1. Who we are and how to contact us
Marcos Luiz de sá (Filed OPS) operates the Filed OPS platform. For privacy, security, rights or deletion requests, contact suporte@filedopscrm.com. Our public data deletion page is /data-deletion.
Essential platform rules and information about data use.
This Privacy Policy explains how Filed OPS collects, uses, stores, shares and deletes personal data when providing the CRM, installable app and integrations. It also describes how we handle data received through Google, Meta, WhatsApp, email-provider and Stripe APIs.
Marcos Luiz de sá (Filed OPS) operates the Filed OPS platform. For privacy, security, rights or deletion requests, contact suporte@filedopscrm.com. Our public data deletion page is /data-deletion.
For account registration, platform security, subscription billing and platform administration, Filed OPS acts as a controller where it determines processing purposes. For data a business customer enters or imports about its own clients, leads, staff and contacts, Filed OPS generally acts as processor/service provider on behalf of that business. The business customer remains responsible for establishing a lawful basis, providing notices and obtaining consent when required.
We may process account and user data (name, email, phone, language, role, company and protected credentials); customer and lead data (name, company, phone, email, address, messages, source, campaign and requested service); appointments, jobs, checklists, photos/attachments, time and expenses; quotes, invoices, amounts and payment status; technical records (IP, browser, audit logs, webhooks and security events); and data obtained from integrations explicitly connected by the user or administrator.
We use data to create and manage accounts; authenticate users; provide the CRM; synchronize schedules; receive and organize leads and messages; generate quotes and invoices; process billing; send operational notifications; provide support; prevent fraud and abuse; maintain security, auditability and availability; comply with law; and improve features with aggregated or de-identified information. Where a specific legal basis is required, it may include contract performance, legal obligation, legitimate interests, fraud prevention or consent.
When you connect a Google Account, we request only the scopes required for enabled features. For Google Calendar, the CRM may use the calendar.events scope to create, update, read or remove events related to operational scheduling. For Google Ads and Google Local Services, the CRM may use the adwords scope to access authorized accounts, lead/conversation data and information necessary for configured features. OAuth tokens are protected and can be revoked by disconnecting the integration or through Google Account security settings. Filed OPS does not sell Google user data, does not use Google user data for targeted advertising, and does not permit humans to read Google user data except where necessary for security, legal compliance, or user-requested support. Filed OPS's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
When a business connects Facebook/Instagram, Filed OPS may receive Page and professional-account identifiers, Lead Ads data, messages, delivery/read events, postbacks and authorized webhook data. Integration tokens are protected and used only to perform requested CRM functions. Disconnecting stops new synchronization; previously imported data can be requested for deletion through the public data deletion page. Customers must comply with Meta terms and policies and maintain the notices, permissions and lawful bases required to process third-party data.
When WhatsApp or a WhatsApp API infrastructure is connected, the CRM may process phone numbers, identifiers, conversation content, delivery status and data required for routing and service history. The business customer is responsible for obtaining applicable consent, honoring opt-out/block requests and avoiding spam or prohibited messages. Data obtained through WhatsApp should only be used as reasonably necessary for authorized messaging and customer service.
If a business enables email integration, the CRM may securely store connection credentials and access inbound messages via IMAP to create leads and conversations, and may use SMTP or another configured provider for operational outbound email. Administrators must connect only mailboxes they are authorized to access and provide required notices to contacts where applicable.
When Stripe is enabled, payment data is processed by Stripe under Stripe's own terms and privacy policy. Filed OPS may store customer, subscription, invoice and transaction identifiers, amounts, currency and status needed for reconciliation. When using hosted Stripe Checkout/elements, Filed OPS does not need to store full payment-card numbers or security codes.
We may share data with providers strictly necessary to host and operate the platform, deliver email, process payments, execute authorized integrations, monitor security and provide support. Those parties receive only data necessary for their contracted purpose and are subject to their own contractual/privacy obligations. We may also disclose information when required by law, valid legal process, or to protect rights, safety and platform integrity. We do not sell personal data.
Filed OPS may use infrastructure and providers located in other countries. Where applicable, we use contractual mechanisms and safeguards appropriate to the transfer and applicable law. Use of Google, Meta, WhatsApp, Stripe and other providers is also subject to their own international-transfer practices.
We apply risk-appropriate technical and administrative safeguards, including HTTPS, tenant segregation, role-based access, password hashing, protection of tokens/secrets, webhook validation, audit logging, session revocation and operational backups. No transmission or storage method is absolutely secure, so incidents are handled under security procedures and applicable legal obligations.
We retain data while an account is active and for as long as needed to provide the service, resolve disputes, prevent fraud and meet legal/accounting requirements. Integrations may be disconnected by administrators. Deletion requests are assessed and, where applicable, we aim to complete them within 30 days unless a different legal period or legitimate retention requirement applies. Residual copies may temporarily remain in protected backups until normal backup rotation, without ordinary operational use.
Depending on jurisdiction, you may request confirmation of processing, access, correction, portability where applicable, information about sharing, consent withdrawal, objection, restriction, anonymization or deletion. For data belonging to a Filed OPS customer, we may route the request to the business controller responsible for that workspace. Contact suporte@filedopscrm.com or use the data deletion page.
The platform is intended for business use and is not directed to children. We do not intentionally invite minors to create business accounts. If we learn that a minor's data is being processed without an appropriate basis, we will take appropriate steps under applicable law and instructions from the responsible controller.
We may update this Policy to reflect legal, technical or product changes. The last-updated date will be shown on this page. Material changes may be communicated through the site, app or email when appropriate.
Some features depend on external services. See the applicable official policies as well: