Policy

Privacy Policy

How Vitto handles personal data on its website, iPhone, iPad and Android apps, management platform and supporting APIs.

Last updated: 7 October 2026.

Who processes your data

The controller of the data collected on this site is Vita Munhoz Tecnologia LTDA, Brazilian company registry (CNPJ) no. 59.414.271/0001-36, headquartered at Rua Clorivaldo Migliari, 150, Nova Ourinhos, Ourinhos/SP, Brazil, CEP 19.907-475 — the owner of the Vitto brand.

We act as controller for account administration, subscription billing, security, support and commercial relationships. For customer, supplier, staff, delivery and order data entered by a subscribing organization, that organization is the controller and we act as processor under its instructions, the agreement and applicable law.

Data we collect

On the website, we collect the information needed to answer your request and keep it secure:

• Demo request form: name, e-mail, phone with country code, business type and stage, plan of interest and message — to answer and make the commercial contact you authorized.
• Technical data: a one-way hash of the IP address for form rate limiting and abuse prevention. The hosting provider may keep IP addresses, browser, date and time in its own technical logs.
• Cookies and local storage: see our Cookie Policy.

Apps and operational data

Depending on the functions used, we process account and organization identifiers, contact details, permissions, customer and staff records, addresses, products, orders, purchase history, managerial financial records, selected images, free-text notes, sessions and security logs. Passwords and PINs are stored as hashes on the server. We do not request or store card numbers, security codes or bank login credentials; recording a payment method is not processing a card payment. Do not insert unnecessary sensitive data in free text.

Apps do not use advertising or cross-app tracking SDKs, advertising identifiers, analytics SDKs or crash-reporting SDKs. Website analytics remain optional. Customer information is not sold or shared for third-party advertising. Vitto is a business tool, not a service directed at children.

WhatsApp and optional AI

An organization may connect its number by QR code using WhatsApp Web, not the official WhatsApp Business API. Vitto processes conversation identifiers, phone numbers, messages, selected images, timestamps, sending status, support history, bot pauses, order drafts, campaign choices and technical connection data. History is isolated by organization and accessible according to user permissions. WhatsApp/Meta processes communications under its own rules.

When AI interpretation or support is enabled, the Vitto backend uses the OpenAI API with gpt-6-luna to interpret limited information and compose responses:

• Orders: selected permitted order information and item preferences, with catalog names, categories, descriptions, ingredients, sizes and options using temporary codes. Delivery addresses, payment and customer identification stay in the Vitto processing flow, outside that selection. The catalog sent does not include prices or internal customer or organization identifiers;
• Contextual support: excerpts from up to eight customer messages in the preceding 30 minutes, limited to 1,200 characters in total, plus necessary catalog context. Checks block content containing certain identifiable personal data. Customer records, phone numbers and other customer metadata are not included in this context. Free text means these controls do not guarantee complete anonymity;
• Control: OpenAI has no establishment credentials, database access or action tools. Product, price, availability and permission checks stay in Vitto. AI produces drafts for human review, not completed orders. Automated replies depend on the support settings and rules.

The organization can disable AI and the bot in WhatsApp settings and retain manual service. This stops new use of those functions, not deletion of existing history. Enabling a feature does not replace the organization's duty to inform customers, establish a suitable legal basis and obtain consent where required. We do not assume that customer consent has already been obtained.

Broadcast campaigns: selection by purchase history, city and neighborhood is processed in Vitto, not sent to AI as a customer list. Campaigns may include an image and at most 200 customers. Explicit consent is required and opt-outs must be respected.A purchase is not consent to receive campaigns.

Delivery location and device permissions

With the courier's consent and device permission, precise location is sent while a delivery is in route, including in the background when permitted. Authorized organization users can see the courier's position and route. The public delivery link shows limited order progress, the customer's first name and neighborhood, not precise courier coordinates. Tracking stops when no deliveries remain in route, on logout or when paused; permission can also be revoked in device settings. Delivery management remains available without tracking. The preference is remembered per courier and organization on the device.

Only images selected for upload are sent, not the entire photo library. Local-network access supports configured printing. Local storage may hold sessions, tokens, terminal identifiers and preferences. The saved-access option stores only the company code, not the PIN. Removing local data does not delete server records.

Legal basis

For the website contact form, we use your consent, given when you check the consent box on the form and revocable at any time, and on our legitimate interest in keeping the site secure and functional (technical logs and abuse prevention), always proportionally and without affecting your rights.

Platform processing may also rely on contract performance, legal obligations, exercising rights, or proportionate legitimate interests such as security, depending on the purpose. The organization determines the legal basis for data it controls, including WhatsApp and AI use. Consent applies to optional analytics, courier location and other appropriate situations and can be withdrawn.

Sharing and processors

We limit access to authorized personnel and providers needed for each purpose. Website providers include:

• Hosting and infrastructure (Locaweb), to store the site and database;
• E-mail delivery service, to forward your message to our sales team;
• Google Analytics (GA4) — off by default — only activated if you accept analytics cookies in the consent banner.

Platform recipients also include hosting and database providers, OpenAI for the limited AI inputs above, WhatsApp/Meta for communications, local printing services, and authorities when legally required. ViaCEP receives the postcode and our server's IP, not the device's IP. OpenStreetMap map images are loaded by the device; configured OSRM routing and optional Nominatim geocoding use the data necessary to calculate routes or locate delivery addresses. Provider information can be requested through our privacy contact.

OpenAI, WhatsApp/Meta and optional Google Analytics may process data outside Brazil. We do not promise exclusive processing in Brazil. International transfers must observe the applicable LGPD and ANPD requirements and safeguards.

How long we keep it

Data is retained for its purpose and, when justified, contractual duties, legal obligations or exercising rights. Organization data follows its instructions and applicable duties. WhatsApp history, drafts, delivery records, campaign preferences and connection data do not have one guaranteed automatic deletion period: cleanup configuration and record type matter. The AI's 30-minute context window is not the retention period for history. Restricted backups are progressively replaced; deletion requests consider lawful retention.

OpenAI's documentationsays API data does not train models by default, unless explicitly opted in. Abuse logs may contain content and normally remain up to 30 days, with legal or safety exceptions. We use store=false; this does not mean zero retention.

Security

We use HTTPS, role-based access, logical separation between organizations, server-side password hashes, rate limits, audit records and restricted administrative access. No environment is infallible; relevant incidents are assessed and notified where required.

Your rights

Under Brazil's General Data Protection Law (LGPD — Law 13.709/2018), you may at any time request confirmation of processing, access, correction, portability, deletion of your data and withdrawal of consent, via contato@vitamunhoztecnologia.com.br.

Authorized administrators can start an account-deletion request in the app under Settings → Privacy and data. This records a request, not immediate deletion. We may verify identity, representation and scope. For data controlled by a subscribing organization, contact that organization; we assist as processor. Readaccount and data deletion instructions or use our privacy email. Requests also cover sharing information, objections, restriction or deletion where applicable; you may contact Brazil's ANPD after contacting the controller.

Changes to this policy

We may update this document to reflect site improvements or legal changes. The version in force is always the one published on this page, with the update date at the top.

Questions about this document? Write to us at contato@vitamunhoztecnologia.com.br.