ConexBot CRM is a WhatsApp Web sales automation tool. Its single, core purpose is to help businesses manage contacts, schedule and send messages, run CRM pipelines, and warm up their WhatsApp accounts — all directly within the WhatsApp Web browser tab. Every permission and every piece of data collected serves this single purpose and no other.
Local-first design: Contacts, campaigns, CRM records, scheduled messages, templates, and all settings are stored exclusively on the user's own device (chrome.storage.local / IndexedDB). They are never uploaded to our servers. Only the minimum data listed in Section 1 is transmitted externally — always over HTTPS, always for the specific purpose stated, never for advertising or profiling.
The table below is the complete, exhaustive, and non-omitting list of every category of personal data the Extension collects, processes, stores, and shares. There are no hidden categories.
| Data category | Exact data collected | Purpose of collection | How it is processed | Storage location & retention | Shared with |
|---|---|---|---|---|---|
| 1.1 Account & License | Email address, full name, license key identifier (issued by Hotmart at purchase) | Authenticate user access to the Extension; validate that the license is active and not shared fraudulently; display account information inside the Extension panel | Sent via HTTPS POST to api.conexbot.com/license/verify on each WhatsApp Web page load and on-demand. Server returns only a license status object (active / expired / invalid). The email and name are stored in our database for account management. |
ConexBot servers (TLS in transit, AES-256 encrypted at rest). Retained for the duration of the active license plus up to 5 years after termination, as required by Brazilian tax law (Lei nº 9.430/1996). | Hotmart (payment processor) — receives email and name at the moment of purchase for license generation. No other sharing. |
| 1.2 Telemetry & Fraud Prevention | IP address (IPv4/IPv6), Chrome browser version, Extension version number, anonymous installation ID (a UUID generated locally on first install, with no link to personal identity) | Detect fraudulent license sharing (one license used on many machines simultaneously); monitor Extension compatibility across Chrome versions; generate aggregate usage statistics | Sent automatically alongside every license verification request to api.conexbot.com. The IP address is compared against a list of known VPN/proxy exits for fraud scoring only and is not used for behavioral tracking or profiling. |
ConexBot servers. IP addresses are automatically deleted after 90 days. The anonymous installation ID and Chrome version are kept for the duration of the active license. | Nobody. This data is never shared with any third party. |
| 1.3 AI Assistant Text (optional — user must explicitly type text and click "Generate") |
Text typed by the user in the AI reply assistant field inside the Extension panel | Generate a suggested customer-service reply using OpenAI's language model | The text is transmitted via HTTPS through a ConexBot-controlled relay proxy at api.conexbot.com/ai/generate, then forwarded to the OpenAI API. The proxy adds authentication credentials; it does not read, log, store, or analyze the content of the text. No WhatsApp conversation text, contact data, or other personal information is included in this request. |
Not stored by ConexBot. The text is processed in real time by OpenAI and is subject to their Privacy Policy. ConexBot retains no copy. | OpenAI (via ConexBot relay proxy) — only the text the user explicitly typed in the AI field, for the purpose of generating a reply suggestion. |
| 1.4 P2P Account Warmup (Maturador) (optional — user must activate the Maturador feature) |
WhatsApp phone number of the logged-in account (with international country code, e.g. +5511999999999) | Participate in ConexBot's mutual account warmup network: the server pairs users' numbers to exchange short, natural-looking messages, simulating organic WhatsApp usage to reduce the risk of account restriction by Meta's anti-spam systems | The phone number is sent periodically (every 2–7 minutes while the Maturador is active) to api.conexbot.com/maturador/tick. The server responds with a command specifying which number to message and what type of interaction to perform (text, reaction, audio, etc.). The Extension executes this via the WhatsApp Web DOM. No message content is stored by ConexBot. |
ConexBot servers. The number is retained only for as long as the Maturador feature remains active. It is deleted immediately when the user disables the feature or uninstalls the Extension. | Nobody. The phone number is never sold, shared, or disclosed to any third party. |
| 1.5 Local User Data (never transmitted to our servers) |
Contacts imported by the user (name, phone number, tags, notes), message campaign lists, CRM deal records and pipeline stages, scheduled messages and their content, message templates, Extension settings and preferences | Provide the core CRM, campaign scheduling, and message automation features of the Extension | Processed exclusively within the user's Chrome browser, inside the Extension's isolated sandbox. This data is never transmitted to ConexBot's servers or to any third party, with the sole exception of optional third-party CRM integrations configured explicitly by the user (see 1.7). | User's own device only — stored in chrome.storage.local and IndexedDB within Chrome's extension storage. This data is automatically removed when the user uninstalls the Extension or uses the "Clear all data" function inside the Extension settings. |
Nobody (except optional CRM integrations — see 1.7). |
| 1.6 Payment Data | Name, email address, and payment instrument details (credit/debit card, PIX key, boleto) provided at the time of license purchase | Process the license purchase and issue an electronic invoice (NFS-e) as required by Brazilian tax law | Processed entirely by Hotmart (PCI-DSS Level 1 certified payment processor). ConexBot never receives, processes, handles, or stores credit card numbers, CVV codes, or any other payment credentials. ConexBot receives only a license confirmation object from Hotmart after a successful payment. | Not stored by ConexBot. Stored and managed by Hotmart under their Privacy Policy. CPF/CNPJ and address are retained by ConexBot's accounting system for the period required by Brazilian tax authorities (5 years). | Hotmart (payment processor); Brazilian tax authorities (Receita Federal) for mandatory electronic invoice generation. |
| 1.7 Third-Party CRM Integration Data (optional — user must configure and authorize each integration) |
Contact names, phone numbers, email addresses, deal stages, pipeline values, and notes — only the fields the user explicitly selects for synchronization | Synchronize the user's sales data between the ConexBot Extension and a third-party CRM platform chosen by the user | Sent directly from the user's browser to the selected CRM platform's API using API credentials provided and authorized by the user. ConexBot's servers do not intermediate, store, or have access to these credentials or the synced data. | Not stored by ConexBot. Stored by the respective CRM platform under their own privacy policy. | Pipedrive, RD Station, HubSpot, Monday.com, Pipe.run, or Trinks — only when the user actively configures and activates the integration for that platform. |
ConexBot Softwares expressly declares that the Extension does not collect, access, read, store, or transmit to our servers any of the following:
web.whatsapp.comEach Chrome permission requested by this Extension has a single, specific, and necessary purpose:
| Permission | Why it is required |
|---|---|
storage / unlimitedStorage |
Save contacts, campaigns, CRM records, and settings on the user's own device via chrome.storage.local. Data never leaves the device through this API. |
alarms |
Schedule automatic message sending at times set by the user, and run periodic license validity checks in the background. |
activeTab / scripting |
Inject the Extension UI overlay and message automation logic into the WhatsApp Web tab. Required to interact with WhatsApp's DOM to send messages on behalf of the user. |
notifications |
Display browser notifications to inform the user when a message campaign finishes, when a send error occurs, or when license status changes. |
offscreen |
Run secondary background tasks (e.g., parsing public group-list pages for the Group Finder tool) without interfering with the user's active WhatsApp Web tab. |
Host permissions — access to external domains is limited to:
https://web.whatsapp.com/* — Extension UI injection and message automation (core function)https://api.conexbot.com/*, https://conexbot.com/* — License authentication, P2P warmup coordination, AI relay proxy, and Group Finder reference datahttps://api.openai.com/* — Optional AI assistant feature (user-initiated only)linkdegrupo.com.br, gruposdezap.com, centraldelinkswhats.com.br, etc.) — Only when the user uses the Group Finder toolnominatim.openstreetmap.org, tile.openstreetmap.org — Map display when the user sends a location messageThe use and transfer of information received from Google APIs and user data comply in full with the Chrome Web Store Developer Program Policies — Limited Use. ConexBot Softwares explicitly declares that:
| Third party | Data shared | Purpose | Mandatory or optional |
|---|---|---|---|
| Hotmart | Name, email address, payment details | License purchase and issuance | Mandatory to purchase a license |
| OpenAI | Text typed in the AI assistant field | Generate a reply suggestion | Optional — only when user clicks "Generate" |
| CRM platforms (Pipedrive / RD Station / HubSpot / Monday.com / Pipe.run / Trinks) |
Contact names, phone numbers, deal data selected by user | CRM synchronization | Optional — only when user configures integration |
| Brazilian tax authorities | CPF/CNPJ, address (for NFS-e) | Mandatory electronic invoice issuance under Brazilian law | Mandatory (legal obligation) |
ConexBot Softwares does NOT sell, rent, trade, or commercially disclose user data to any advertiser, data broker, analytics platform, or any other entity not listed in the table above.
| Data type | Where stored | How long |
|---|---|---|
| Contacts, campaigns, CRM records, settings | User's device only | Until user uninstalls Extension or clears data |
| Email, name, license ID | ConexBot servers (encrypted) | License term + 5 years (tax obligation) |
| IP address, Chrome version, install ID | ConexBot servers | 90 days, then automatically deleted |
| WhatsApp phone number (Maturador) | ConexBot servers | Only while feature is active — deleted immediately on disable or uninstall |
| AI assistant text | Not stored by ConexBot | N/A — real-time relay to OpenAI only |
| Payment and invoicing data | Hotmart + ConexBot accounting | 5 years (Brazilian tax law) |
Under Brazil's General Data Protection Law, you have the right to:
To exercise any right, email suporte@conexbot.com. We will respond within 15 business days.
All data transmitted to ConexBot servers uses TLS 1.2+ encryption. Data at rest is encrypted with AES-256. Access to production systems is restricted to authorized personnel only, with multi-factor authentication. Data stored locally in the user's browser is isolated within Chrome's extension sandbox and inaccessible to other extensions or websites.
This Extension is intended exclusively for business users aged 18 or older. We do not knowingly collect personal data from minors. If we become aware that data from a minor has been collected, it will be permanently deleted immediately.
We may update this Privacy Policy to reflect changes to our practices, the Extension's features, or legal requirements. The effective date at the top of this page will always reflect the most recent revision. Users with an active license will be notified by email of any material changes.
The current version is always available at: https://conexbot.com/privacy.html