Privacy Policy
This is a courtesy translation. The Portuguese version of this document prevails for all legal purposes.
Last updated: May 28, 2026
16pct ("16pct", "we") operates a performance marketing and customer service platform that integrates data from WhatsApp, Meta Ads, Google Ads, HubSpot, and other systems on behalf of our clients (advertisers). This policy describes which data we collect, why we collect it, how we store it, and how you can exercise your rights.
This policy complies with the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) and with the Meta Platform Terms for applications that use the Marketing API, Conversions API, and Graph API.
1. Who we are
- Controller: 16PCT Publicidade LTDA
- CNPJ: 58.924.674/0001-62
- Address: R. São Borja, 2391, Centro, Imbé/RS, CEP 95625-000
- Website: https://16pct.com
- Contact / DPO: equipe@16pct.com.br
When we act under contract with an advertiser (our client), we are data processors on behalf of that advertiser: the advertiser is the controller. When we collect our own data (e.g., a commercial contact through a form on our website), we are the controllers.
2. Which data we collect
2.1 Data of our clients (advertiser companies)
When a company contracts 16pct, we collect:
- Company name, CNPJ, address, commercial contacts.
- Credentials delegated for access to the advertiser's platforms:
- Meta Business Manager, System User token with scopes
ads_read,ads_management,business_management,pages_read_engagement,pages_messaging(as applicable). - HubSpot, the client account's Service Key.
- Google Ads, refresh token via OAuth 2.0.
- Meta Business Manager, System User token with scopes
- Configuration of campaigns, projects, audiences, pixels, and ad accounts.
2.2 Data of leads and end users (collected on behalf of clients)
As processors, we access:
- WhatsApp conversations captured via the Evolution API: phone number, WhatsApp display name, message content, media sent, timestamps.
- CTWA attribution data (Click-to-WhatsApp) from Meta:
ad_id,ctwa_clid, ad title at the moment of the click. - Meta Ads campaign and insights data via the Graph API: spend, impressions, clicks, conversions.
- HubSpot CRM events via webhook: contacts, deals, funnel stages, custom properties.
- Sales recorded manually by the clients' salespeople through a public form.
2.3 Data we send to Meta via the Conversions API
When configured by the client, we send server-to-server events to the client's Meta pixel, containing:
- Event name (e.g.,
Lead,Purchase,QualifyLead). event_id(stable UUID for deduplication).- User data hashed with SHA-256 before sending: email, phone, first name, last name, country, external_id.
- Non-hashed data: client IP, User-Agent,
_fbc,_fbp(when available). - Custom data: value, currency, content name.
3. Why we collect (purposes)
| Purpose | Legal basis (LGPD) |
|---|---|
| Perform the contract with our advertiser clients | Performance of a contract (art. 7, V) |
| Attribute leads to Meta campaigns (CTWA) and measure ROI | Legitimate interest (art. 7, IX) of the advertiser |
| Fire conversion events to Meta CAPI | Legitimate interest of the advertiser for media optimization |
| Quality analysis of conversations via AI (Anthropic, OpenAI) | Legitimate interest of the advertiser for sales coaching |
| Send operational communications to the client itself | Performance of a contract |
| Comply with legal obligations (tax, regulatory) | Compliance with a legal obligation (art. 7, II) |
We do not use the data for purposes not stated here. We do not sell data to third parties.
4. Where the data comes from
- Directly from the advertiser client (during onboarding and throughout the contract).
- Meta Graph API (https://graph.facebook.com): campaigns, ads, insights, audiences.
- Meta Conversions API: we send events to Meta; we receive a status response.
- Evolution API (WhatsApp Cloud gateway): messages in real time via webhook.
- HubSpot Workflows: funnel events via webhook.
- Google Ads API: campaigns, conversions, keywords.
- End users who click ads and start conversations, or who fill out our clients' public sales forms.
5. Where we store data and for how long
- Database: Supabase (PostgreSQL) in the US-East region. RLS enabled per client: 16pct users can only access data of the clients to whom they have been explicitly linked.
- WhatsApp media: Supabase Storage, with signed and expirable URLs.
- Operational logs: Supabase, 90-day retention for detailed logs.
Retention:
- Operational data (conversations, leads, campaigns): kept while the contract with the advertiser client is in force.
- After contract termination: up to 30 days for export by the client, then deletion.
- Tax/accounting data: 5 years (legal obligation).
- Security audit logs: up to 12 months.
6. Sharing with third parties (sub-processors)
To operate the platform, we share strictly necessary data with:
| Third party | Data shared | Purpose |
|---|---|---|
| Meta Platforms, Inc. | Hashed events (CAPI), Graph API reads | Conversion measurement, campaign optimization |
| Google LLC | Google Ads API reads | Performance reporting |
| HubSpot, Inc. | Funnel events (read-only via webhook) | CRM synchronization |
| Anthropic, PBC | Textual conversation excerpts | Status/coaching analysis via the Claude API |
| OpenAI, OpC | Textual conversation excerpts | Status/coaching analysis via GPT |
| Supabase, Inc. | All operational data | Database and storage hosting |
| Vercel, Inc. | HTTP traffic and logs | Web application hosting |
| Evolution API | Receipt of WhatsApp webhooks | WhatsApp gateway |
All sub-processors have contracts with equivalent data protection clauses.
7. International transfer
The services of Supabase, Vercel, Anthropic, OpenAI, Meta, Google, and HubSpot process data in the United States. The transfer occurs under contractual safeguards (DPA, Data Processing Agreement) with each sub-processor and complies with art. 33 of the LGPD.
8. Your rights (LGPD art. 18)
You have the right to:
- Confirmation that processing exists.
- Access to your data.
- Correction of incomplete or outdated data.
- Anonymization, blocking, or deletion of unnecessary data.
- Portability of the data.
- Deletion of data processed on the basis of consent.
- Information about sharing with third parties.
- Withdrawal of consent.
To exercise any of these rights: send an email to equipe@16pct.com.br with the subject "Direitos LGPD".
We will respond within 15 business days.
Important: if you are an end user (a lead or customer of our advertiser client) and want to exercise rights over data that we process on behalf of that advertiser, we may direct your request to the advertiser itself, which is the controller.
For specific data deletion within Meta, see our dedicated page: https://16pct.com/exclusao-de-dados
9. Security
- Communication between services via HTTPS/TLS 1.2+.
- Access tokens to third-party platforms stored encrypted in the database, accessible only via service role.
- RLS (Row Level Security) active on all tables: isolation per client.
- Human access to the data restricted to authenticated users explicitly linked to the client.
- Access auditing recorded in Supabase logs.
- SHA-256 hashing of PII before sending to Meta CAPI.
10. Cookies
On our dashboard (https://app.16pct.com.br), we use only essential technical cookies:
sb-*, Supabase session (authentication).client_view_session, client dashboard public-view session (HMAC, 30 days).
We do not use advertising or tracking cookies on our own domain.
11. Children
Our service is not directed at minors under 18 years of age. We do not knowingly collect data from minors.
12. Changes to this policy
Material changes will be communicated by email to contracting clients and reflected in the "Last updated" date at the top of this page.
13. Contact
Data Protection Officer (DPO): equipe@16pct.com.br 16PCT Publicidade LTDA, CNPJ 58.924.674/0001-62 Address: R. São Borja, 2391, Centro, Imbé/RS, CEP 95625-000 Website: https://16pct.com
For unresolved complaints, you may also contact the Brazilian National Data Protection Authority (ANPD): https://www.gov.br/anpd