Privacy Policy

Last updated: October 26, 2026

1. Introduction

Alisios ("we", "us", "our") operates a cloud-based platform for CRM, outreach, campaign management, recruiting workflows, messaging coordination, and related business operations (the "Platform").

This Privacy Policy explains how we collect, use, disclose, store, and protect personal data in connection with the Platform. It also explains when Alisios acts as an independent controller and when Alisios acts only on behalf of its clients as a processor / operador.

2. Roles

2.1 Alisios as independent controller. Alisios acts as an independent controller for personal data processed for account creation, login, authentication, security, fraud prevention, support, service administration, analytics about use of the Platform, and compliance with legal obligations.

2.2 Alisios as processor / operador. For contact, candidate, prospect, customer, campaign, and messaging data that clients upload, import, manage, or generate through the Platform ("Customer Data"), Alisios acts as a processor / operador on behalf of the relevant client, which acts as the controller / controlador.

3. Categories of Data We Process

We may process the following categories of personal data:

  • Account and profile data: name, business email address, company, role, login and account identifiers.
  • Authentication and security data: hashed credentials, session identifiers, IP address, device/browser metadata, login history, and security event logs.
  • Support and communications data: messages sent to support, customer success, or operational contacts and the related metadata.
  • Usage data: feature interactions, product telemetry, audit events, and administrative logs.
  • Google account, calendar, and integration data: the Google email address, calendar events, and tokens needed to provide connected features, as described in Section 16, and limited data from other integrations.
  • Customer Data processed for clients: professional contact data, CRM records, candidate information, company affiliations, communication history, message content, timestamps, identifiers, and related workflow data that clients choose to process through the Platform.

4. Sources of Data

We collect personal data:

  • directly from Platform users;
  • from clients who upload or import Customer Data;
  • from integrations and connected third-party services authorized by the user or client; and
  • automatically through use of the Platform and its security systems.

5. How We Use Personal Data

When Alisios acts as an independent controller, we use personal data to:

  • create and administer accounts;
  • authenticate users and secure the Platform;
  • provide customer support and operational communications;
  • monitor service performance, detect abuse, prevent fraud, and maintain audit trails;
  • manage contracts, subscriptions, and billing-related operations;
  • improve, maintain, and troubleshoot the Platform; and
  • comply with legal, regulatory, and contractual obligations.

When Alisios acts as a processor / operador, we process Customer Data only on behalf of our clients and in accordance with their instructions, as reflected in their use of the Platform and related agreements.

6. Legal Bases

Where GDPR applies and Alisios acts as an independent controller, our legal bases generally include:

  • performance of a contract for account provisioning, authentication, support, and service delivery;
  • legitimate interests for service security, fraud prevention, product analytics, internal administration, and service improvement; and
  • compliance with legal obligations where retention, disclosure, or processing is required by law.

Where Alisios acts as a processor / operador for Customer Data, the relevant client is responsible for determining and documenting the lawful basis for that processing.

7. LinkedIn, WhatsApp, and Other Integration Data

If a client connects LinkedIn, WhatsApp, calendars, or other third-party integrations, we process the data made available through those integrations only as necessary to provide the relevant functionality requested by the client.

Clients are solely responsible for ensuring that their collection, import, messaging activity, opt-in management, retention decisions, and other uses of integrated third-party data comply with applicable law and the relevant third-party platform rules.

8. Sharing and Disclosure

We may disclose personal data:

  • to service providers and subprocessors that help us operate the Platform;
  • to professional advisers, auditors, insurers, and corporate affiliates where reasonably necessary;
  • to competent authorities, courts, regulators, or law enforcement where required by law or legal process; and
  • in connection with an actual or proposed merger, acquisition, financing, reorganization, or sale of business assets, subject to appropriate safeguards where required.

We do not sell personal data.

9. Subprocessors and Service Providers

We use third-party service providers to operate the Platform and related business functions. These providers are authorized to process personal data only as necessary for the services they provide to us and under appropriate contractual restrictions.

Our subprocessors include Supabase (database hosting), Recall.ai (meeting recording and calendar sync), OpenRouter (AI processing), Brevo (transactional email), and Unipile (LinkedIn and email connectivity).

Clients may request current subprocessors information by contacting [email protected].

10. International Data Transfers

Personal data may be processed in countries other than the country where it was originally collected.

Where required by applicable law, we implement appropriate transfer safeguards, which may include contractual protections such as standard contractual clauses, transfer impact assessments where appropriate, and other lawful transfer mechanisms recognized under GDPR, LGPD, or other applicable law.

11. Retention

We retain personal data for as long as reasonably necessary for the purposes described in this Privacy Policy, including to provide the Platform, maintain security and audit records, comply with legal obligations, resolve disputes, and enforce agreements.

Retention periods vary depending on the nature of the data, the account status, the client's instructions, legal obligations, and backup and disaster-recovery cycles. When data is no longer required, we delete, anonymize, or de-identify it in accordance with our retention practices and applicable law.

12. Security

We implement technical and organisational measures designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. These measures include access controls, encryption in transit, security monitoring, credential protections, and role-based restrictions appropriate to the nature of the data and the risks involved.

No method of transmission or storage is completely secure. Accordingly, we cannot guarantee absolute security.

13. Data Subject Rights

Depending on your location and the context in which your personal data is processed, you may have rights that include:

  • confirmation of processing;
  • access to personal data;
  • correction of incomplete, inaccurate, or outdated data;
  • anonymization, blocking, restriction, or deletion in certain circumstances;
  • portability where legally applicable;
  • objection to certain processing;
  • withdrawal of consent where processing depends on consent; and
  • information about applicable data-sharing and transfer practices.

If Alisios processes your personal data as a processor / operador on behalf of a client, you should direct your request primarily to that client. We will assist our clients with such requests where required by law or contract.

14. LGPD Rights (Brazil)

Where Brazil's LGPD applies, data subjects may have rights under applicable law, including the rights listed in Article 18 and related provisions. We will handle rights requests in accordance with applicable legal deadlines and regulatory requirements.

15. GDPR Rights (EEA/UK)

Where GDPR applies, data subjects may have the rights listed in Articles 12 to 22 of the GDPR, subject to applicable limitations and exemptions. We will respond without undue delay and, in any event, within the period required by applicable law, which is generally one month and may be extended where legally permitted.

You also have the right to lodge a complaint with your local supervisory authority.

16. Google User Data and Limited Use Disclosure

Users can connect a Google account to the Platform. Alisios's use and transfer to any other application of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

16.1 What we access and why. We request only the Google permissions needed for the features you use:

  • Google account identity (openid, email, profile): your Google email address and basic profile, used to identify which Google account is connected to your Platform account.
  • Google Calendar (https://www.googleapis.com/auth/calendar.events): we read events on your primary calendar (title, start and end time, attendees and their response status, Google Meet link, and whether the time is marked busy) to show your agenda, calculate your availability on scheduling pages, and attribute meetings to the right team member. When someone books or cancels a meeting through a scheduling page, we create or delete the corresponding event, including a Google Meet link, on your calendar.
  • Google Drive and Google Sheets (https://www.googleapis.com/auth/drive, https://www.googleapis.com/auth/spreadsheets): requested only for the Google Sheets publishing feature. We list your Drive folders so you can choose a destination, copy a template spreadsheet into the folder you choose, and write the CRM records of a shared view that you choose to publish into that spreadsheet. We do not read the content of your other files.

16.2 What we store and how we protect it. We store your Google email address, the permissions you granted, and the OAuth access and refresh tokens, which are encrypted at rest (AES-256-GCM) and used only to call Google APIs on your behalf. Calendar events are fetched when needed and cached for up to 15 minutes. Meetings created through the Platform are kept as part of the booking record. Data you publish to Google Sheets is stored in your own Google Drive.

16.3 Sharing. If you enable the meeting notetaker, we pass your Google refresh token to Recall.ai, our meeting-recording provider, so it can read your upcoming calendar events and send a recording bot to the meetings you choose. We do not otherwise share Google user data with third parties except as described in the Limited Use commitments below.

16.4 Retention, disconnecting, and deletion. We keep your Google tokens until you disconnect Google in the Platform's Integrations page or your account is deleted. Disconnecting deletes the stored tokens. You can also revoke Alisios's access at any time at myaccount.google.com/permissions. To request deletion of other Google user data we hold, contact [email protected].

16.5 Limited Use commitments. Our use of information received from Google APIs follows these rules:

  • We use Google user data only to provide and improve the user-facing scheduling, calendar, meeting-recording, and Google Sheets publishing features described above.
  • We do not use Google user data for advertising, including retargeting, personalized, or interest-based advertising.
  • We do not use Google user data to develop, improve, or train generalized artificial intelligence or machine learning models.
  • We do not sell Google user data.
  • We do not permit humans to read Google user data except where you have given affirmative consent, where necessary for security purposes or to investigate abuse, where required by law, or where the data is aggregated and anonymized for internal operations.
  • We do not transfer Google user data to third parties except with your consent where necessary to provide or improve these features, to comply with applicable law, or, with your explicit prior consent, in connection with a merger, acquisition, or asset sale.

17. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will update the effective date above and provide additional notice where required by applicable law.

18. Contact

For privacy questions, data rights requests, or subprocessors information, please contact:

Alisios
São Paulo, Brazil
Email: [email protected]