Privacy Policy
Last updated: September 2026
1. Who we are
Khelp is a management platform for non-profit organizations. This policy describes how we process the personal data collected through our platform and by the organizations that use it.
Data controller (LGPD): K F DO ESPIRITO SANTO, CNPJ 68.276.397/0001-82, with registered office at Av. Alexandre Soares, 87, Anexo 03, Centro, Taboleiro Grande/RN, CEP 59840-000, Brazil.
2. Data we collect
We collect the following data when you interact with the platform:
- Full name, email, CPF/CNPJ (taxpayer ID) and phone number (in registrations and donations)
- Payment data processed by PCI-DSS certified processors (we do not store full card numbers)
- IP address, device and browser, for security purposes
- Interaction history (donations, messages, volunteering)
3. Purpose of processing
We use your data to:
- Process donations and issue receipts
- Communicate with you about your contributions and about the chosen NGO
- Ensure the security of the platform (fraud prevention)
- Comply with legal and tax obligations
4. Legal basis (LGPD)
Processing is carried out on the basis of your consent (art. 7, I), the performance of a contract (art. 7, V) and compliance with a legal obligation (art. 7, II).
5. Sharing
We share data only with: (a) the organization receiving the donation; (b) the payment processor it uses (varies by country and payment method); (c) infrastructure providers (Supabase, Vercel, Resend); (d) artificial intelligence providers (Anthropic, OpenAI), which process conversation text only to draft replies, when the organization turns on the automated assistant; (e) authorities when legally required. We never sell data.
6. Facebook and Instagram (Meta)
When an organization connects its Facebook Page or Instagram professional account to Khelp, we receive from Meta, with the authorization of the person who connected it: the name, picture and ID of the Page and account; an access token, stored encrypted; the private messages and comments sent to the organization, with the ID and public name of the sender; and data about posts made through the system, such as the link and reach.
We use this data only on behalf of the organization itself: to answer messages (including through the automated assistant, which identifies itself as such and hands the conversation to a person on request), reply to comments, publish what the organization approves and measure results. We do not sell this data, use it for advertising, or share it with other organizations.
How long we keep it: comments received are kept for 180 days and then deleted from here (they remain on the social network). Post metrics — views, reach and interactions — are counts about the post, with no data about who saw it. When someone opens a post donation link, we count the visit per day, without cookies and without recording the visitor IP address.
The organization can disconnect the account at any time under Social media → Connected accounts: the access token is deleted immediately and we stop receiving messages and comments from that account. Access can also be removed in Facebook or Instagram settings.
How to request deletion of data received from Meta: Facebook and Instagram data deletion
We process this data in accordance with Meta's Platform Terms and Developer Policies.
7. Your rights (art. 18 LGPD)
You may, at any time:
- Confirm the existence of processing of your data
- Access, correct or request the deletion of your data
- Request portability or anonymization
- Withdraw consent
To exercise any of these rights, contact us by email atprivacidade@khelp.com.br.
8. Retention
We keep your data for as long as necessary for the purposes above and to comply with legal obligations (a minimum of 5 years for tax data).
9. Security
We adopt technical and administrative measures to protect your data: encryption in transit (HTTPS), multi-factor authentication, access monitoring and auditing.
10. Data Protection Officer (DPO)
Contact of the officer in charge of data processing:dpo@khelp.com.br.
11. Changes
This policy may be updated. The current version will always be available on this page, with the date of the latest revision at the top.