Privacy Policy — LPH Meet

In most situations, LPH acts as data processor, processing personal data in accordance with the Customer's instructions, who is the controller. In these cases, the obligations of transparency and obtaining consent from data subjects belong to the Customer.

LPH acts as controller when it autonomously defines the purposes and means of processing — for example, when processing data of LPH's own Customers and platform users for managing the commercial relationship, when developing AI models with genuinely anonymized data, or when complying with LPH's own legal obligations.

To enable the provision of the Services and the management of the commercial relationship, LPH collects the following data from the Customer's representatives and Authorized Users:

• Identification data: full name, role, company, tax ID;
• Contact data: business email, phone, WhatsApp;
• Access data: login credentials, access logs, IP address, device used;
• Platform usage data: features accessed, configurations, history of support interactions;
• Financial data: billing information, tax ID for invoice issuance (we do not store credit card data).

When accessing the platform, LPH automatically collects:

• IP address, device and browser type, operating system;
• Pages accessed, session duration, and navigation flow;
• Cookie data and similar technologies, as described in Section 10.

LPH Meet (Broadcast/Coach) processes additional categories of data specific to its function, including data accessed through Google Workspace APIs. See the product-specific section below for the complete description and the Google Limited Use disclosure.

Google Calendar Integration (user-initiated). When an Authorized User connects their Google account via the Integrations feature of the platform, LPH collects and stores: (i) an OAuth access token and refresh token issued by Google, which authorize LPH to read the user's calendar data on their behalf; and (ii) the e-mail address of the connected Google account, extracted from the OpenID Connect identity token at the time of authorization. LPH reads calendar events solely to identify upcoming commitments of the Authorized User and cross-reference them with calls registered in the platform. Raw calendar event data is fetched on demand and is not persistently stored by LPH beyond what is necessary to display results in the user interface.

The primary use of data is the operation of the Services contracted by the Customer. Without this data, it is not possible to deliver the Services.

Customer and platform user data is used for: invoice issuance and billing; communications about contracted Services; technical support; and renewals or contract changes.

LPH uses anonymized and aggregated data for identifying errors and improvements in the platform and developing AI models. Identifiable personal data obtained from Google Workspace APIs is never used to train, develop, or improve generalized or non-personalized AI/ML models. See the Google Limited Use disclosure below.

LPH may process personal data to comply with legal, regulatory, judicial, or administrative obligations, disclosing only the minimum necessary.

Platform access and usage data are used for security monitoring, detecting improper use, fraud prevention, and protection of system integrity.

LPH may share personal data with the following recipients:

• Service providers and sub-processors: cloud infrastructure providers (including Google Cloud Platform), video conferencing platforms, CRM and analytics tools — contractually obligated to maintain equivalent protection standards;
• Customers: in the course of providing the Services, LPH shares generated outputs with the contracting Customer;
• Competent authorities: when required by law, judicial decision, or administrative authority request, only to the extent strictly necessary;
• Acquirers in corporate transactions: in the event of a merger, acquisition, or sale of LPH's assets, with notice to users.

LPH uses cloud infrastructure that may be located outside Brazilian territory. International transfers are made under:

• European Union / EEA: Standard Contractual Clauses (SCCs) approved by the European Commission, under art. 46 of the GDPR;
• Brazil: for data sent to countries with an adequate level of protection recognized by the ANPD, the transfer occurs without additional requirements;
• Other countries: SCCs approved by ANPD Resolution No. 19/2024.

LPH does not sell, rent, share, or assign personal data to third parties for marketing or advertising purposes independent of the Services contracted by the Customer. For purposes of the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), LPH does not "sell" or "share" personal information as those terms are defined under California law.

LPH adopts technical and organizational measures consistent with market standards to protect personal data. Data is encrypted in transit (TLS 1.2+) and at rest (AES-256).

In the event of a Data Breach that may pose risk or harm to data subjects, LPH will notify the Customer within no more than 72 (seventy-two) hours after becoming aware of the incident, with the information necessary to comply with communication obligations to the ANPD (LGPD art. 48) and to affected data subjects under the GDPR (art. 33).

You may exercise your rights at any time by contacting privacy@leadsperhour.com. LPH will respond within no more than 15 (fifteen) days (LGPD) or 30 days (GDPR/CCPA).

You may revoke LPH's access to your Google account in two ways: (i) directly within the platform, by navigating to Integrations and clicking Disconnect next to Google Calendar — this immediately revokes the token with Google and deletes all stored credential data from LPH's database; or (ii) by visiting your Google Account permissions page. Revocation by either method immediately stops LPH from accessing your Google Calendar data. Revocation does not affect lawful processing performed prior to revocation.