The short version: we collect the minimum needed for your device to work, for you to access your account and for us to provide support. We do not sell your personal data and we do not use voice recordings. When you speak to Alexa or Google, those companies process the audio and we only receive the interpreted command.
1. Who the controller of your data is
The controller of the personal data processed under this policy is:
- Legal name: SESIS, Sistemas de Engenharia e Software Ltda.
- Trading name / brand: Coisas Espertas
- Company register (CNPJ): 04.147.191/0001-70
- Address: Avenida São João, 2375, Sala 2005, Jardim Aquarius, São José dos Campos/SP, Brazil
- Privacy contact: contato@coisasespertas.com.br
- Phone: +55 12 3923-3831
In this policy, “Coisas Espertas”, “we” and “our” refer to the company above. “You” and “User” refer to the natural person whose data is processed.
2. Who this policy applies to
This policy covers personal data processing carried out through:
- the coisasespertas.com.br website and its contact and quote forms;
- the Coisas Espertas Home app, distributed on Google Play and the Apple App Store;
- the Coisas Espertas SmartHome skill for Amazon Alexa;
- the integration with Google Assistant and Google Nest devices;
- Coisas Espertas IoT devices (switches, dimmers, outlets and relays) and the cloud platform that connects them;
- our customer service, technical support and after sales channels (email, phone and WhatsApp);
- our design and installation services for automation, internet, audio, climate control, access and security.
3. Personal data we collect
We collect only what each purpose requires. The data below is grouped by source.
3.1 Data you give us directly
| Category | Examples | Where it is collected |
|---|---|---|
| Identity | Full name | App sign up, website forms, customer service |
| Contact | Email, phone, WhatsApp | App sign up, website forms, customer service |
| Credentials | Account password (stored hashed, never in readable text) | App sign up |
| Enquiry content | Message, subject, project description | Forms and support channels |
| Installation address | Street, number, unit, city, postcode | Only for site visits, projects or deliveries |
| Tax data | CPF or CNPJ, state registration | Only to issue invoices for purchases and services |
| Identity documents | ID card or equivalent | Only where needed to confirm your identity for a rights request (section 12) |
3.2 Data about the devices and environment you configure
- Names you choose for devices, rooms and scenes (for example “John's bedroom”, “Patio light”). We recommend avoiding names that reveal sensitive information.
- Technical device identifiers: serial number, model, firmware version and MAC address.
- State and commands: whether a device is on or off, dimming level, schedules, timers and scenes, plus a record of when each command ran.
- Local network data: the Wi-Fi network name (SSID) and the credentials entered during pairing. Wi-Fi credentials are used to provision the device and travel encrypted.
3.3 Data collected automatically
- Access and connection data: IP address, date and time of access, and application logs kept as required by the Brazilian Internet Civil Framework (Law No. 12,965/2014).
- Device data: model, manufacturer, operating system and version, language, install identifiers and app version.
- Diagnostics and performance: crash logs, errors and stability metrics, used to fix defects.
- Approximate and precise location: processed not linked to your identity and used only in the technical context described in section 6.
What we do not collect: we do not collect sensitive personal data (racial or ethnic origin, religious belief, political opinion, union membership, health data, sex life, genetic or biometric data). We do not record, store or process audio from voice assistants. We do not collect images or video through the Coisas Espertas Home app. We do not sell personal data.
4. How we use your data
- Delivering the service: creating and maintaining your account, authenticating access, syncing devices, running commands, scenes and schedules.
- Technical support: diagnosing problems, guiding installation and answering your tickets.
- Security: detecting unauthorised access, preventing fraud and protecting platform integrity.
- Continuous improvement: fixing faults, measuring stability and developing new features and firmware updates.
- Commercial and contractual: preparing quotes, delivering projects and installations, issuing invoices and meeting contractual obligations.
- Communication: sending operational and security notices (mandatory) and, only with your consent, news and promotions.
- Legal compliance: meeting tax, accounting and regulatory obligations and orders from competent authorities.
We do not use your data for automated decision making that produces legal effects or that significantly affects your interests.
5. Legal bases for processing
All processing relies on at least one of the grounds in Article 7 of the LGPD:
| Legal basis (LGPD) | When we apply it |
|---|---|
| Performance of a contract (Art. 7, V) | User account, device operation, app, cloud, projects, installation and warranty |
| Compliance with a legal obligation (Art. 7, II) | Invoices, retention of access logs, tax and accounting obligations |
| Legitimate interest (Art. 7, IX) | Platform security, fraud prevention, fault diagnosis and product improvement |
| Consent (Art. 7, I) | Marketing communications, non essential cookies and optional app permissions |
| Regular exercise of rights (Art. 7, VI) | Defence in judicial, administrative or arbitration proceedings |
Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.
6. Permissions requested by the app
The Coisas Espertas Home app asks only for the permissions the devices need. You can grant or revoke each of them at any time in your phone settings.
| Permission | Why it is needed | Mandatory? |
|---|---|---|
| Location (approximate and precise) | Required by Android to scan for nearby Wi-Fi networks and pair the device. Used only during setup. We do not use it to track you and we do not link it to your identity. | Only for pairing on Android |
| Wi-Fi and connection state | Discovering devices on your local network and enabling local mode control without depending on the internet. | Yes |
| Notifications | Sending device alerts, security notices and firmware updates. | No |
| Camera | Scanning a QR code to add devices faster. | No, a manual alternative exists |
| Storage / photos | Choosing an image to personalise a room. | No |
| Bluetooth | Initial provisioning on models that support Bluetooth pairing. | Only on applicable models |
If you decline an optional permission the app keeps working. Only the matching feature becomes unavailable.
7. Alexa, Google Assistant and account linking
To use the Coisas Espertas SmartHome skill or the Google Assistant integration you complete an account linking step, authorising the assistant to access only the data needed to show and control your devices.
- What the assistant receives from us: the device list, the names you defined, the type of each device and its current state (on, off, dimming level).
- What we receive from the assistant: the already interpreted command (for example “turn on Living room light”) and a technical identifier for the link.
- Voice audio: capture, storage and processing of audio are handled by Amazon or Google under their own privacy policies. Coisas Espertas does not receive, record or store voice recordings.
- How to undo it: disable the skill in the Amazon Alexa app or unlink the account in the Google Home app. From that moment the assistant loses access to your devices.
We recommend reading the privacy policies of Amazon and Google, which apply to your use of those assistants.
8. Who we share your data with
We do not sell or rent personal data. Sharing happens only in the situations below and is always limited to what is necessary:
- Technology processors and suppliers: cloud hosting, email delivery, push notifications and diagnostic tools, contractually bound to process data only on our instructions.
- Voice assistant platforms: Amazon and Google, only after your account linking and within the limits of section 7.
- App stores: Google and Apple, for app distribution and aggregated crash and performance reports.
- Payment and logistics: payment processors and carriers, when products are purchased and delivered.
- Installation partners: accredited technicians and integrators, with only the data required to carry out the visit or service you contracted.
- Authorities: judicial, administrative or government authorities, where required by law or a competent order.
- Corporate transactions: in a merger, acquisition or reorganisation, with prior notice and maintenance of the protection standard set out in this policy.
9. International data transfers
Some of our infrastructure and voice assistant suppliers keep servers outside Brazil. In those cases the international transfer follows Chapter V of the LGPD, with appropriate contractual safeguards including standard data protection clauses, and is always limited to the purposes in this policy.
10. How long we keep your data
| Data type | Retention period | Reason |
|---|---|---|
| Account and device data | While the account exists | Performance of the contract |
| Data after a deletion request | Up to 30 days for permanent removal from production and backups | Technical propagation window |
| Application access logs | 6 months minimum | Art. 15 of the Internet Civil Framework |
| Command and event history | Up to 12 months | Technical support and diagnostics |
| Video recordings (camera services, where contracted) | Up to 30 days | Security purpose |
| Tax and accounting records | 5 years, or the applicable legal period | Legal obligation |
| Service and support records | 5 years | Defence in a possible claim (Consumer Code) |
| Marketing data | Until consent is withdrawn | Consent |
Once the period and purpose end, data is deleted or irreversibly anonymised.
11. Information security
We apply technical and administrative measures to protect your data, including:
- encryption in transit between the device, the app and our servers;
- password storage using hashing algorithms, never keeping passwords in readable text;
- role based access control following the principle of least privilege;
- event logging and monitoring for anomalous access;
- firmware updates and security fixes delivered through the app;
- security assessment of suppliers before contracting.
No system is completely immune. If a security incident occurs with relevant risk to your rights, we will notify you and the Brazilian data protection authority (ANPD) within the legal deadlines.
You protect your account too: use a strong, unique password, do not share your credentials, keep the app updated and protect your Wi-Fi network password.
12. Your rights as a data subject
The LGPD grants you the following rights, at any time and free of charge:
- Confirmation and access: find out whether we process your data and obtain a copy.
- Correction: update incomplete, inaccurate or outdated data.
- Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully.
- Portability to another provider, subject to commercial and industrial secrecy.
- Deletion of data processed on the basis of consent, except where retention is legally required.
- Information about sharing with public and private entities.
- Information about the option not to consent and the consequences of refusing.
- Withdrawal of consent at any time.
- Objection to processing based on another legal ground, where the law is not being complied with.
- Review of automated decisions, where applicable.
- Complaint to the ANPD.
How to exercise them
Email contato@coisasespertas.com.br with the subject “LGPD, data subject”, giving your full name, the registered email address and a description of your request. To protect your account from fraudulent requests we may ask for additional identity confirmation. We will ask only for the minimum necessary and will use it solely to validate the request, discarding it afterwards.
Response time: up to 15 days for confirmation and access requests, with an immediate simplified response where applicable, under Article 19 of the LGPD.
13. Account and data deletion
In line with Google Play and Apple App Store policies, you can request deletion of your account and associated data through either route:
- In the app: go to Menu › My account › Delete account and confirm.
- By email: write to contato@coisasespertas.com.br with the subject “Delete my account”, from your registered email address.
What happens after the request:
- Deleted: registration data, credentials, linked devices, rooms, scenes, schedules and command history.
- Retained: only access logs, tax documents and data under mandatory retention, for the periods in section 10, in a segregated environment with restricted access.
- Deletion completes within 30 days, including removal from backups.
- Your physical devices keep working through manual touch control and can be set up again under a new account.
Please note: account deletion is permanent and cannot be undone. Scenes, rooms and schedules cannot be recovered once removed.
14. Children and teenagers
Our products and services are intended for people aged 18 and over. We do not knowingly collect data from children or teenagers. The app is not directed at children and does not take part in family programmes on the app stores.
Where a device is used in a household with children, the account holder must be the legal guardian. If we identify collection of a minor's data without the specific and prominent consent of at least one parent or guardian, we will delete that information. If you believe this has happened, write to contato@coisasespertas.com.br.
15. Cookies and similar technologies
On our website we use:
- Strictly necessary cookies: these keep the site working, secure and aligned with your browsing preferences. They do not require consent.
- Performance and analytics cookies: these help us understand in aggregate how pages are used so we can improve them. They require your consent.
- Marketing cookies: where used, these measure campaigns and show relevant advertising. They require your consent.
You can manage or delete cookies at any time in your browser settings. Disabling non essential cookies does not prevent you from using the site, but it may reduce some functionality.
16. Third party services and links
Our website and app contain links and integrations with third party services: Google Play, Apple App Store, Amazon Alexa, Google Assistant, WhatsApp and social networks. Those services have their own privacy policies, for which we are not responsible. We recommend reading them before use.
17. Changes to this policy
This policy may be updated to reflect legal, technical or business changes. The last updated date and version number always appear at the top of this page. Where a change is significant, for example a new processing purpose, we will notify you prominently on the website, in the app or by email, and we will ask for fresh consent where the law requires it.
We recommend revisiting this page from time to time. Continued use of our services after a new version is published indicates that you are aware of the changes.
18. Contact the Data Protection Officer
For questions, requests or complaints about privacy and personal data protection, contact our Data Protection Officer:
- Email: contato@coisasespertas.com.br (subject: “LGPD, DPO”)
- Phone: +55 12 3923-3831
- Address: Avenida São João, 2375, Sala 2005, Jardim Aquarius, São José dos Campos/SP, Brazil
You may also file a complaint directly with the Brazilian National Data Protection Authority (ANPD) at gov.br/anpd.
This Privacy Policy should be read together with our Terms of Use, which govern the use of the Coisas Espertas website, app, skill and devices.
Language: this is a translation provided for convenience. In the event of any conflict, the Portuguese version prevails, as Brazilian law governs this relationship.