Privacy Policy

1. How We Collect Personal Data

What personal data we collect depends largely on the interaction that takes place between you and Iara, most of which can be categorized as follows:

When you use the Iara Service or interact with an entity that uses an Iara Service. When you use the Iara Service, we store all content you provide, including information relating to you as a customer or end user of the Service. We collect this information directly from you when you enter it, or from integrations you have linked to the Service (Facebook, Instagram, etc.). When you ask us to sign a DPA or other documents, we also receive data about you and your representatives.

In some cases, we may receive information from third parties, for example, from a payment service provider regarding whether your payment was successful.

When you send us emails or messages. When we receive emails or chat messages from you, we may store the content of such emails and attachments, as well as your contact details.

When you submit forms on the Site or participate in our events. When you fill out forms on the Site (contact us, subscription, demo request, event registration, etc.), we collect your contact details and the information you enter in the form. If we organize joint events with our partners, we may receive information from our partners.

When you use the Site. When you use the Site, we collect certain information, as described in more detail below, which may, alone or in combination with other information, constitute personal data (for example, cookie files).

When you participate in our communities. When you participate in our Facebook, Instagram, and other social media groups or accounts, we may see data in your profile and process comments you have posted in our groups.

2. What Types of Personal Data We Process

We collect and process the following personal data:

Customer account details. To create or update your account and provide the Service, we collect from you and from third-party integrations (for example, Facebook, Instagram) information about you as a customer or end user of the Service. This includes ID, name, email, status, linked pages and accounts, products in use, location, gender, etc.

Financial information. To process your payments for the Service subscription, we need your credit card details (last four digits of the card number), account details, and payment information.

Contact details and business data. We receive information about our customers and prospective customers for purposes of cooperation and communication. This includes full name, job title, company, email, or other contact details as necessary.

Requests, messages, and details of submitted forms. We receive and process your messages, support requests, emails, and information you share with us through online forms or social media accounts. This includes the content of such communications, as well as your contact details, if any.

Usage data, logs, and other technical data. When you interact with the Service, metadata and log data are collected automatically. Log data may include your Internet Protocol (IP) address, your browser type and settings, the date and time you used the Service, information about browser configuration plugins, language preferences, the pages or features you browsed, the time spent on those pages or features, the frequency of use of pages and functions, and the links clicked or used. If you use the Service from your phone, this may also include the device type, operating system, device settings, and device identifiers.

Email performance data. To track engagement and performance metrics for our newsletters, we may use a 'clear image' (gif) in email communications. Much of this data is aggregated. If you wish to opt out of this tracking, you may do so by disabling images in the email itself.

Website cookies and similar technologies. We use cookie technology on the Site. See details in the Cookie Statement. In particular, the Site uses a first-party functional cookie named iara_arm, valid for 90 days, which stores only the identifier of the homepage version displayed to you (for example, "a1"), so that you see the same version on subsequent visits. This cookie does not contain personal data and does not identify you individually. The Site also loads the Meta Pixel, which writes the _fbp and _fbc cookies (valid for 90 days) to measure and attribute advertising campaigns; these pseudonymous identifiers are sent to Meta by the Pixel itself and, for the same purpose, included in the server-to-server copy of the event that we transmit to Meta (Conversions API), as described in the section on advertising partners. In addition, the WhatsApp message pre-filled by the Site carries an invisible technical marker that contains only the page version identifier and an opaque visit key, used to attribute the conversation initiated to the visit to the Site; this marker does not contain personal data.

Customer Content. When using our Service or interacting with our Service, you may import into our system personal data that you have collected from your users or from you, customers, prospective customers, social media and messaging platform contacts (collectively, “Subscribers”), or other individuals. Customer Content also includes any “User-Generated Content”, as defined in our Terms of Service. We process this data solely on your behalf as our customer. We have no direct relationship with your Subscribers or with anyone other than you and, for that reason, you are responsible for ensuring that you have the appropriate permission and legal basis for us to collect and process information about these individuals and that you have informed these individuals about the collection of personal data by the Service, the provisions of this Privacy Policy, and the Data Processing Addendum. For information on how we process personal data relating to Subscribers, please refer to our Data Processing Addendum.

We ask that you not send or disclose to us any sensitive personal data (for example, depending on your applicable data protection law, the following may be considered sensitive data: social security numbers, information related to racial or ethnic origin, political opinions, religion or other beliefs, health, biometrics or genetic characteristics, data concerning health or sex life, criminal record, trade union membership, or membership in a religious, philosophical, or political organization) on or through the Service or otherwise.

3. For What Purposes We Use Personal Data

We collect and process your personal data for the following purposes:

To operate the Service: We use data to enter into the contract with you as a customer and to operate, maintain, and administer your account on the Service, as well as to communicate with you about the account (sending announcements, technical notices, updates, security alerts, and support and administrative messages) and to respond to requests, questions, and feedback related to the Service. We also use your data to fulfill our billing obligations.

To provide the Service. We process Customer Content information on your behalf as a customer (see details in the Data Processing Addendum).

To communicate with you and inform you about the Service. If you request information from us, register for the Service, complete a form or feedback on a Site, or participate in our surveys, promotions, or events, we may send you marketing communications related to Iara, if permitted by law. In all such communications, we will provide you with the option to unsubscribe. We may also use personal data collected about you to display advertising campaigns on social media.

To hold events and communicate with you. We use your personal data, which you provided when registering for the event, to send reminders about the event, event-related communications, and communications about Iara-related services. In addition, we may ask for your feedback. In our communications, we always offer the option to unsubscribe from communications.

To comply with the law. We use your personal data as necessary to comply with applicable laws, including sanctions requirements, accounting and tax obligations, legal proceedings or audits, and to respond to subpoenas or legally binding requests from government authorities. Before disclosing any information to an authority upon its request, we carefully verify the validity of such request.

To negotiate, enter into, and perform contracts. We have to collect and process information about our counterparties and their representatives in order to negotiate and enter into legally valid contracts and to cooperate with them.

For compliance and security. We use your personal data as we believe necessary or appropriate to (a) enforce the terms and conditions governing the Service; (b) protect our rights, privacy, safety, or property, and/or those of you or others; and (c) protect against, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity.

We may also use anonymized Customer Content for product improvement or analytical purposes.

4. How We Share Personal Data

We do not sell your data to third parties for commercial or advertising purposes. We share your data as described in this Privacy Policy or upon obtaining your consent to such data sharing.

We disclose personal data to third parties in the following circumstances:

Service Providers. We engage third-party companies and individuals to assist us in performing certain activities, for example, payment service providers. We also use third-party software to process data (for example, CRM, email agent, cloud storage solutions, etc.). See the list of all processors and sub-processors at www.mermaid.chat/legal/service-providers. We also use third-party cookies on the Site. See more details in the Cookie Statement. These third parties are permitted to use personal data about you only to perform these tasks, solely for lawful business purposes, in accordance with the terms of the agreement(s) we have in place with such service providers, and for no other purpose.

Advertising Partners. We may share limited personal data with our advertising partners to measure the effectiveness of our advertising, build or refine audiences, and (where permitted by law or with your consent) personalize ads. This may include sharing certain identifiers (for example, a hashed email address or other pseudonymous identifiers) so that they can recognize you across devices and platforms and perform ad measurement and attribution (for example, Customer Match / Enhanced Conversions). We do not disclose raw email addresses to advertising partners; when used, identifiers are encrypted using a one-way algorithm (for example, SHA-256) and transmitted securely. Such processing is carried out on the basis of your consent, where required (for example, through our Cookie Statement/preferences), or our legitimate interests in promoting and improving our Services.

Professional Advisors. We may disclose your personal data to professional advisors, such as lawyers, bankers, auditors, and insurers, where necessary in the course of the professional services they render to us.

Third-Party Applications and Integrations. To provide the Service, we receive and share data with integrations and applications linked by customers (Facebook, Instagram, Stripe, Paypal, etc.), as well as applications developed through the “Iara Developer Program”.

Business Transfers. As we develop our business, we may sell or buy businesses or assets. In the event of a corporate sale, merger, reorganization, dissolution, or similar event, personal data may form part of the transferred assets. You acknowledge and agree that any successor to or acquirer of Iara (or of its assets) will continue to have the right to use your personal data and other information in accordance with the terms of this Privacy Policy. In addition, Iara may also disclose aggregated personal data to describe our Service to potential acquirers or business partners.

Compliance with Laws and Law Enforcement. Iara may disclose information about you to government or law enforcement officials or to private parties as required by law, and may disclose and use such information as we believe necessary or appropriate to (a) comply with applicable laws and lawful requests and legal process, such as responding to subpoenas or requests from government authorities; (b) enforce the terms and conditions governing the Service; (d) protect our rights, privacy, safety, or property, and/or those of you or others; and (e) protect against, investigate, and deter fraudulent, harmful, unauthorized, unethical, or illegal activity.

Corporate Affiliates. We may share personal data with our corporate affiliates. See the list at www.mermaid.chat/legal/service-providers.

5. Your Data Protection Rights and Choices

You, including any data subject whose personal data is processed by Iara in its capacity as data controller, may have the following rights, depending on the applicable legislation in your jurisdiction:

If you wish to confirm the existence of processing of your personal data or to access your personal data that Iara collects, you may do so at any time by contacting us.

You may also contact us to update or correct incomplete, inaccurate, or outdated data, or to delete information in your account. See more details on how to delete your account.

You have the right to request information about the sharing of data and with whom it is shared.

You have the right to request information about the possibility of not providing consent and the consequences of refusal.

If you are in the European Economic Area (“EEA”), the United Kingdom, Brazil, or Switzerland, you may object to the processing of your personal data, ask us to restrict the processing of your personal data processed with consent, or request the portability of your personal data where technically feasible.

Likewise, if you are in the EEA, the United Kingdom, Brazil, or Switzerland, and provided that we have collected and processed your personal data on the basis of your consent, you may withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we carried out prior to its withdrawal, nor will it affect the processing of your personal data carried out on the basis of other lawful grounds for processing.

You have the right not to be subject to a decision based solely on automated processing, including profiling, that produces legal effects ("Automated Decision-Making");

You have the right to obtain additional information about international transfers of your Personal Data and to access the contractual regulation of such transfers.

You have the right to lodge a complaint with a data protection authority about our collection and use of your personal data. Contact details for data protection authorities in the EEA, Switzerland, and certain non-European countries (including the US and Canada) are available here, and the service of the ANPD (Brazil's National Data Protection Authority) for this purpose is available here.

You may submit your request through the "Privacy and Security Section of the Support Page" or by sending an email to [email protected]. We will respond to all requests in accordance with applicable data protection laws.

Access to Data Controlled by Our Customers. We have no direct contractual relationships with our customers’ Subscribers, that is, the individuals whose personal data is stored by our customers in the Service. An individual who seeks access to, or who seeks to correct, amend, or delete, personal data processed in the Service by our customers is advised to initially direct their request directly to the Customer.

6. How Long We Retain Personal Data

We will retain your personal data only for as long as necessary to fulfill the purposes for which it was collected or otherwise processed, and in accordance with applicable laws and legitimate business requirements.

For example, we will retain and process personal data within the Service until you terminate the Agreement with us, or until your user account is closed at your explicit request or due to prolonged inactivity, as set forth in our Terms of Service. Once your account is deleted or deactivated, we will securely delete or anonymize your personal data, unless a longer retention period is required by law or necessary to establish, exercise, or defend legal claims.

If you are located in Brazil, we are also required to store access logs for a period of 6 months to meet the requirements set forth in the Brazilian Internet Civil Framework (Marco Civil da Internet) (Law 12,965 of April 23, 2014).

We may also store some data for a retention period required by law or for the period necessary to resolve disputes, prevent abuse, and enforce our agreements.