Privacy Policy

1. Introduction

Manda4 Tecnologia Ltda. ("Manda4", "we" or "our") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store and protect information when you use MandaMail.

This policy applies to all users of MandaMail and observes the Brazilian General Data Protection Law (LGPD) and the European Union General Data Protection Regulation (GDPR). Commercial and licensing terms are in the MandaMail EULA.

2. Information we collect

2.1 Account data

• Name and contact details of whoever administers the application
• Contact email address and phone number
• Identifier of the Bitrix24 portal where the application is installed
• Data required to invoice the subscription

2.2 Configuration data

• Address of the connected mailbox and IMAP server settings
• Mailbox access credentials, stored in protected form
• Pipeline, stage and assigned user chosen for the deals created
• Field mapping and filter rules you define
• Monitoring mode chosen: real time (IMAP IDLE) or interval

2.3 Usage data

• Access and activity logs in the configuration panel
• IP addresses and device information
• Message processing logs, with success or failure results
• Volume and performance metrics of the integration

2.4 Content of processed messages

• Name and email address of the sender and other visible recipients
• Subject and full message body
• Inline images and message attachments
• Date, time and technical message identifiers used for deduplication

2.5 Data accessed in Bitrix24

• Existing contacts, to find the sender before creating a new one
• Structure of pipelines, stages, fields and assignable users
• Deals and activities created by the application itself

Access uses official Bitrix24 authentication and is limited to the permissions granted when the application was installed.

3. Scope of processing

Processing performed by the Software is limited to these operations:

• Reading: IMAP connection to the mailbox you authorized and reading of incoming messages
• Extraction: sender, subject, body, inline images and attachments
• Writing: creating a deal in the chosen pipeline, creating or linking a contact, and recording a timeline activity with the message content
• Deduplication: comparing message identifiers so no duplicate record is created
• Processing log: recording the result, so failed messages can be reprocessed

The Software does not send emails on behalf of the connected mailbox, does not delete messages from the email server and does not use message content for any purpose other than the integration you configured.

4. Email content as third-party personal data

4.1 You are the controller, Manda4 is the processor

Regarding the personal data contained in received messages, you act as controller and Manda4 acts as processor. We process those messages exclusively according to the configuration you define in the application: the mailbox you connect, the filters you create, the destination pipeline and the field mapping.

4.2 Legal basis and communication with data subjects

Defining the legal basis for processing the content of received emails and informing data subjects about that processing is your responsibility as controller. That includes making clear, in your own privacy policy or service channels, that messages sent to your company mailboxes are recorded in the CRM.

4.3 Sensitive data sent spontaneously

A sender may include information you never asked for, including sensitive data, in the message body or in an attachment. The Software does not classify message content: it records what was received. Assessing that risk, guiding your team and using the available filters is your responsibility.

5. How we use information

5.1 Service delivery

• Monitor the connected mailbox and process incoming messages
• Create deals, contacts and activities in your Bitrix24 portal
• Prevent duplicate records and allow failures to be reprocessed
• Manage your account and subscription

5.2 Service improvement

• Analyze usage and performance to fix processing defects
• Investigate incidents you report
• Develop new integration features

5.3 Communication and support

• Send important service notifications
• Provide technical support
• Inform you about updates and new features

5.4 Legal compliance

• Meet legal and regulatory obligations
• Respond to requests from competent authorities
• Protect Manda4's rights and property

We do not use the content of processed messages for advertising, for enriching any database or for any commercial purpose of our own.

6. Credentials and mailbox access

About the credentials:

• They are provided by you and used only to connect the mailbox you indicate
• They are stored in protected form with restricted access
• They are not shared with third parties and are not used to send messages

We recommend using an app password, where your provider offers one, or an account dedicated to the integration, instead of a person's own password. You can end access whenever you want by removing the connection in the application, changing the password or revoking the app password at your email provider.

7. Where the data lives

7.1 Processing by Manda4

Message processing runs on Manda4 servers, which read the mailbox and write to your CRM. You do not need to keep servers of your own for the integration.

7.2 Retention of processing data

Processing data, such as message logs and the result of each attempt, is kept in limited form, for as long as needed to operate the integration, reprocess failures, provide technical support and meet legal obligations. The specific retention conditions that apply to your account are those set out in your subscription and can be requested at any time at [email protected].

7.3 After termination

Once the subscription ends, the Software stops monitoring the connected mailboxes. The records already created remain in your Bitrix24 portal, because they belong to you. Deleting those records is done by you, inside Bitrix24.

8. Filters and messages that create no record

You can configure filters so that certain messages are ignored, such as newsletters, noreply senders and spam. A filtered message creates no deal, contact or activity in the CRM.

Filter configuration is yours and it is a meaningful data minimization control: the more precise the filter, the less unnecessary content reaches your CRM.

9. Data sharing

9.1 We do not sell your data

Manda4 never sells, rents or trades personal data to third parties.

9.2 Authorized sharing

We share data only in the following situations:

• Bitrix24: as needed to write the deal, the contact and the activity in your portal
• The email provider you connect: as needed to establish the authenticated IMAP connection
• Infrastructure providers: services that support the operation of the Software, under confidentiality agreements
• Legal obligation: when required by law or court order

10. Security

No security measure removes risk entirely. If we identify a security incident that may pose relevant risk to data subjects, we will inform you so that, as controller, you can assess the notifications required by applicable law.

11. Data subject rights

11.1 Rights under LGPD and GDPR

• Confirmation and access: know whether processing exists and what data is held
• Correction: correct incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion: of unnecessary data or data processed unlawfully
• Portability: receive the data in a structured format
• Information about sharing: who the data was shared with
• Objection and withdrawal: object to processing and withdraw consent, where applicable

11.2 How to exercise these rights

If you are a data subject who emailed a monitored mailbox, address your request to the company that received the message, which is the controller and has access to the records in its own CRM. Manda4, as processor, supports that company in fulfilling the request.

If you are a Manda4 customer and need to handle data in your account or a request received from a data subject, write to [email protected].

12. International transfers

Infrastructure providers, the email provider you connect and Bitrix24 itself may operate outside Brazil. Where international transfer occurs, we adopt safeguards such as:

• Standard contractual clauses
• Assessment of the destination country's level of protection
• Other legally recognized guarantees

13. Cookies and similar technologies

The MandaMail configuration panel uses cookies and similar technologies to:

• Keep you authenticated
• Remember configuration preferences
• Analyze panel usage
• Strengthen security

You can control cookies in your browser settings.

14. Minors

MandaMail is intended for business use and not for individuals under 18. We do not knowingly collect personal data from minors. If we identify such collection, we will take steps to delete the information.

15. Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by email or within the application. We recommend reviewing this policy regularly.

16. Contact

For questions about this Privacy Policy or about personal data processed by MandaMail: