Version 1.5 · In force since 2026-08-02 Publication address: https://lunahia.com.br/en/privacy Portuguese version: https://lunahia.com.br/privacidade How to request deletion: https://lunahia.com.br/en/data-deletion

Language notice. This is a courtesy translation. The original and legally prevailing text is the Portuguese version, kept in section-for-section parity with this one. Should any divergence in meaning arise between the two texts, the Portuguese version prevails.

Document status. This text has been in force since 2026-08-02, the date it was published at this address, and it is Helsen's current statement on the processing of personal data described here. External legal review by a lawyer has not been carried out as of that date: it is an open, tracked item, and it ceased to be a condition of entry into force on 2026-08-02. Any adjustment the review may require enters as a new dated version in the version history at the end of this document — no change happens without leaving a trace. Section 5 (roles and processing chain) is the one that depends most on that review and is marked accordingly.

1. Who Helsen is and what it does

Helsen operates messaging infrastructure: it transports, persists and delivers WhatsApp messages between the WhatsApp Business Platform, operated by Meta, and the software systems of the companies that hire it. Helsen acts as a Meta-approved Tech Provider and uses exclusively the official WhatsApp Cloud API.

The platform operates at three levels, and the distinction matters in order to understand who answers for what in this policy:

• Helsen — Tech Provider. Operates the infrastructure that receives, stores and delivers the messages. It does not decide the purpose of the conversation, does not interpret and does not answer messages.
• Customer (also called tenant) — the software company that consumes Helsen's API to embed the WhatsApp channel into the product it sells.
• End Business — the company that owns its own WhatsApp Business Account, completed its own Embedded Signup, accepted Meta's terms and keeps its own payment method with Meta. It is the one that decides why it talks to you.

If you are a person who exchanged messages with a company over WhatsApp and ended up here, the company you talked to is the End Business. Helsen is the infrastructure that carried that message.

2. Data collected, named item by item

This section exists so that there is no doubt about exactly what Helsen collects. Each row names the data, states where it comes from, what it is used for and how long it is kept. There is no generic category in this table by design: "communication data" and "account information" tell nothing to someone who wants to know what the platform holds about them.

What Helsen does not do with content. Helsen does not use message data to create, develop, train or improve machine learning or artificial intelligence systems, and does not provide, host or run any model, prompt or conversational flow. Helsen also does not sell personal data to anyone.

3. The business-scoped user identifier

Since early April 2026, Meta delivers in its webhooks an identifier called the business-scoped user identifier — in the user_id, recipient_user_id and, when enabled, parent_user_id fields.

What you need to know about it, in plain terms:

• It is a personal identifier. It identifies you before a specific business, in the same way your phone number used to.
• It is unique per business-and-user pair. The identifier one business receives about you differs from the one another business receives. It does not let two different businesses cross-reference information about the same person using that value.
• It has the form of a country code, a dot and an integer. For example: US.13491208655302741918.
• Meta started delivering it without Helsen asking for it and without any way to refuse it. It arrives together with the message.
• It is the key Helsen uses to honour a deletion request when the phone number is not available. It is the value that section 9 and the data deletion instructions page ask for when the person must be identified precisely.

The phone number may stop being provided. Meta now lets people adopt a username on WhatsApp. If you adopt a username and do not interact with a given business for 30 days, Meta may omit your phone number from the data delivered to that business. What this means in practice:

1. In that case Helsen does not receive your phone number and therefore does not store it.
2. Identification is then done through the business-scoped identifier.
3. A deletion request made with the phone number alone may find no record at all. That is why the data deletion instructions page also accepts the identifier.
4. Meta itself states that usernames are not intended for privacy: adopting one does not hide your phone number from a business you keep interacting with.

4. Contact repository hosted by Meta

Meta maintains, under the business portfolio, a contact repository called the Contact Book. It is declared here in its own section because it does not belong to Helsen and Helsen does not control its clock.

State observed in the dashboard. The rule Helsen imposed on itself is to declare here what the Business Portfolio dashboard shows, with the date of the observation, and never what the documentation says — because Meta's documentation and public sources contradict each other on whether the Contact Book is enabled by default. As of 2026-07-29 that observation has not yet been made, and the pending item is recorded, with the exact capture location, in Helsen's internal pending-items tracker.

Until the dashboard is checked, this policy does not assert that the repository is on nor that it is off. It asserts what is verifiable today: the repository exists, it is hosted by Meta, it records automatically when enabled, and Helsen treats the possibility of it being active as the conservative assumption. This section will be updated with the state and the date at the same moment the capture enters the repository — and the update will appear in the version history at the end.

5. Roles and processing chain

Section subject to external legal review, which is still pending. On 2026-08-02 the review ceased to be a condition of entry into force and became a tracked pending item. The framing below is in force as Helsen's statement and is its technical understanding of the chain — it does not replace a lawyer's opinion, and it is the part of this document most likely to change once that opinion arrives.

Brazil's data protection law (LGPD) assigns roles, and on this platform they are spread across five links:

Where Helsen is a controller. For Helsen's own data — Customer registration, API keys, access logs, subscription and billing data — Helsen is the controller, and the processing rests on performance of the contract and compliance with legal and regulatory obligations, including the retention required by article 15 of the Brazilian Internet Civil Framework. Those data belong to companies and their representatives, not to the end user of the conversation.

The instrument that holds the chain together. Helsen keeps a data processing agreement with every Customer, and requires by contract that the Customer keep an equivalent instrument with every End Business. Without that chain, Helsen would process third-party message content without a title qualifying it as a processor. The instrument is published as an annex to the Terms of Use.

6. Retention at Helsen

The periods below are the ones Helsen controls and implements. The number published here is the parameter the infrastructure implements — there is no "policy period" and a different "system period". The correspondence between what is published and what is configured is verified automatically on every change to the versioned artefacts. Once the period elapses, the data is deleted by an automated routine, with no request required.

One divergence open as of 2026-08-02, declared rather than hidden. The correction to the access log period — from 180 to 185 days, for the reason explained below — entered the documents and the versioned parameter on that date. The running instance has not yet received the new value, and for that single class of data the parameter in force is still the previous one, 180 days, which deletes the record one to four days before the statutory floor. Applying it is recorded as an open, tracked pending item, and will be reflected here, with a date, once completed. No other class of data in this table diverges.

Why "6 months" and "185 days" appear together, and are not the same thing said twice. Article 15 of the Internet Civil Framework sets the retention period at 6 (six) months. A month is a calendar unit: under article 132, §3, of the Brazilian Civil Code, a period expressed in months ends on the day bearing the same number as the start date, so six months amount to 181 to 184 days depending on when they begin. There is no start date on which six months equal 180 days. The system parameter has to be a number of days, and it is 185 — the smallest whole number of days that never falls short of six months, whatever the start date. 6 months is the statutory period; 185 days is the parameter that implements it.

Until 2026-08-02 this policy published "6 months, that is, 180 days", and the equality was false: the record would be deleted one to four days before the statutory floor. The value, the technical parameter and the automated check that verifies it were all corrected on the same day, and the correction is recorded in the version history at the end.

Two distinct clocks, not one. The Internet Civil Framework requires keeping access logs — who called the API, and when. It does not authorize keeping message content for that period. That is why access logs live in their own storage, separate from content, and each follows its own period.

Helsen does not provide an archiving service or long-term backup, and does not offer extended retention as a feature. If the Customer or the End Business need to preserve data beyond the periods above, it is up to them to extract and keep it.

7. Retention at Meta

Nothing in this section is configurable by Helsen. It is here because the data exists, the data subject has the right to know, and someone has to say who holds the clock.

The quotations in this section come from Meta's own contractual text, captured and hash-verified by Helsen, not from memory. The provenance is listed at the end of this document.

Technical media windows. Meta applies its own windows to media identifiers and files. They live in Meta product documentation that Helsen has not yet captured with a hash in its contract repository, and therefore they are not declared here with the same degree of authority as the clauses quoted above. No period in section 6 depends on them.

8. Sharing and Meta's business agent products

Who Helsen shares data with. Helsen shares message data with: (a) the Customer that integrated the channel, and through it the End Business, which are the parties entitled to access that conversation; (b) Meta, to the extent inherent to the operation of the Cloud API; and (c) competent authorities, upon lawful order. Helsen uses cloud infrastructure providers to store and process data, acting under contract and only as instructed. Helsen does not sell personal data.

Meta's business agent products. Meta offers, under a separate contract, business agent products that are not the WhatsApp Business Platform and are not part of Helsen's service. If an End Business adopts those products:

• it does so in a direct relationship with Meta, through an acceptance that happens outside Helsen's flow;
• under that contract, use implies granting Meta a perpetual, worldwide, non-exclusive, fully paid and royalty-free licence over the "Input" provided, and the definition adopted there expressly reaches the prior conversation history in the WhatsApp Business app that the company may share during onboarding;
• in practical terms, an End Business that adopts those products may, by that very act, licence to Meta content that also travels through Helsen's infrastructure;
• Helsen is not a party, does not control, does not intermediate and is not answerable for that relationship. The decision is the End Business's and so is the instrument.

This disclosure exists because the data subject is entitled to know that this possibility exists, even though it depends on a third party's act.

9. Data subject rights and how to exercise them

The LGPD guarantees the data subject, among others, the rights of confirmation of processing, access, correction, anonymization, portability, information about sharing, withdrawal of consent and deletion.

Where to address the request. Requests about the interaction itself — why the company contacted you, the content of the conversation, correcting a record in its own database — are addressed to the controller, which is the End Business you talked to. Helsen is a processor and honours those requests under its instruction, or directly when the request concerns deletion of the data Helsen keeps.

Channel and deadline. The request is made through the contact address in section 10 or through the page https://lunahia.com.br/en/data-deletion. Helsen answers within 15 calendar days of receiving the complete request. If the request depends on the controller's instruction, Helsen says so in the answer and states whom to address.

The full step-by-step, including what to provide in each case, is on the data deletion instructions page, published at https://lunahia.com.br/en/data-deletion. That is the URL registered in the data deletion instructions field of Helsen's app with Meta.

10. Security, data protection officer and contact

Security measures. Helsen adopts, in general terms and without detailing anything exploitable: encrypted transport on every interface; encryption of sensitive data at rest; secrets and credentials never stored in cleartext, with API keys kept only as a hash; logical isolation of data per account, enforced in the data layer itself; least-privilege access control, with mandatory second factor on administrative accounts; cryptographic verification of the authenticity of everything arriving from Meta; and an auditable access log of every call to the API.

International transfers — they happen, and they are total. This is not a hypothesis: it is what happens to all message content. The data described in section 2 is processed outside Brazil, and in this version there is no processing of message content on infrastructure located in Brazilian territory. By name:

The instrument for that transfer is being determined, and this policy does not claim it exists today. Helsen maintains with each of those providers the data processing agreement they offer, resting on the European Union Standard Contractual Clauses. Those clauses are not the Brazilian Standard Contractual Clauses, set out by the Brazilian National Data Protection Authority in Resolution CD/ANPD no. 19 of 23 August 2024. Whether the instrument is adequate depends on the external legal review this policy declares pending at the top, and its outcome will enter as a new dated version in the history at the end.

Until 2026-08-02 this paragraph said only that, "where an international transfer occurs", it would take place "under the contractual instruments required by applicable law". It was conditional where the fact is categorical, and it asserted an instrument whose adequacy Helsen cannot assert. The document the data subject reads now says the same as the document the Customer reads. The correction is recorded in the version history at the end.

Meta is a separate clock. The traffic of messages across the WhatsApp Business Platform itself and the location of the repositories hosted by Meta — among them the contact repository of section 4 — arise from the direct relationship between the End Business and Meta, are not controlled by Helsen, and Helsen makes no statement about them beyond what Meta's own text asserts.

Incidents. Should a security incident occur with relevant risk to data subjects, Helsen notifies the affected Customers and the national authority in the form and within the deadline set by law.

Who the controller is, identified. Helsen is HELSEN IA TECNOLOGIA LTDA, a Brazilian limited liability company (sociedade empresária limitada) enrolled with the Brazilian corporate taxpayer registry (CNPJ/MF) under no. 57.589.381/0001-03, with its registered office at Rua Argélia, no. 425, Anexo 01, Petrovale 2ª Seção, Ibirité/MG, ZIP code 32417-087, Brazil, trading under the business name Helsen Ia and offering the platform to the market under the commercial name Luna. That is the legal entity this policy means whenever it says "Helsen", and it is the controller of the data that section 5 identifies as being under Helsen's controllership — Customer registration data, API keys, access logs, subscription and billing data.

The cross-reference is to that paragraph of section 5, not to the whole of section 5. Section 5 declares the full five-link chain, including message content, whose controller is the End Business and not Helsen. Until 2026-08-02 this sentence read "the controller of the data described in section 5", with no such narrowing, and read literally it declared the exact opposite of what section 5 itself and the whole of Annex I state. The correction is recorded in the version history at the end.

Data subject channel. Data subject requests, questions about this policy and privacy-related communications should be sent to ia.helsenservice@gmail.com, addressed to the Data Protection Officer. It is the same channel cited in section 9 and on the data deletion instructions page, and it is Helsen's only privacy address: there is no alternative channel, and no other address answers for this policy.

Data protection officer (DPO). The officer's name is published in this section at the moment this policy is published, alongside the address above. The gap that remained until 2026-08-02 was the address, and it is now filled; what remains is the formal appointment of the person, and it is declared here rather than suppressed — a policy that omits the existence of the officer is worse than one that declares the appointment pending.

Changes to this policy. Material changes are communicated to Customers at least 30 days in advance and recorded in the history at the end. The last update date is at the top of the document.

Provenance of the quotations

Every contractual quotation in this document comes from Meta's own contractual text, captured and hash-verified by Helsen, and not from memory.

Version history