Privacy Policy

1. Who controls your data

Bee DevStack LTDA, registered under CNPJ 48.205.119/0001-27, is the controller of the personal data processed under this Policy, as defined by Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD).

Bee DevStack is also the controller of the data processed in the products it operates, including BeeLiving.

Privacy channel. To exercise your rights, ask a question about this Policy, or raise anything relating to your personal data, write to the contact email published on the home page of this site.

This is the communication channel Bee DevStack maintains for data subjects, under art. 41 of the LGPD and ANPD Resolution CD/ANPD No. 2/2022, which applies to small-scale processing agents. Messages sent to this channel are read and answered.

2. What this Policy covers

This Policy describes the processing Bee DevStack carries out at company level:

• the messages we send over WhatsApp;
• this website;
• the enquiries we receive by email.

It does not describe the processing that happens inside each product. BeeLiving processes additional data — resident records, parcel records, pickup proofs and billing details, among others — described in the policy published at beeliving.app/privacy-policy.

The controller is the same company in both cases. The documents are divided by processing context rather than by legal entity, so that each one describes precisely what actually happens instead of generalising across both.

3. Data we process

Messages sent over WhatsApp

We use the WhatsApp Business Platform, provided by Meta, to send transactional notices relating to the product you use. For that we process:

• your phone number, in international format;
• delivery metadata: message identifier, timestamps for sending, delivery and reading, retry count, and any delivery error.

We do not store message content. Messages you send to our business account are not recorded by our systems.

We do not use your WhatsApp display name. The name in our records is the one registered by you or by your building management inside the product.

This website

This site consists of static pages. We use no cookies, no advertising pixels, no analytics tools and no tracking SDK of any kind. There are no forms: nothing is sent from your browser to us.

Our hosting provider records technical access data — such as IP address and browser type — to operate and secure the infrastructure.

Email enquiries

When you write to us, we process your email address and the content of your message, for as long as needed to reply and to keep a record of the enquiry.

4. Why we use the data, and on what legal basis

Purpose	Legal basis (LGPD)
Sending transactional notices about the product you use	Performance of a contract (art. 7, V)
Responding to enquiries and requests you initiate	Performance of a contract or legitimate interest (art. 7, V and IX)
Complying with legal and regulatory obligations	Compliance with a legal obligation (art. 7, II)
Keeping access logs and securing the services	Compliance with a legal obligation (art. 7, II) and legitimate interest (art. 7, IX)

We send transactional messages only — for example, the notice that a parcel has arrived for you. We do not send promotional or marketing messages over WhatsApp, we do not use your data for behavioural advertising, and we do not sell personal data.

5. Who we share with

We share data only with the providers necessary for the operation described in this Policy:

Provider	What it receives
Meta Platforms, Inc. and Meta Platforms Ireland Ltd.	Phone number and message template variables, for delivery over WhatsApp
Render Services, Inc.	Hosting for this site and for the infrastructure that sends the notices
Grafana Labs	Application technical logs

We share data with public authorities only where there is a legal requirement or a court order.

The providers used by each product are listed in that product's policy.

6. International transfers

Our providers process data outside Brazil: the infrastructure is hosted in the United States. No processing takes place on Brazilian territory.

These transfers apply the safeguards required by articles 33 to 36 of the LGPD.

7. How long we keep data

We keep your phone number and delivery metadata for as long as you are linked to a product operated by Bee DevStack, and for the period required to comply with legal obligations.

Application access logs are kept for a minimum of 6 months, as required by art. 15 of the Brazilian Internet Civil Framework (Law No. 12,965/2014).

You can request deletion at any time — see the Data Deletion Instructions page.

8. Your rights

Under article 18 of the LGPD, you may at any time request:

• confirmation that processing takes place;
• access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary data or data processed unlawfully;
• portability of your data to another provider;
• deletion of data processed on the basis of your consent;
• information about who we share your data with;
• withdrawal of consent, where consent is the applicable legal basis.

To exercise any of these rights, write to the contact email published on the home page. Specific deletion instructions are on the Data Deletion Instructions page.

9. Security

We apply technical and administrative measures to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration or disclosure.

In the event of a security incident presenting a relevant risk to data subjects, we will notify those affected and Brazil's National Data Protection Authority (ANPD) within the legal deadlines.

10. Children and adolescents

The products operated by Bee DevStack are contracted by residential buildings and intended for the residents of their units — which includes families.

We do not collect date of birth or any other data identifying users' age, and we do not knowingly collect data about children or adolescents.

Resident records — including adding a phone number to receive notices — are created by the contracting building management, which is responsible for obtaining the necessary authorisations from residents and, where applicable, their legal guardians.

Where processing of a minor's data is identified without the specific consent required by art. 14 of the LGPD, the data will be deleted on request sent to our privacy channel.

11. Changes to this Policy

This Policy may be updated. The current version and effective date are shown at the top of this page, and material changes will be communicated before they take effect.

12. Contact

For questions about this Policy or about how your data is processed, write to the contact email published on the home page of this site.