lyraPlatform

Privacy Policy — Lyra Platform

Last updated: November 13, 2026

1. Who we are and how to contact us

Lyra Platform is operated by VISUAL WEB DIGITAL BRASIL LTDA, a Brazilian limited liability company registered under CNPJ 30.585.094/0001-79, at Rua Frederico Moura, 1407, Cidade Nova, Franca, São Paulo, 14401-150, Brazil. The company uses the Talarico Labs commercial brand. Lyra Platform includes Lyra Agency, LeadFlow, and Social.

For privacy questions and personal data requests, contact privacy@lyrasuite.com.

2. Scope and our role

This Policy describes personal information processed in connection with the platform, account administration, security, support, and features that are actually enabled.

VISUAL WEB DIGITAL BRASIL LTDA may act as a controller for account management, security, communications addressed directly to Lyra, and administration of its relationships with users and organizations. When a business uses Lyra to manage its contacts, customers, workers, campaigns, or communications, that business generally decides the purposes of that processing, and Lyra may act as a processor on its behalf. Roles depend on the particular activity and applicable arrangements. In agency–end-customer relationships, the roles of the agency and its customers likewise depend on the circumstances.

Where another organization controls the information, we may refer or coordinate a request with that organization without disclosing another customer's information.

3. Information we process

Depending on features used, information may include:

Free-text fields, messages, and files submitted by customers may contain sensitive information or information about children or teenagers. The service is intended for professional use; customers should avoid submitting unnecessary information and meet applicable legal requirements.

We process information to provide and secure accounts and services; perform requested features; synchronize authorized channels; organize business operations; provide support; detect misuse and security issues; preserve necessary records; and comply with legal obligations.

When we act as a controller, the applicable legal basis depends on the activity and may include performance of a contract or pre-contractual steps, compliance with legal duties, establishment or exercise of legal rights, legitimate interests where legally appropriate, or consent when required. When we act as a processor, we follow lawful controller instructions and applicable obligations. Consent is not necessarily the legal basis for every feature.

Customer content is not offered for Lyra's independent sale or advertising. An optional statistical contribution feature intended to help improve the product was not collecting data in the environment assessed; any activation is subject to its own applicable notices and controls.

5. Meta and other connected services

When an organization connects Meta services such as WhatsApp, Instagram, Messenger, advertising, or social publishing, Lyra processes information made available through the relevant APIs, within the permissions and features enabled. This may include account identifiers, messages, attachments, conversation history, campaigns, posts, aggregated results, and events.

Disconnecting an integration in Lyra stops use of the local connection and removes or invalidates locally stored credentials as supported by the flow. It does not necessarily revoke authorization at Meta or delete information previously imported. Users can also manage permissions directly through Meta. Requests concerning stored information may be sent to our privacy address, subject to the customer controller's responsibilities and applicable technical and legal limitations.

Third-party features remain subject to the applicable providers' terms, policies, and availability.

6. Google services integrations

Lyra Social is preparing integrations with Google Ads, Google Analytics 4, and Google Business Profile. An integration can access information from an authorized Google account only after the applicable authorization and the feature's availability.

When implemented and enabled, these integrations may process, subject to the scopes displayed during authorization, authorized account and resource details, advertising campaigns and performance reports, analytics properties and reports, or business profile information and interactions. Available features, read or write operations, and requested permissions will be presented in the connection flow and relevant feature information.

Data received from Google APIs will be used solely to provide the visible, user-authorized Lyra Social features, in accordance with applicable Google API policies. We will not sell this data, use it for independent advertising, or use it to train general-purpose AI models. Human access, transfers to other parties, and storage of Google user data must remain within the applicable Google policy limitations and what is necessary to provide an authorized feature, protect security, or comply with law.

Until these integrations are implemented and enabled, Lyra does not collect Google account information through them. Disconnecting does not necessarily remove previously synchronized data. Account owners may also revoke access through their Google Account security settings. Requests to delete information stored by Lyra may be directed to privacy@lyrasuite.com and will be evaluated in light of the parties' roles and applicable requirements.

7. Artificial intelligence and automated processing

Some features use third-party AI providers, including OpenAI, for audio transcription, message analysis, response generation, classification support, meeting or document summaries, and marketing content creation. Depending on the feature, we may send text, messages, pictures, audio, transcripts, documents, briefs, brand information, and contractual content needed to perform the operation.

LeadFlow may use automated replies, CRM updates, routing, and lead scoring. These activities may affect how inquiries are prioritized or handled. Organizations enabling automation should assess notices to their contacts, appropriate human oversight, and individual rights. Requests related to qualifying solely automated decisions will be reviewed under applicable law.

Provider-specific retention, processing, and potential use of information are governed by the relevant services and applicable terms. The absence of all third-party retention should not be assumed.

8. Providers and international transfers

We may share information necessary for enabled features and operations with service providers, including, as applicable, OpenAI, Meta, LiveKit Cloud, Cloudflare R2, Hostinger, Telnyx, and Autentique, as well as recipients configured by the customer, such as email services and outbound webhooks. Not every provider handles information about every customer.

These services may involve international transfers of personal information, including to the United States and other locations where providers operate. Processing locations vary by service; we do not represent that all data stays in Brazil. Transfers subject to Brazilian data protection law must comply with a lawful basis and an applicable transfer mechanism under the LGPD and ANPD rules. Contact us for information about a particular transfer.

9. Security

Lyra uses authentication, organization- and context-based permissions, security records, and encryption for certain integration credentials. Separation among customer organizations is logically enforced by the application. Some assets intended for public display may be accessible using application-provided URLs; other content requires authentication or temporary access mechanisms.

We use technical and organizational safeguards appropriate to the risks, but no system can guarantee absolute security. Users should safeguard their credentials and report suspected unauthorized access.

10. Cookies, browser storage, and logs

Some Lyra applications use browser storage, including localStorage, for session and authentication information; other interfaces use authentication cookies. Webchat embedded on customer websites may store a visitor identifier and record the visited page and browser details. IP addresses, user agents, requested URLs, and technical events are also processed for operations and security. Third-party tools loaded for particular connection features may use their own storage technologies.

11. Retention, backups, and deletion

Retention depends on the information category, purpose, legal obligations, and features used. There are cleanup routines for some categories, but there is no single automated deletion period for all customer information. Some records, messages, metrics, summaries, and files may remain after a feature is disabled or a connection ends.

In some modules, deleting a contact archives the record instead of permanently erasing it. Backups and file mirrors may retain information after an active copy is deleted. Applicable retention periods and the feasibility of handling such copies require category-specific assessment. Disconnecting a provider does not necessarily erase all previously imported data.

Contact our privacy address to request an evaluation of access, correction, deletion, or another applicable action. Requests are considered in light of controller/processor roles, individual rights, and any lawful retention duties. A universal self-service account erasure or full personal-data export tool is not available across all products.

12. Your privacy rights

Subject to applicable law, individuals may have rights to confirmation of processing, access, correction, information about disclosures, anonymization, blocking or deletion where legally applicable, portability under relevant rules, and certain rights concerning automated decisions.

Contact privacy@lyrasuite.com. We may require proportionate identity verification to protect against unauthorized disclosure. If a customer organization controls the information, we may refer or coordinate the request with that organization. We respond under applicable legal requirements and timeframes. Fulfillment may depend on legal conditions, controller instructions, and justified limitations.

13. Children and teenagers

Lyra is intended for business and professional activities, not directed at children. Information entered by customer organizations may incidentally concern minors. The party determining the processing purpose should comply with the child's or teenager's best interests and applicable legal requirements.

14. Changes to this Policy

We may update this Policy to reflect service, vendor, or legal changes. The current version will be identified by the update date on this page. Where a change requires specific notice, renewed consent, or another legal measure, we will follow the applicable requirements.

Privacy contact: privacy@lyrasuite.com.