Privacy Policy

1. Introduction

SOCIOS A.I USA LLC ("we", "Omni Connect") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, share and protect information when you use the Service.

We process personal data in line with the data protection law that applies to you and, where it applies, with the European Union's General Data Protection Regulation.

2. Information We Collect

2.1 Provided by you: registration data (name, email, password, company), payment data (processed by a secure third-party provider), user content (messages, campaigns, imported lists), and support communications.

2.2 Collected automatically: usage data, device and browser information, IP address, cookies, and system logs.

2.3 Lead data (processed on your behalf): the lead data you collect or import is processed on your behalf. You are the controller of this data and Omni Connect acts as the operator; you are responsible for ensuring a legal basis for the processing.

3. How We Use Information

We use the information to:

• Provide, maintain, and improve the Service
• Process transactions and send related notifications
• Respond to requests and provide support
• Send technical notices, security alerts, and administrative messages
• Analyze usage patterns to enhance the experience
• Detect, prevent, and address technical and security issues
• Comply with legal and regulatory obligations

4. Legal Basis for Processing

We process personal data on the following legal bases:

• Performance of a contract: needed to provide the Service
• Consent: when you choose to receive communications
• Legitimate interest: to improve the Service, prevent fraud and, in business-to-business prospecting, process public company data
• Compliance with a legal or regulatory obligation

5. Information Sharing

We do not sell your personal data. We may share it in the following situations:

• Operators/subprocessors that help us operate the Service
• Third-party integrations you choose to connect (WhatsApp, SMS, email, and other channels)
• Compliance with a legal obligation, court order, or request from a competent authority
• Protection of rights, safety, and property
• Corporate transactions, such as a merger or acquisition, subject to this Policy

6. Processors and Subprocessors

Some third parties may process data on our behalf so the Service can run: application and database hosting, the artificial intelligence vendors, and the email address validity service.

The full list, with each one's purpose and country, is kept in the Subprocessors document, which is the version in force and the one to consult. We publish any new addition there at least 30 days in advance.

The channel platforms you connect, such as WhatsApp, Instagram, Messenger, Telegram, and your email or SMS provider, are not our subprocessors: they are services of yours, with their own terms between you and them.

7. International Data Transfers

Your data may be processed on servers located outside the country you are in, according to the subprocessors listed in the Subprocessors document.

We apply appropriate safeguards to those transfers. Where the European Union's General Data Protection Regulation applies, they rely on Standard Contractual Clauses; in other cases, we apply what the law applicable to your processing requires.

8. Data Security

We adopt technical and organizational measures to protect your data, including:

• Encryption in transit (TLS) and at rest
• Role-based access control (RBAC) and per-workspace isolation
• Authentication and identity verification
• Continuous monitoring and logging of security events
• Backups and redundancy
• Periodic security reviews and testing

9. Data Retention

We retain data for as long as necessary to provide the Service and comply with legal obligations. In particular:

• Account data: while the account is active
• Deleted leads (soft delete): permanent deletion within 30 days
• Global cache of public prospecting data: up to 180 days
• Enrichment cache: up to 30 days
• Transaction/tax data: for the period required by Brazilian law
• System logs: for a limited period, according to operational and security needs

10. Your Rights

Under the data protection law that applies to you, and without prejudice to any further rights it grants, you may exercise:

• Confirmation that we process your data, and access to it
• Correction of incomplete, inaccurate or outdated data
• Anonymisation, blocking or erasure of unnecessary data or data processed unlawfully
• Portability to another provider
• Erasure of data processed on the basis of consent
• Information about who we share it with
• Withdrawal of consent, at any time
• Objection to processing carried out on the basis of legitimate interest

To exercise any of these, write to socio@sociosai.com. We acknowledge the request within 5 business days and answer within whatever period the applicable law sets, or within 30 days where it sets none.

11. Cookies and Tracking Technologies

We use essential cookies (functionality), preference cookies (your settings), and analytics cookies (Service usage). You can configure your browser to refuse cookies, but this may limit some functionality.

12. Children's Privacy

The Service is not directed at minors under 18, and we do not knowingly collect data from minors. If we become aware of such collection, we will take steps to delete the data.

13. Data Protection Officer (DPO)

For data protection matters or to exercise your rights, contact our Officer:

• Officer (DPO) · SOCIOS A.I USA LLC
• Email: socio@sociosai.com
• Address: 7550 Futures Drive, Suite 204, Orlando, FL 32819, United States

14. Changes to this Policy

We may update this Policy from time to time. We will post the revised version on this page and update the "Last updated" date. We recommend reviewing it regularly.

15. Contact

If you have questions about this Policy, get in touch:

• SOCIOS A.I USA LLC
• Email: socio@sociosai.com
• Address: 7550 Futures Drive, Suite 204, Orlando, FL 32819, United States

If you are not satisfied with our answer, you may lodge a complaint with the competent data protection authority in your country.