify.com.
15. Minors
Turbo Notify is intended for people aged 18 or over and does not knowingly collect data from children or teenagers as users. If we identify such an account, we will close it and delete its data. If a customer's contacts include children or teenagers, the customer, as controller, must comply with the special rules of the LGPD (art. 14).
16. Changes to this policy
We may update this policy. Significant changes will be announced by e-mail or in the dashboard at least 30 days in advance, unless required by law or for security reasons. The date of the last update is at the top of this page.
17. Contact
- Privacy and data protection (data protection officer): privacy@turbonotify.com
- Technical and account support: support@turbonotify.com or WhatsApp +55 11 97311-7056
- Invoices and payments: billing@turbonotify.com
- Sales and resale: sales@turbonotify.com
This policy is written in Portuguese. This English version is a translation, and the Portuguese version prevails in case of conflict.
See also our Terms of Service.