Cockpit AI · legal document
Privacy Policy
How Cockpit AI handles data on the website, in the dashboard, in the CRM, in the AI agents and in the Android and iOS apps.
Updated October 30, 2026 · Terms of Use (EULA)
1. Who processes the data
Cockpit AI is provided by Cockpit AI CRM Ltda, CNPJ 57.319.942/0001-54, Av. Franz Voegelli, 900, Indl. Autonomistas, Osasco/SP, CEP 06020-190, in Brazil, and by TLJ Tech Systems and Development, LLC, in the United States, referred to here as “Cockpit AI CRM”.
- Your account data (name, email, phone, photo, password) and data from the commercial relationship with Cockpit AI CRM: Cockpit AI CRM is the controller.
- Data your company puts in the CRM — customers, contacts, deals, conversations, messages, files: your company is the controller and Cockpit AI CRM is the processor, handling the data on its behalf and according to the configuration it chooses.
If you are a customer of a company that uses Cockpit (for example, you received a message, an email or a survey from it), requests about your data should go first to that company. Cockpit AI CRM helps the company respond.
2. Data we process
| Data | What it is for | How long we keep it |
|---|---|---|
| Account: name, email, phone, photo, password (stored only as a hash) and email confirmation | Sign in, identify who does what, recover the password and contact you | As long as the account exists |
| Free trial sign-up: name, company (or professional name), email, phone, whether it is a company or an individual, and the campaign source | Create the account and the workspace. The name, company, email, phone and source also go into the TLJ group's commercial CRM, so our team can help with the trial and present the plans | Account: as long as it exists. In the commercial CRM: until you ask to opt out or for up to 2 years without contact |
| CRM: contacts, companies, deals, activities, properties, sales, products, contracts, rentals, notes, files and the history of each record | The CRM's operation | As long as the company keeps it in the CRM; deleted when it deletes it or requests deletion |
| WhatsApp, Messenger and Instagram messages (text, media, status) from the numbers and pages the company connects | Serve the company's customers inside the CRM, campaigns, chatbot and surveys | As long as the company keeps the conversation in the CRM |
| Email marketing: recipients, sends, opens, clicks, unsubscribes and the suppression list | Send the company's campaigns and respect those who do not want to receive them | As long as the campaign exists; the suppression list, as long as the account exists |
| Website forms, storefront, satisfaction surveys and ad leads: what the person fills in, the campaign source (UTM) and consent | Create the contact and the deal in the right company and measure campaigns | Like the rest of the CRM data |
| Team chat and conversations with the AI agents | The team's internal conversation and the agents' answers | Chat: as long as the company keeps it; memory of the conversation with the agent: about 30 minutes |
| Integrations (Bitrix24, Zoho, Meta): access tokens | Read and write in the systems you connected | As long as the integration is on |
| Payment: plan, amounts, invoices and the customer identifier at Stripe | Charge and issue receipts. Card data stays with Stripe; Cockpit AI CRM does not receive it | For the period required by tax law |
| Access logs: IP address, date and time of each sign-in to the account | Legal obligation (Marco Civil da Internet, art. 15) and security | 6 months, kept confidential; only handed over by court order |
| Usage and security: browser, agent usage counters and anti-bot verification (Cloudflare Turnstile) | Protect against abuse, limit excess, fix errors and measure consumption | For as long as needed for security (generally, days); usage counters, as long as the account exists |
| Connected calendars (Google, Microsoft, Apple): the events you choose to sync and the access token | Show and create appointments in the CRM calendar | As long as the calendar is connected |
| Public website, only with your consent: pages visited, visit source (UTM) and sign-up events, through Google Analytics and the Meta Pixel (Google Tag Manager) | Measure where Cockpit AI's new customers come from and the results of our ads | According to the Cookie Policy; you can withdraw consent at any time |
Google Tag Manager only runs on the public pages of the Cockpit AI website and only after your consent in the cookie banner. It does not run inside the CRM or on client companies' pages (storefront, forms and surveys).
We only ask for what is necessary: the sign-up has six fields, the phone number is used for the account and for our contact, and the rest of the CRM data is whatever your company decides to record.
3. Legal bases
Each processing activity carried out by Cockpit AI CRM as controller has a legal basis under the LGPD (art. 7):
- performance of a contract and preliminary procedures — creating and maintaining the account, the workspace, billing and support;
- legitimate interest — commercial contact with those who created the trial account, security, fraud prevention and service improvement, always with the option to ask us to stop;
- compliance with a legal obligation — access logs (Marco Civil da Internet), tax documents and requests from authorities;
- consent — measurement and marketing cookies on public pages and the apps' permissions (notifications, camera, microphone, location);
- regular exercise of rights — keeping what is necessary for defense in proceedings, for the period set by law.
For the data your company puts in the CRM, it is the company, as controller, that chooses the legal basis.
4. Android and iOS apps
The apps access the same account and the same data as the web dashboard. In addition to what is in the table above, they may process:
- the device's notification identifier, to alert you about messages, tasks and leads, if you allow it;
- camera, photos and files, only when you choose to attach something;
- microphone, only when you record audio or make a call through the app;
- location, only in features that use it and if you allow it.
Each permission is requested by the device's system and can be withdrawn in its settings. The apps do not track you across other apps or websites and have an option to delete the account.
5. Artificial intelligence
The agents use language models run on Cloudflare (Workers AI). To respond, the service sends the model only the portion of data needed for that task — for example, a deal's fields, a list of activities or the notes from a survey.
- According to Cloudflare's documentation, this content is not used to train models.
- Cockpit AI CRM does not use your data or your customers' data to train its own models.
- Responses are produced by a statistical model and may contain errors.
6. What we do not do
- We do not sell, rent or transfer data.
- We do not use CRM data for advertising, ours or third parties'.
- We do not mix data from different companies: each workspace is separate, and the Cockpit AI CRM team only accesses a workspace to provide support or when the law requires it.
- We do not send messages to your company's customers on our own: the sends are the ones your company configures.
7. Who we share with
Only with the providers needed for the service to work, each for its own part:
- Cloudflare — servers, databases, file storage and artificial intelligence;
- Vercel — hosting of the website and the dashboard;
- Meta — WhatsApp, Messenger, Instagram and ad forms, when the company connects them;
- Amazon Web Services (SES) — email sending;
- Stripe — payments;
- Google — measurement of the website's public pages (Tag Manager and Analytics), only with consent, and the Google calendar, when connected;
- Meta — Pixel on the website's public pages, only with consent;
- Microsoft and Apple — calendars, when connected;
- Bitrix24 — the TLJ group's commercial CRM, which receives the free trial sign-ups;
- Bitrix24 and Zoho — when the client company connects those systems;
- authorities, when the law or a court order requires it.
Some of these providers are located outside Brazil. International transfers follow the LGPD, with providers that adopt appropriate contractual and security safeguards.
8. Your rights
Under the LGPD (Law 13,709/2018, art. 18) — and, where applicable, the GDPR — you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, deletion, information about sharing and review of automated decisions, as well as withdraw consents and object to processing based on legitimate interest. Write to atendimento@cockpitai.net.br. We respond within 15 days.
To stop receiving our commercial contact, reply to any message asking to opt out. Optional cookies are turned off under “Cookie preferences”, in the website footer.
You may also file a complaint with the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.
9. Deletion of the account and data
To delete the account, use “Delete my account” under My account, on the website, or the option in the app — or write to atendimento@cockpitai.net.br from the account's email. Deletion is immediate when it leaves nothing pending; if you are the only owner of a paid workspace or one with a team, Cockpit AI CRM will sort out the workspace with you and complete it within 7 days.
The owner of a workspace may delete contacts and records at any time and request deletion of all the workspace's data, carried out within 30 days. Only the records the law requires us to keep (access logs, for 6 months, and tax records) are retained, for the period set by law.
10. Security
All traffic uses HTTPS. Passwords are stored as hashes, and integration tokens in a restricted area. Each request is checked against the account and profile of whoever makes it, and each person sees only what their profile allows. There are limits against abuse and anti-bot verification at sign-up. No system is completely immune to incidents: if one affects your data, you will be notified as required by law.
12. Minors
Cockpit is a professional service, for people over 18. We do not knowingly collect data from children and teenagers as users.
13. Changes to this policy
This policy may be updated. The version in force is the one on this page, with the date at the top. Relevant changes are notified by email or within the service.
14. Contact and data protection officer
Questions, requests and the channel to the data protection officer: atendimento@cockpitai.net.br · phone (11) 5026-5199 — Cockpit AI CRM Ltda, CNPJ 57.319.942/0001-54, Av. Franz Voegelli, 900, Indl. Autonomistas, Osasco/SP, CEP 06020-190.