Legal documents

1. Who provides the service and what these Terms cover

SkyInbox is provided by SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, Brazilian company registration (CNPJ) 05.699.856/0001-10, with its address at Quadra ACSE 1, Rua SE 1, nº 38, sala 10, 2º andar, Plano Diretor Sul, Palmas–TO, CEP 77020-014, Brazil.

These Terms apply to all of SkyInbox: the website skyinbox.com.br, the service dashboard at app.skyinbox.com.br, the pipelines and features at kanban.skyinbox.com.br, the chatbots that Skills IT publishes for the customer, the API and the connected channels. In this document, “SkyInbox” means the service or its provider, as the context requires.

SkyInbox is an omnichannel customer service platform with artificial intelligence, offered as a managed service: hosting, updates, maintenance and support are provided by Skills IT. The customer contracts for a working service and does not receive a software licence to install, source code, container images or any right to run the platform on its own infrastructure.

2. Acceptance and order of precedence

These Terms take effect when the company contracts for the service or starts using it. Whoever accepts on behalf of a company represents that they have authority to bind it. The service is intended for professional use by adults.

In the event of a conflict, the following order applies: (1) the commercial proposal or signed contract, for the conditions expressly negotiated; (2) the Data Processing Agreement, for everything concerning personal data processed on the customer's behalf; (3) these Terms; (4) the Privacy Policy; (5) the descriptions published on the website.

3. Account, users and access

The account belongs to the contracting company and is created by Skills IT during onboarding. Dashboard users are created by the company, with the access profile it defines, and sign in with email and password or with a Google account, when that option is chosen.

Each person uses their own credentials. Shared credentials are the company's responsibility and make the audit trail unworkable. The company is responsible for what its users do in the dashboard, including the messages sent to its customers, and must revoke access that is no longer needed. Any suspected unauthorised access must be reported immediately to contato@skyinbox.com.br.

4. Plans, limits and billing

The current plans, with prices in Brazilian reais and the limits of each, are listed on the plans and pricing page. The commercial proposal confirms the plan, price, billing period, adjustment and payment terms before the contract is signed.

The plan counts conversations handled and replies sent by Sky, as described on the pricing page. When a limit is reached, the company is notified and service is not interrupted: an add-on pack or a plan change is offered.

Non-payment may lead to suspension of access, after prior notice and an opportunity to settle. Data is preserved during the suspension.

5. Consultative Onboarding

Consultative Onboarding is a service charged separately from the monthly fee, with price and scope set out in a proposal after the assessment. It covers the assessment of the operation, building the knowledge base from material provided by the company, defining Sky's rules, connecting the channels and following the operation for the agreed period.

Delivery depends on the company's cooperation: providing the material, making the people who know the customer service available for meetings and approving texts before they are published. Deadlines are suspended while any of these dependencies is outstanding. Approval of the official WhatsApp account is Meta's decision, and its timing is not controlled by Skills IT.

6. Third-party costs and rules

Meta charges for WhatsApp directly to the company, and that charge does not go through Skills IT. The company registers its own payment method in the WhatsApp account. A message initiated by the company outside the 24-hour window requires an approved template and is always charged; from October 1, 2026, replies within the window are also charged by Meta.

Use of each channel is subject to the policies of its operator. A block or restriction imposed by Meta or another channel for breach of its policies is the operator's decision: Skills IT helps to understand it and to appeal, but cannot reverse it. Channels and integrations that depend on the customer's own account, such as Twilio, Bandwidth, Dialogflow or video providers, are governed by the contracts the customer has signed with them and are billed by them.

7. Content and ownership

The content belongs to the customer. Conversations, contacts, attachments, knowledge base, pipelines and reports belong to the contracting company. It authorises Skills IT to store, process, transmit and create technical derivatives of that content, such as search indexes and vectors, only to the extent necessary to provide, maintain, protect and support the service, under the Data Processing Agreement.

Skills IT and the artificial intelligence model providers it selects and contracts do not use customer data, including messages, knowledge base documents and generated replies, to train artificial intelligence models. This authorisation does not grant any licence to commercialise the customer's content either.

The platform belongs to Skills IT and its licensors. Brand, interface, configuration and whatever Skills IT develops remain with their respective owners. The contract grants a right of use, not ownership.

8. Sky and what it does not guarantee

Sky is the artificial intelligence in SkyInbox. It answers based on the company's knowledge base and the rules defined during onboarding, and it is set up to hand over to a person when no article covers the question and on the subjects marked as human-only.

No artificial intelligence gets every case right, and Skills IT does not promise that. The quality of a reply depends on the quality and currency of the knowledge base, which is the company's content. The company remains responsible for the service provided to its customers, just as it is with its human team, and must carefully assess the use of Sky on regulated matters, with sensitive data or with significant impact on people.

What Skills IT delivers is the control mechanism: limits by subject and by channel, a record of every reply in the conversation history, the ability to switch Sky off at any time and the follow-up of the operation for the period set out in the Consultative Onboarding proposal.

9. Acceptable use

SkyInbox may not be used to:

• send unsolicited bulk messages or use contact lists obtained without a legal basis;
• commit fraud, scams, harassment, unlawful discrimination, hate speech or any unlawful purpose;
• collect sensitive personal data or data of children and adolescents through the channels without a legal basis and without the safeguards required by the LGPD;
• try to circumvent plan limits, access another account's data or bypass security controls;
• test the platform's security without written authorisation;
• impersonate third parties in a misleading way;
• resell, sublicense or offer the service to third parties as one's own without a specific contract.

10. Availability and support

Support channels and response times vary by plan: email and WhatsApp on Essencial and Profissional, priority support on Business and dedicated support, with an account manager, on Enterprise.

A formal availability commitment exists on the Enterprise plan, with availability and response-time targets defined in the contract. The other plans have no contractual availability SLA. Skills IT provides the service with professional diligence, gives advance notice of scheduled maintenance whenever possible and reports significant interruptions through its support channels.

11. Suspension and termination

• At the customer's initiative: the fee is monthly and cancellation follows the signed contract. Services already performed, such as Consultative Onboarding, are not refunded.
• For non-payment: suspension of access after prior notice, with data preserved.
• For misuse: in the event of a breach of section 9, immediate suspension with notice of the reason. Where there is risk to third parties or a legal order, suspension may precede the notice.
• At Skills IT's initiative, with no fault on the customer's part: 60 days' prior notice and a pro rata refund of anything paid in advance.

On termination, the company may export contacts, conversations and reports in an open format. The request must be made before the end of the contract or within 30 days after it; after that period, the data is deleted as described in the Data Processing Agreement. Cancelling the plan is not the same as immediately deleting every record.

12. Liability

Skills IT is liable for failures in providing the service under the law and the contract. Except in cases of wilful misconduct or where the law provides otherwise, liability is limited to the amount paid by the company in the 12 months before the event and does not extend to loss of profits.

Skills IT is not liable for unavailability or policy changes of third-party channels, for content sent by the company or its users, or for business decisions made on the basis of a platform report. Nothing in these Terms excludes rights or liabilities that the law does not allow to be excluded by contract, including those under consumer protection law where it applies to the relationship.

13. Versions, languages and governing law

Material changes to these Terms are notified by email at least 30 days in advance, and a company that does not agree may terminate without penalty up to the effective date. Each version remains published at its own dated address, and a new publication does not retroactively change what was accepted before.

Portuguese, English and Spanish present the same contractual basis. In case of any divergence in interpretation, the Portuguese version prevails, unless a specific contract or mandatory rule provides otherwise.

These Terms are governed by Brazilian law. Disputes will be submitted to the legally competent court. Before taking any legal action, the parties undertake to seek an amicable solution by email at contato@skyinbox.com.br.

1. Who processes the data and what this Policy covers

SkyInbox is operated, hosted and supported by SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, Brazilian company registration (CNPJ) 05.699.856/0001-10, Quadra ACSE 1, Rua SE 1, nº 38, sala 10, 2º andar, Plano Diretor Sul, Palmas–TO, CEP 77020-014, Brazil. Privacy contact: contato@skyinbox.com.br. Data protection officer: Adriano Fante, through the same contact.

This is the single Privacy Policy of SkyInbox: it covers the website skyinbox.com.br, the service dashboard at app.skyinbox.com.br, the pipelines and features at kanban.skyinbox.com.br, the chatbots published by Skills IT and the connected channels.

2. Three people, three roles

A customer service platform involves three different people with data at stake, and the LGPD (Brazil's General Data Protection Law) treats each one differently. Almost every question about responsibility is settled here.

Who	Which data	Role of Skills IT
Website visitors	Contact sent through the form and, with consent, audience measurement	Controller
The customer company and the dashboard users	Registration, billing, credentials, access and activity logs	Controller
The customer company's own customer, the person who messages the company on WhatsApp, Instagram, email or the chat on its website	Conversations, attachments, contact details, notes and data collected by chatbots	Processor, on behalf of and under the instructions of the customer company, which is the controller

In the third case, it is the customer company that decides what is collected and why. Skills IT processes that data within the limits of the Data Processing Agreement, and the privacy policy that applies to that person is the one of the company they spoke to.

3. What data is processed

On the website. Name, company, email, phone number, team size and any free text written in the contact form. The request reaches the Skills IT sales team by email and is recorded in the company's sales system, together with the IP address it was sent from, used only to block automated bulk submissions and deleted within 180 days. With consent, audience and performance measurement data is also processed, as described in the Cookie Policy.

On the platform. Registration data of the company and of dashboard users (name, email, access profile, Google identity when that sign-in is chosen), access and activity logs, and the content of customer service conversations: messages, attachments, audio, images, contact details, labels, notes, pipeline cards and answers collected by chatbots.

What we do not ask for. The website does not ask for identity documents, bank details or sensitive information in any form. A request of that kind on behalf of SkyInbox outside the dashboard is not ours.

4. Purposes and legal bases

Where Skills IT is the controller, each purpose has its own legal basis (article 7 of the LGPD):

Purpose	Legal basis
Replying to a contact made through the website	Preliminary steps related to a contract, at the data subject's request
Providing the contracted service: creating accounts, connecting channels, keeping the dashboard running and providing support	Performance of a contract
Invoicing and collection	Performance of a contract and compliance with legal and tax obligations
Platform security: access logs, login attempt limits and abuse prevention	Legitimate interest, balanced against the impact on the data subject, and legal obligation regarding logs
Measuring the website's audience and performance	Consent, collected in the cookie notice and revocable at any time
Exercising rights in judicial, administrative or arbitration proceedings	Regular exercise of rights

For customer service conversations, the legal basis is defined by the customer company, which is the controller. Skills IT processes that data under its instructions.

5. What Sky does with the content

Sky is the artificial intelligence in SkyInbox. To answer a customer, it reads the ongoing conversation and the articles in that company's knowledge base and generates the reply from them.

• No cross-account use. One company's knowledge base and history never feed the reply given to another company's customer.
• There is third-party processing. Text generation uses a language model provider contracted by Skills IT, to which the necessary excerpt of the conversation is sent at the time of the reply. The knowledge base is converted into search vectors by a provider of the same kind. The providers are listed under subprocessors.
• No training on your data. Neither Skills IT nor the model providers it contracts use messages, documents or generated replies to train artificial intelligence models.
• Sky may record notes about a contact, to give context to the next conversation. These notes are visible to the team, can be edited and deleted, and are removed together with the contact.
• The company sets her limits, including switching her off on any channel. What she answers and what she hands over is described in what Sky does not do.

6. Who the data is shared with

Skills IT does not sell personal data or share it for third-party advertising. Data is shared only with those needed for the service to work:

• the subprocessors that host the platform, generate Sky's replies and deliver the website, listed under subprocessors;
• the channel operators that the customer company chooses to connect (Meta for WhatsApp, Instagram and Messenger, Telegram, email providers and others). Without them messages can neither arrive nor be sent, and each has its own terms, accepted by the company when connecting the account;
• services contracted directly by the customer company and connected by it, such as Twilio, Bandwidth, Dialogflow or video providers, which are governed by the contracts between them;
• public authorities, when there is a legal order. In that case Skills IT notifies the affected customer, unless the order itself forbids it.

7. How long data is kept

Data	Period
Contact made through the website	For as long as the sales conversation lasts and up to 12 months after it, to resume the conversation. Deletion can be requested earlier
Contact form IP address	Up to 180 days
Customer service conversations	For the duration of the contract, with full history on every plan. The customer company may request deletion earlier. On termination, export can be requested within 30 days, after which the data is deleted
Registration and billing	For the duration of the contract and, after it, for the periods required by tax and civil law
Access logs	For the period set out in Brazil's Civil Rights Framework for the Internet (Marco Civil da Internet)
Backups	Daily routine with 7-day retention. Deleted data leaves the service immediately and disappears from backups at the end of that cycle

8. Data subject rights

Article 18 of the LGPD guarantees, over your personal data, the rights of confirmation and access, correction, anonymisation, blocking or deletion, portability, information about sharing, withdrawal of consent and objection. The full procedure, with deadlines, is in data protection and your rights.

Anyone who is a customer of a company that uses SkyInbox and wants to exercise these rights over the conversation they had with it should send the request to that company, which is the controller. If the request reaches Skills IT, it is forwarded to the company and the person is informed.

9. Security

The measures in place are described on the security page: own infrastructure administered by Skills IT, isolation of data and knowledge base by company, encryption in transit, passwords stored encrypted, login attempt limits, permission profiles, audit trail from the Business plan upwards and daily backups with seven-day retention.

Skills IT does not claim any formal security certification: it holds neither SOC 2 nor ISO 27001. If a security incident poses relevant risk or harm to data subjects, the affected customers and the ANPD (Brazil's data protection authority) are notified within the legal deadlines.

10. International transfers

Some of the providers needed for the service process data outside Brazil: the cloud provider, the channel operators and the artificial intelligence providers used by Sky. These transfers take place to perform the contract and follow the safeguards required by chapter V of the LGPD in the contracts signed with each provider. The list of subprocessors identifies each one.

11. Children and adolescents

SkyInbox is a work tool and is not intended for people under 18. Skills IT does not intentionally collect data from children and adolescents on the website. If the customer company serves this audience through the connected channels, it is up to the company, as controller, to obtain parental consent as required by article 14 of the LGPD.

12. Changes to this Policy

Each version of this Policy remains published at its own dated address. When a change materially alters how data is processed, customers are notified by email before it takes effect.

The Portuguese, English and Spanish versions describe the same processing. In case of any divergence, the Portuguese version prevails.

1. Parties, roles and subject matter

This Agreement forms part of the SkyInbox contract between the customer company and SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, Brazilian company registration (CNPJ) 05.699.856/0001-10, Quadra ACSE 1, Rua SE 1, nº 38, sala 10, 2º andar, Plano Diretor Sul, Palmas–TO, CEP 77020-014, Brazil, provider of SkyInbox.

It applies to the personal data that Skills IT processes as processor, on behalf of the customer company, which is the controller: mainly the data of the company's own customers, which arrives through the channels connected to SkyInbox. If the customer company in turn acts as processor for another controller, it represents that it is authorised to engage Skills IT as sub-processor and to give valid instructions.

The processing that Skills IT carries out as controller, such as registration, billing, security and sales contact, is governed by the Privacy Policy.

2. Description of the processing

Element	Scope
Purpose	Providing the contracted omnichannel customer service: receiving, organising and answering conversations, generating Sky's replies and suggestions, running pipelines, chatbots, reports and integrations
Operations	Receipt, storage, organisation, retrieval, transmission to the necessary channels and providers, generation of replies by artificial intelligence, vectorisation of the knowledge base, export and deletion
Data subjects	Customers and prospective customers of the customer company, people who get in touch through the connected channels and dashboard users
Data	Name, phone number, email, identifiers on the connected networks, message content, attachments, audio and images, labels, notes, data collected by chatbots and records associated with conversations
Duration	The term of the contract and the period needed for export, deletion or retention required by law

The customer company decides what is collected and must avoid unnecessary data. Sensitive data and data of children and adolescents require their own legal basis and additional safeguards, which must be agreed with Skills IT before the processing takes place.

3. Documented instructions

Skills IT processes the data only on the documented instructions of the customer company: the contract, this Agreement, the settings made in the dashboard and requests sent by authorised representatives, including with regard to transfers. If the law requires different processing, Skills IT informs the customer company beforehand, unless the law prohibits such notice.

If it considers an instruction incompatible with the law, Skills IT informs the customer company and may suspend the affected flow until it is clarified. The customer company is responsible for the lawfulness of its instructions, for the information given to data subjects and for the access permissions it grants.

4. Authorised persons and security

Anyone at Skills IT who processes the data is bound by a duty of confidentiality, contractual or statutory, and has access appropriate to their role.

Skills IT maintains technical and organisational measures proportionate to the risk, reviewed while the service is provided. They currently include isolation of data and knowledge base by company, encryption in transit, passwords stored encrypted, login attempt limits, permission profiles, an audit trail from the Business plan upwards, key-only server access and daily backups with seven-day retention. The customer company may request information about these controls to assess whether they are adequate for its processing.

The customer company administers the users, credentials, channels and integrations it connects, and must keep them consistent with its own instructions.

5. Subprocessors and changes

The customer company gives general authorisation for the subprocessors needed for the features it uses, described in the list of subprocessors. Channel operators (such as Meta, for WhatsApp, Instagram and Messenger) and the services the customer company contracts itself and connects to SkyInbox are governed by the terms it accepts with them.

Before adding or replacing a subprocessor that processes the data covered, Skills IT notifies the customer company through the registered contact, with a reasonable period to raise a reasoned objection, sent to contato@skyinbox.com.br. The parties will seek a workable alternative. While the objection remains unresolved, the affected flow may be unavailable; if no solution is found, it may be terminated in accordance with the contract.

Skills IT requires its subprocessors to accept data protection obligations consistent with this Agreement and remains responsible to the customer company for the performance of the obligations it entrusts to them, to the extent provided by law.

6. Sky and the artificial intelligence providers

When Sky is active, the necessary excerpt of the conversation and the relevant knowledge base articles are sent to the language model provider at the time of the reply, and the knowledge base is converted into search vectors. This transmission serves exclusively to generate the reply or suggestion requested.

Skills IT and the model providers it selects and contracts do not use the customer company's data, including messages, knowledge base documents and generated replies, to train artificial intelligence models. Skills IT undertakes to maintain this condition when selecting and contracting those providers. One company's knowledge base and history are never used in the reply given to another company's customer.

7. Assistance to the customer company

Taking into account the nature of the processing and the information available, Skills IT assists the customer company in responding to data subject requests, with security, with impact assessments and with consultations with the ANPD (Brazil's data protection authority), where required.

A data subject request that reaches Skills IT directly about the customer company's data is forwarded to the company, and the response does not go beyond the company's instructions, unless the law requires otherwise. The dashboard allows the customer company to find, export and delete contacts and conversations without depending on Skills IT.

8. Personal data incidents

Skills IT notifies the customer company without undue delay after becoming aware of an incident affecting the data processed on its behalf. The first notification may be supplemented later; the investigation does not need to be complete before notice is given.

The notification states, where available, the nature of the event, the data and people affected, the likely consequences, the containment measures and a contact. Skills IT cooperates in the investigation and mitigation. It is for the customer company, as controller, to assess and make the notifications for which it is responsible, within the applicable deadlines.

9. Return and deletion

On termination, the customer company may export contacts, conversations and reports in an open format. The request must be made before the end of the contract or within 30 days after it. After that period, Skills IT deletes the data covered, unless retention is required by law.

Deletion includes the relevant derivatives, such as knowledge base indexes and vectors, notes and records containing conversation content. Backups disappear at the end of the seven-day cycle; if a restore takes place during that period, the deletion is applied again. Skills IT confirms in writing what was deleted and what was retained because of a legal obligation.

10. International transfers

Some subprocessors process data outside Brazil. Skills IT undertakes to adopt a valid mechanism for these transfers where the law requires it, taking into account the parties, the destination and the flow, including the standard contractual clauses approved by the ANPD where they are the applicable instrument.

The customer company may request information about each flow and the safeguards adopted. Any specific territorial restriction must be agreed before the corresponding processing.

11. Demonstration of compliance and audit

Skills IT makes available the information needed to demonstrate compliance with this Agreement and allows audits by the customer company or by an auditor it authorises. The parties agree on the scope, notice and protection of third-party information, without defeating the legal right to audit. Intrusive tests require written authorisation.

12. Precedence, languages and duration

This Agreement prevails over the Terms of Service in any conflict regarding the processing it covers. The Portuguese version governs any divergence in translation, unless the contract or the law provides otherwise.

The data protection obligations remain in force for as long as Skills IT holds data covered by this Agreement. Each version remains published at its own dated address, and a new publication does not retroactively change what was accepted before.

Contact: contato@skyinbox.com.br.

1. How to read this list

SkyInbox is provided by SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, Brazilian company registration (CNPJ) 05.699.856/0001-10. This page lists the external services that may take part in processing data, organised by purpose. Which of them take part in each operation depends on the features and channels the customer company uses.

It complements the Data Processing Agreement, which sets out the obligations for selecting, contracting and supervising these providers.

2. Customer service platform

Service	Purpose	Data and condition of use
Microsoft Azure	Platform hosting: server, storage and backups	All platform content, stored on the infrastructure administered by Skills IT
OpenRouter	Routing of calls to Sky's language model	Conversation excerpt, relevant knowledge base articles and generated reply, when Sky is active
OpenAI	Sky's language model and knowledge base vectorisation	Conversation excerpt, knowledge base articles and generated reply, when Sky or a chatbot AI block is active
Google Cloud Translation	Automatic message translation	Text of the messages to be translated, only when the feature is enabled for the account
Google	Sign-in to the dashboard with a Google account	Name, email and account identifier, only for those who choose this sign-in

Skills IT and the model providers it selects and contracts do not use messages, documents or generated replies to train artificial intelligence models.

3. Channels and services connected by the customer company

Channel operators deliver and receive messages. They are connected by the customer company, which accepts each operator's terms when connecting the account:

Service	Channel
Meta	Official WhatsApp Business API (direct connection, no intermediary), Instagram and Messenger
Telegram	Telegram
The customer company's email provider	Mailboxes connected as a channel

Services that depend on the customer company's own account, such as Twilio and Bandwidth (voice and SMS), Dialogflow and video call providers, only process data when the company enables them, and are governed by the contract between the company and the provider.

4. Company website

Service	Purpose	Data and condition of use
Vercel	Hosting and delivery of the website skyinbox.com.br	Web requests, IP address and technical access data
Vercel Web Analytics	Website audience measurement	Technical browsing data, only with consent
Vercel Speed Insights	Website performance	Loading and visual stability metrics, only with consent
Google Analytics	Website audience measurement	Page path, traffic source, campaign markers and actions on the website, only with consent

Contact requests sent through the website are delivered by email, through the mail server of the skyinbox.com.br domain, and recorded in the Skills IT sales system. The Cookie Policy details the measurement that requires consent.

5. Internal components

Chatwoot, KanbanCW, Typebot, PostgreSQL, Redis and Nginx are software components of the platform that run on the infrastructure administered by Skills IT. They are not external providers receiving data, which is why they are listed separately from the list above.

6. Changes and contact

Before adding or replacing a subprocessor that processes data on behalf of the customer company, Skills IT gives notice through the registered contact, with a period to object, as set out in the Data Processing Agreement. This list is updated at the same time, with a new dated version.

Contact: contato@skyinbox.com.br.

1. Contact channel

SkyInbox privacy requests are received by SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, Brazilian company registration (CNPJ) 05.699.856/0001-10, at contato@skyinbox.com.br. The data protection officer is Adriano Fante, who responds through this channel to data subjects and to the ANPD (Brazil's data protection authority).

Address: Quadra ACSE 1, Rua SE 1, nº 38, sala 10, 2º andar, Plano Diretor Sul, Palmas–TO, CEP 77020-014, Brazil.

State your request, the email address or phone number related to the data and, where applicable, the company you spoke to. Do not send passwords or copies of documents before receiving guidance on the appropriate channel. Representatives may submit the corresponding authorisation.

2. Who to address the request to

Skills IT is responsible for the processing in which it is the controller: contacts made through the website, the registration and billing of customer companies and the dashboard users.

If you spoke to a company that uses SkyInbox, through its WhatsApp, Instagram, email or website chat, the company itself decides about that data, as the controller. The request should go to it. If it reaches Skills IT, it is forwarded to the company and you are informed. More details are in the Privacy Policy and in the Data Processing Agreement.

3. Rights that can be exercised

Depending on the LGPD (Brazil's General Data Protection Law) and the specific situation, you can request:

• confirmation that processing exists and access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability to another provider, under the applicable legal and technical conditions;
• deletion of data processed on the basis of your consent;
• information about who your data is shared with;
• information about the possibility of not giving consent and the consequences of refusing;
• withdrawal of consent, without invalidating processing carried out before;
• objection to processing based on legitimate interest;
• review of a decision taken solely on the basis of automated processing that affects your interests.

4. Deadlines and verification

The request is recorded, identity and scope are verified, and you receive the action taken or the reason for not taking it. Identity verification is the only way to avoid handing your data to someone else, and it is proportionate to the request.

Confirmation that processing exists or access in simplified form is provided immediately; a full statement within 15 days of the request, as provided for in the LGPD.

5. Limits and retention

Data subject to legal retention, such as tax and access records, is kept only within the scope and for the period the law requires, and the response explains why. Deletion includes backups, which disappear at the end of the seven-day cycle.

To request deletion, say so expressly, including when you also ask to cancel the plan: cancelling is not the same as deleting.

6. Complaints

You can complain to the National Data Protection Authority (ANPD) at any time and use any other legal remedies.

The Portuguese, English and Spanish versions describe the same procedure. Source: LGPD, especially articles 18 to 20.

1. One policy for the website and the dashboard

This Policy forms part of the Privacy Policy and applies to the website skyinbox.com.br and to the service dashboard at app.skyinbox.com.br. The party responsible is SKILLS IT SOLUCOES EM TECNOLOGIA LTDA, trading as Skills IT, Brazilian company registration (CNPJ) 05.699.856/0001-10. Contact: contato@skyinbox.com.br.

2. Categories

Category	Purpose	Your choice
Necessary	Keeping you signed in to the dashboard, protecting the session, storing your cookie choice and your theme preference	Always on, because the service does not work without them
Audience measurement	Counting visits per page, traffic sources and actions on the website, such as clicking WhatsApp, choosing a plan or submitting the form	Optional; off until you consent
Performance	Measuring page load time and visual stability	Optional; off until you consent

The two optional categories can be accepted or refused separately. Refusing them changes nothing about what you can read or do: no page depends on them.

3. Inventory and duration

Technology	Category and purpose	Where	Duration
skyinbox_privacy_consent	Necessary: records the version, the measurement and performance choices and the date of the decision	Website	Up to 180 days from the choice
Theme storage	Necessary: remembers whether you prefer the light or dark theme	Website	Until you change the theme or clear the browser
cw_d_session_info and dashboard session cookies	Necessary: keeping the user signed in and protecting the session	Dashboard at app.skyinbox.com.br	For the duration of the session, subject to security controls
Vercel Web Analytics	Audience measurement: pages, traffic source and technical browsing data	Website	Runs only with consent
Vercel Speed Insights	Performance: loading metrics	Website	Runs only with consent
Google Analytics, including _ga and _ga_<id>	Audience measurement: page path, traffic source, campaign markers (such as utm and gclid) and actions on the website	Website	Only with consent; cookies set for up to 180 days

The address sent for measurement is the page path; from the query string, only campaign markers are sent, without the fragment. What you type in forms is not included, and there is no personal identification. The service dashboard does not load any audience measurement or advertising tool.

The chat that a customer company installs on its own website also stores a conversation identifier (cw_conversation) in the visitor's browser, so that they can pick the conversation up where they left off. In that case, the company that published the chat decides how it is used, and its cookie policy is the one that applies.

Cookie lifetimes are different from data retention periods, which are described in the Privacy Policy. You can delete local data in your browser settings.

4. Accepting, refusing and changing your mind

In the cookie notice, accepting and refusing are equally easy. Closing the notice continues with the necessary features only. Ignoring the notice does not authorise any optional category, and the legal document pages can be read before making any choice.

To change your choice, use the “Preferências de cookies” (cookie preferences) link in the website footer. The change applies to future measurement; withdrawing consent does not make earlier processing carried out on a valid basis unlawful. Requests about data already processed follow the data subject rights procedure.

5. Another browser, another choice

Your choice is stored in the browser where it was made. Another device, another browser, private browsing or clearing storage may require a new choice. The notice also reappears when the record expires or when a change of purpose requires a new decision.

The cookie choice is independent of accepting the Terms of Service and the Data Processing Agreement: contracting SkyInbox does not authorise the optional categories.