Last updated: September 1, 2026
Privacy Policy
1. Who we are
CitraChat is a product of MakeLemonAd Ltda (CNPJ 53.556.611/0001-87), acting as data controller for the personal data processed under this policy, pursuant to the GDPR (Regulation EU 2016/679).
2. Data we collect
From the account holder (CitraChat customer):
- Name, email, phone, and company
- Tax identification for billing purposes
- Payment data: processed by Stripe; CitraChat does not store card numbers
From visitors who converse with a CitraChat agent (leads):
- Name, email and phone provided in the conversation
- Conversation content with the agent
- IP address and approximate location
- Tracking cookies (GTM, GA4, Meta Pixel, TikTok, LinkedIn) when the customer configures those integrations
3. Legal basis (Art. 6 GDPR)
- Contract performance: to operate the account holder's account.
- Legitimate interest of our customer (the business using CitraChat) in qualifying their own leads, subject to a balancing test.
- Explicit consent (opt-in): for non-essential cookies and marketing communications.
4. Purpose of processing
To operate the service, notify the customer when a lead is qualified, and train the agent configured by that specific customer. A customer's conversation is never used to train another customer's agent.
Automated decision-making (Art. 22 GDPR): CitraChat's AI performs automated lead scoring. If this scoring significantly affects you, you have the right to request human review, contest the result, and express your point of view. Contact us at the address below.
5. Sub-processors
| Company | Function | Processing location |
|---|---|---|
| Anthropic | AI processing (Claude model) | USA: SCCs apply |
| Supabase | Database | sa-east-1 (São Paulo) |
| Vercel | Hosting | USA / Global Edge |
| Resend | Notification email delivery | USA: SCCs apply |
| Stripe / Asaas | Payment processing | Per each provider's policy |
International transfers: Anthropic, Vercel and Resend process data in the United States. These transfers are covered by Standard Contractual Clauses (SCCs) approved by the European Commission.
6. Data storage location
Our primary database is in sa-east-1 (São Paulo, Brazil) via Supabase. Some sub-processors process in the US under SCCs as noted above.
7. Retention period
Data is retained for the duration of the contract and for up to 90 days after cancellation before permanent deletion. You may request early deletion at any time.
8. Your rights (GDPR)
You have the right to: access, rectification, erasure ("right to be forgotten"), restriction of processing, data portability, objection to processing based on legitimate interest, and rights related to automated decision-making (Art. 22).
You also have the right to lodge a complaint with your national data protection authority (e.g., CNPD in Portugal, AEPD in Spain, ICO in the UK).
Requests via [contato@makelemonad.com.br](mailto:contato@makelemonad.com.br). We respond within 1 month.
9. Security
TLS encryption in transit and encryption at rest. Access control via authentication. See our Security page for details.
10. Minors
The service is not intended for individuals under 18 without parental or guardian consent.
11. Changes to this policy
Material changes will be communicated by email to account holders and highlighted on this page with a new effective date.
12. Data Protection Contact
[contato@makelemonad.com.br](mailto:contato@makelemonad.com.br)