Privacy Policy

1. Tablia’s two roles

Tablia is a platform hired by building material stores. That makes our responsibility over data change according to whose data it is. The distinction is not a formality: it decides who you should address for access, correction or deletion.

The relationship between Tablia and each store in those cases is governed by the Data Processing Agreement, which records the store’s instructions under LGPD art. 39.

In practice: if you requested a quote from a store and want to access, correct or erase your data, the request goes to the store. If it calls on us, we act. You can also reach us through the channel in section 15 and we forward it to the store responsible.

2. Data we process

2.1. People who visit this site

Just browsing, nothing of yours is processed — unless you accept audience measurement in the consent banner. If you accept, Google Analytics starts recording pages visited, where the visit came from, device type and a random browser identifier. Never a name, email or phone number. If you decline, or while you have not answered, none of that happens. Section 12 goes into detail, and the Cookie Policy lists them cookie by cookie.

By filling in a form, you send us what you typed. On the contact form: name, email, subject and message, and optionally company and phone. On the data deletion form: name, email, your relationship with Tablia and what you are asking for, and optionally phone, store name and details.

Along with the submission we record date and time, IP address, browser identification (user-agent), the page you submitted from and the version of this Policy you accepted, with the exact wording of that acceptance. That record is what proves your consent — without it, consent does not exist for legal purposes.

The form content reaches our team by email, and a confirmation copy goes to the address you gave. We use that data to reply and, in the case of deletion, to act on the request.

2.2. People who use the platform inside a store

For store owners and salespeople we process first name, surname, email, contact phone, role in the store, access credentials and authentication logs. We also process the store's registration data: name, address, phone, WhatsApp, description and logo.

We log access attempts and API usage to protect accounts against unauthorised access, and we log each store's processing volume to measure contracted usage.

2.3. People who request a quote from a store

This is the most sensitive group, and it is where Tablia acts as a processor. We handle:

• Identification and contact: name or company name, WhatsApp number, email when given, and tax ID when given
• Content of the request: the list of products and quantities, and the original file sent — PDF, image, spreadsheet, text document or the typed text
• Processing result: the items recognised, the matching products in the store's inventory, the items marked as missing and the quote versions
• Service preference: the salesperson chosen, where there is one
• Deal status: whether the quote was sent, is under negotiation, was approved, declined or superseded
• Technical records: date and time of operations and the quote's unique identifier

The file you send may contain more than the product list — the header of an estimate, a site address, the name of a person in charge. That file is stored exactly as you sent it. Send only what the quote needs.

3. Data coming from WhatsApp

When a store connects its WhatsApp Business to Tablia, conversations between the store and the customer start being processed by the platform. In that channel we handle:

• Phone number of whoever sends the message
• Name, when provided by the customer or by the WhatsApp profile
• Messages exchanged in the conversation, including files, photos and documents sent
• Products looked up — the terms searched and the items the customer asked about
• Quote requests made through the chat
• Order-related information, such as quantities, requested changes and the status of the deal
• Data needed to serve the customer, such as the salesperson in charge and the conversation history

What they are for. This data is processed to allow customer service, product lookups, quote building, commercial communication and the features the user themselves asked for. We do not use the content of those conversations for third-party advertising and we do not sell it.

Who is responsible. The store you are talking to is the controller of that data. Tablia processes it on the store's behalf, to run the service.

WhatsApp belongs to Meta. Message transport happens on WhatsApp Business infrastructure, subject to Meta's policies, which are outside Tablia's control. This policy covers what we do with the message after it reaches us.

How to opt out. At any time, in the conversation itself, you can ask to speak only with a human or to stop receiving messages from the store.

4. Why we process it

Every purpose has a legal basis under the LGPD. We do not process data for purposes other than those listed without telling you first.

Where processing rests on legitimate interest, we assess beforehand whether it is proportionate and whether your expectations and rights are preserved. You can object to that processing through the channel in section 15.

5. Automated decisions and artificial intelligence

Tablia uses artificial intelligence at two points in the service, and it matters that you know exactly where:

• Reading the list. The file or text you send is read automatically to pull out the items and quantities.
• Matching and ranking. Each item is compared with the store's inventory by similarity of meaning, and the candidate products are ordered automatically.

Neither of these steps makes a decision about you. They organise a list of products. We do no consumer profiling, we assign no credit score, we do not assess behaviour, and we take no decision affecting your interests on the basis of automated processing alone.

The quote goes through human review: the store's salesperson checks it, adjusts it and decides what to send. Even so, under LGPD art. 20 you may request review of any decision taken by automated means and ask for information about the criteria used, subject to commercial and industrial secrecy.

6. Who we share it with

We do not sell personal data. We share only what is needed to run the service, with the providers below, and with the store you requested the quote from.

We may also share data with public authorities where there is a legal obligation, a court order or a request from a competent authority, and with legal and accounting advisers where needed for the regular exercise of rights.

7. International transfers of data

Part of the processing happens outside Brazil. In particular, the content of the quote list — and the original file, when it is a PDF or an image — is sent to Google's artificial intelligence service to be read, and the platform runs on Google Cloud infrastructure.

These transfers are made under LGPD art. 33, on the basis of necessity for performance of the contract and under contractual clauses signed with the providers, binding them to protection standards compatible with Brazilian law.

The artificial intelligence market moves fast, and we may change provider to keep the quality of the service. When that happens we will update the list in section 6 and the date at the top of this page. The change does not widen the purposes in section 4: the provider receives only what is needed to read the list, and is not authorised to use that content to train its own models.

8. Quote links are shareable

Each quote gets a unique address that is hard to guess. That address was made to be sent over WhatsApp or email, so you can pass it to whoever decides the purchase without needing a password.

The consequence is direct and you need to know it: anyone with the link can see the quote. Treat the link the way you would treat the paper estimate itself — forward it only to whoever should see it. The same goes for the generated PDF.

9. How long we keep it

We keep data for as long as it is needed for the purposes in section 4, and after that for the periods required by law or needed to defend rights.

• Quotes, uploaded files and PDFs: 5 years from the last interaction with the quote, unless the controlling store instructs otherwise
• WhatsApp conversations: 5 years from the last interaction
• Store user accounts: for as long as the contract with the store lasts, and for 5 years after it ends
• Contacts from the site form: 2 years from the last contact
• Access and security logs: 6 months, under art. 15 of the Brazilian Internet Civil Framework, or longer where needed to investigate an incident
• Tax and accounting records: for the periods set by applicable law

The 5-year period follows the limitation periods in art. 27 of the Brazilian Consumer Code and art. 206 of the Civil Code. It preserves lookup of the quote by its code, the store's negotiation history and the ability to defend a claim in a dispute.

Once the period ends, the data is deleted or anonymised. When a store terminates its contract, the data we process on its behalf is returned or deleted according to its instruction.

10. Security

We take technical and administrative measures to protect the data, among them:

• HTTPS-encrypted traffic across the whole service, with HSTS enabled
• Token authentication in a secure cookie, with protection against request forgery
• Automatic account lockout after repeated failed sign-in attempts
• Request rate limits per origin, to contain abusive use
• Access separated by role — store owner and salesperson see different things
• Isolation between stores: one store cannot reach another's inventory or quotes

No measure removes risk entirely. If a security incident occurs with material risk to your rights, we will notify you and the Brazilian National Data Protection Authority under LGPD art. 48.

11. Your rights

The LGPD guarantees you, at any time and at no cost:

• Confirm whether we process your data, and access it
• Correct incomplete, inaccurate or outdated data
• Ask for anonymisation, blocking or deletion of unnecessary data, or data processed outside the law
• Ask for your data to be ported to another provider
• Ask for deletion of data processed on the basis of your consent
• Know which public and private entities we share data with
• Be told that you may withhold consent, and what happens if you do
• Withdraw consent, where processing rests on it
• Object to processing carried out on the basis of legitimate interest
• Ask for review of a decision taken solely by automated processing

To exercise any of them, write to the address in section 15. We may ask for extra information to confirm your identity — precisely so we do not hand your data to someone else.

We answer within 30 days. Where the law sets a shorter period, the legal period prevails — as with a request to confirm processing and to access data, which the LGPD puts at 15 days from the request, or answers immediately in simplified form (art. 19, I and II).

If the request concerns data we merely process — quotes you requested from a store — we will forward it to the controlling store and let you know.

You may also petition the Brazilian National Data Protection Authority directly, under LGPD art. 18, §1.

12. Cookies

On this site there is no advertising, profiling or social network cookie. There are audience analytics cookies, from Google Analytics, and they depend on your acceptance: until you answer the banner, the browser is instructed to deny storage and nothing is written. Declining is one click, the same size as accepting, and the choice can be revisited at any time in the Cookie Policy.

On the platform, at app.tablia.com.br, we use cookies strictly necessary for it to work: an authentication cookie, which keeps the session of whoever signed in, and a cookie protecting against request forgery. Both are marked secure. Without them the system cannot be used, which is why they do not depend on consent.

The full list — name, purpose, duration and what stays in the browser's local storage — is in the Cookie Policy.

13. Children and teenagers

Tablia is a professional tool, meant for stores and for people buying building materials. We do not direct the service at anyone under 18 and we do not knowingly collect data from children or teenagers. If we identify data of that kind, it is deleted.

14. Changes to this policy

We may update this policy to reflect changes in the service or in the law. The date of the last update is always at the top of this page. Where a change is material to your rights, we will tell you through the contact channels before it takes effect.

15. Contact and Data Protection Officer

Controller: Tablia Serviços Tecnológicos Ltda., company ID (CNPJ) 53.734.413/0001-66, registered office at Rua Professor Estevão Pinto, 555 — Serra, Belo Horizonte, MG, 30220-060, Brazil.

Data Protection Officer: Carolina Porto.

Data subject channel: [email protected]

For questions about the platform or about signing up, reach us through the form on this site.