Table of contents
- Scope and roles
- Definitions
- What an Agent does
- The Business's AI Provider (bring your own key)
- Data sent to the AI Provider
- AI Notice and contact with a person
- WhatsApp and other messaging channels
- Consent, marketing and opt-out
- Health data and other sensitive data
- Minors
- Retention and deletion
- The Business's obligations
- Prohibited uses
- Accuracy of Agent answers
- Security, incidents and impact assessments
- SonhoLab commitments and suspension
- Responsibility and liability Annex A. End User notice template
1. Scope and roles
1.1 This Addendum applies to every organization that uses an Agent or Messaging (section 2) offered by L. M. PEREZ MONTANA, trade name SonhoLab, CNPJ 61.620.014/0001-00, Rua Fausto Cabral, 871, Casa A, Vicente Pinzon, Fortaleza-CE, 60181-227, Brazil ("SonhoLab"), to talk with its own customers, leads or contacts. Today this covers:
- (a) Jesse, the WhatsApp assistant that serves several businesses, each with its own configuration;
- (b) the agents of Digital Team OS;
- (c) the optional AI agent of Restaurant System, on the web and on WhatsApp, and its WhatsApp Business Platform connection;
- (d) any other System that offers AI agents or business messaging to a business's customers, from the moment it offers them.
1.2 It supplements the Terms of Service, the Data Processing Addendum (DPA), the Acceptable Use Policy and the AI Transparency Notice. If they conflict, this Addendum prevails for Agents and Messaging, except that the DPA prevails where it gives End Users more protection (DPA, section 20.3).
1.3 Other product addenda. Where a System has its own product addendum, that addendum also applies, and its stricter rules prevail. In particular, the AI assistant of Clínicas is governed by the Health Data Addendum (Clínicas), and CobraDia receipts and collection messages by the Debt Collection Addendum (CobraDia). Verita does not use Agents or Messaging (AI Transparency Notice, section 2.1).
1.4 The Business is the controller of Agent Data. It decides why and how that data is processed. It is the "controller" under the GDPR, the "controlador" under the LGPD and the "business" under US state privacy laws.
1.5 SonhoLab is the processor ("operador", "encargado", "service provider"). It processes Agent Data only on the Business's documented instructions and under the DPA. It hosts the platform, stores conversations, runs the messaging channel and sends to the Business's AI Provider the data that the Business's configuration sends (AI Transparency Notice, section 3.2(d)).
1.6 SonhoLab's own agents. When SonhoLab uses an agent for its own business, for example its website chat or its support desk, SonhoLab is the controller and the Privacy Policy applies. Those agents follow the same AI Notice, contact and opt-out rules.
1.7 Accounts that already use an Agent. For Business accounts created before 25 October 2026 that already use an Agent or Messaging, the duties in this Addendum that go beyond the Terms of Service, the DPA and the AI Transparency Notice apply from 24 November 2026. By that same date, SonhoLab adapts the Agents and Messaging of those accounts to what this Addendum describes, in particular the Business's own AI key (section 4), the AI Notice (section 6), the acceptance for the unofficial connection (section 7.4) and the retention periods (section 11).
1.8 Acceptance. The Business accepts this Addendum when it signs up for a System whose service includes an Agent or Messaging. Where the Agent or Messaging is optional in a System, as in Restaurant System, the Business accepts this Addendum when it turns on the Agent or Messaging. SonhoLab records the version and fingerprint that the Business accepted (Terms of Service, section 3.3). For the accounts in section 1.7, using an Agent or Messaging after 24 November 2026 also means accepting this Addendum.
2. Definitions
- Business: the organization that uses an Agent or Messaging to talk with its own customers, leads or contacts. It is the Customer under the Terms of Service.
- End User: a person who talks with the Business through an Agent or Messaging. End Users are third parties who never signed up with SonhoLab.
- Agent: an AI assistant that the Business configures in a System to answer or write to End Users on its behalf.
- Messaging: the functions of a System that send or receive messages between the Business and End Users, such as WhatsApp, whether or not an Agent takes part.
- Business's AI Provider: the AI provider that the Business chooses, contracts with and connects to a System with its own key. It is the "Customer's AI Provider" of the AI Transparency Notice.
- Agent Data: personal data of End Users processed through an Agent or Messaging, including messages, voice notes and their transcripts, images, payment receipts, appointments, lead notifications and contact details.
- AI Notice: the message that tells End Users that they are talking to an AI, together with a way to contact a person at the Business (section 6).
3. What an Agent does
3.1 Depending on the System and the plan, and only with the functions the Business turns on, an Agent can:
- (a) answer End Users on WhatsApp or in a web chat, using the information the Business provides, such as services, prices, menu, opening hours, delivery zones and policies;
- (b) help End Users book appointments or reservations, or place orders;
- (c) read images and documents that End Users send, such as payment receipts;
- (d) transcribe voice notes;
- (e) search the web to answer general questions;
- (f) notify the Business of new leads and requests, with the End User's name, phone number and a short summary.
3.2 The Business configures the Agent: its name, tone, knowledge and instructions. The Agent may have a name, but it must always identify itself as an AI (section 6).
3.3 Plans. Agents exist only on paid plans. The Free plan of every System has no AI functions.
3.4 Lead notifications go only to the contacts the Business sets up. They are Agent Data. The Business must keep them confidential and use them only to answer that End User.
4. The Business's AI Provider (bring your own key)
4.1 The Business's own key. Every AI function of an Agent (language, reading images and receipts, and voice-note transcription) runs only on the Business's AI Provider, with the API key that the Business enters in the System's settings. The Business chooses the provider and the model among those the System supports and contracts with the provider directly. SonhoLab never supplies an AI key for an Agent, and SonhoLab's own AI accounts are never used for Agents. The Agent's AI functions stay off until the Business adds its key.
4.2 The Business's own vendor. The Business's AI Provider processes Agent Data under the Business's own contract. It is the Business's own vendor, not a SonhoLab subprocessor (Subprocessors and International Transfers, section 5.1(a); DPA, sections 8.9 and 16.3). Adding the key is the Business's instruction to send that provider the data described in section 5.
4.3 The Business is responsible for that provider's terms and usage policies, its data processing agreement, the international transfer that the choice of provider and region implies, its retention settings and its charges, which the provider bills to the Business directly (Terms of Service, section 12.7).
4.4 No training. SonhoLab does not use Agent Data to train, fine-tune or improve AI models. The Business must choose a plan, account setting or contract with its AI Provider that does not allow the provider to train on the data it sends.
4.5 The key. SonhoLab stores and uses the key as the DPA describes: only for the Business's own Agent, never for other customers or for SonhoLab's own purposes, and with the additional protections of the DPA, section 8.9(c), in the Systems that apply them (DPA, sections 8.9 and 16.3(e)). The Business can replace or remove its key at any time; when it removes the key, the Agent's AI functions stop. The Business must keep the key secret, set spending limits with its provider where possible and rotate the key at once if it suspects misuse.
5. Data sent to the AI Provider
5.1 What is sent. To answer, the System sends the Business's AI Provider the End User's message and the Business context that the Business's configuration sends, such as its services, prices, menu, opening hours, zones and the earlier messages of the same conversation that the Agent needs. If the Business turns on image reading or voice-note transcription, the image or the audio is sent too.
5.2 Minimization. The Business must configure its Agent so that it asks for and sends only what is needed to answer the End User. Where a System offers it, email addresses and phone numbers are replaced with placeholders before the message is sent to the AI Provider; the AI Transparency Notice and the DPA, Annex I, say in which Systems this applies.
5.3 Web search. Where an Agent searches the web, the search query goes to the web search subprocessor listed in Subprocessors and International Transfers. A query may contain words from the conversation. The Business must not instruct its Agent to search for information about End Users.
5.4 Where the data goes. Agent Data is hosted by SonhoLab as described in Subprocessors and International Transfers. The data sent to the Business's AI Provider is processed wherever that provider processes it, often outside the End User's country. The Business must have a valid basis for that transfer and tell End Users where the law requires it (section 12.2).
6. AI Notice and contact with a person
6.1 When. The Agent shows the AI Notice at the start of each conversation and again when a conversation resumes after a period of inactivity. Each System sets that period; on WhatsApp, the AI Notice goes in the Agent's first message.
6.2 What it says. The AI Notice says, in clear words and in the End User's language, that the End User is talking to an AI assistant of the Business, and it offers a way to contact a person at the Business, such as the Business's phone number or a request to be contacted. Annex A has an example.
6.3 It cannot be removed. The Business may adapt the wording, but it may not turn off, hide or shorten the AI Notice or the contact with a person, or make the Agent say or suggest that it is human. The Business can only turn off the whole Agent.
6.4 When asked. If an End User asks whether they are talking to a person, the Agent says that it is an AI.
6.5 Contact with a person. The Agent offers a way to contact a person at the Business; it does not promise that a person will take over the conversation. Where a System also lets the Agent pass a conversation to the Business's staff, the Business must keep that option available. The Business must name at least one person who handles those contacts and answer within a reasonable time.
6.6 Why. These rules follow the EU AI Act (Regulation (EU) 2024/1689), article 50, in force since 2 August 2026; the California law on bots (Business and Professions Code § 17941, known as SB 1001); the Utah Artificial Intelligence Policy Act (Utah Code § 13-2-12); the Brazilian Consumer Defense Code (CDC), articles 6, III and 36, on clear information and on advertising that can be identified as such; and Meta's policies.
6.7 Companion chatbots. Agents are designed for customer service, not as companions. The Business must not configure an Agent to hold ongoing social or emotional relationships with End Users. If it does, it is responsible for the laws on companion chatbots, such as California SB 243 (Business and Professions Code § 22601 and following).
7. WhatsApp and other messaging channels
7.1 Official channel by default. By default, Messaging on WhatsApp runs on the official WhatsApp Business Platform of Meta Platforms, with the Business's own Meta app, business account, phone number, message templates and access token. Meta is then the Business's own vendor, not a SonhoLab subprocessor (Subprocessors and International Transfers, section 5.1(f); DPA, section 8.9). Where SonhoLab holds or manages the account or the connection itself, Meta acts as a SonhoLab subprocessor, as listed in Subprocessors and International Transfers, section 3.
7.2 Meta's rules. The Business must comply with the WhatsApp Business Terms, the WhatsApp Business Messaging Policy and the WhatsApp Commerce Policy, as Meta updates them. The Business is responsible for:
- (a) collecting the End User's opt-in before sending any message the End User did not ask for, as Meta requires;
- (b) its message templates and their approval by Meta, and the messages it sends outside the customer service window that Meta allows;
- (c) its business account, its number, its quality rating and the fees that Meta charges to that account.
7.3 Automatic notices. Where a System offers automatic WhatsApp notices, such as order status updates, they are off by default. If the Business turns them on, they are sent with the Business's own templates approved by Meta, and section 8 applies.
7.4 Unofficial connection only at the Business's express request. SonhoLab connects a WhatsApp number through the unofficial linked-device connection only if the Business expressly asks for it and accepts the risk in the acceptance box of the Terms of Service, section 15.6. That section governs the connection, including the risk of restriction or ban of the number and the absence of any guarantee from Meta. Section 9 of this Addendum also applies to it.
7.5 Meta decides for itself. Meta may restrict, flag or ban a number or an account, limit messaging or change its prices at its own discretion. SonhoLab does not control those decisions. If it happens, SonhoLab tells the Business what it knows and helps it respond.
8. Consent, marketing and opt-out
8.1 Messages the End User did not ask for. The Agent answers the messages that End Users send. The Business must not use an Agent or Messaging to write to people who have not contacted it or given their opt-in, and must get consent before marketing messages where the law requires it.
8.2 United States. The Business must not send automated marketing messages to US phone numbers without the End User's prior express written consent under the Telephone Consumer Protection Act (TCPA) (47 CFR § 64.1200). The consent must be signed (an electronic signature is valid), must clearly authorize the Business to send marketing messages with automated technology to that number, and must say that consent is not a condition of purchase. We treat WhatsApp messages as covered by the TCPA. The Business must also:
- (a) comply with stricter state laws, such as the Florida Telephone Solicitation Act and the Oklahoma Telephone Solicitation Act;
- (b) send no marketing messages before 8:00 a.m. or after 9:00 p.m. in the End User's local time, or within narrower hours where state law requires (for example, 8:00 p.m. in Florida);
- (c) check the National Do Not Call Registry where the law requires;
- (d) honor revocations made by any reasonable means, promptly and within the period the law sets;
- (e) keep proof of consent and give it to SonhoLab on request.
8.3 Brazil. Marketing messages need a legal basis under the LGPD, usually consent, and must comply with the CDC: the Business must identify itself, and the message must be clearly identifiable as advertising. Collection messages must comply with CDC articles 42 and 71 and with the state rules on days and hours of collection contact; the Debt Collection Addendum (CobraDia) describes these rules, and the Business must follow them even when it uses another System.
8.4 EU and EEA. Electronic marketing needs the End User's prior consent under the ePrivacy Directive (Directive 2002/58/EC), article 13, except the limited "soft opt-in" for existing customers in article 13(2), and the processing needs a legal basis under the GDPR.
8.5 Other countries. The Business must follow the marketing, consent and consumer rules of each End User's country.
8.6 Opt-out. End Users can stop messages from the Business at any time, for example by replying STOP or an equivalent word in their language, or by saying so in their own words. After an opt-out, the Business must send no more messages that the End User did not ask for, keep a record of the opt-out so that later campaigns respect it, and include simple opt-out instructions in every marketing message. The Agent still answers if the End User writes again. Where a System offers opt-out handling, the Business must keep it on.
8.7 Email. If the Business uses a System to send marketing email, each email must comply with the CAN-SPAM Act (15 U.S.C. § 7704) where it applies and with the equivalent rules of the End User's country, including a working opt-out.
9. Health data and other sensitive data
9.1 General rule. The Business must not use an Agent or Messaging to ask for, collect or process health data or other special categories of personal data (such as genetic or biometric data, or data about racial or ethnic origin, religion, political opinions, trade union membership, sex life or sexual orientation), nor government identification documents, card numbers, passwords or security codes.
9.2 Never over WhatsApp. The Business must never use WhatsApp through a System, whether through the official WhatsApp Business Platform or through the connection in the Terms of Service, section 15.6, to ask for, send or process health data or other special categories of personal data. No System offers a way to enable that use today, so the conditions in the Terms of Service, section 12.5(d), are not available. Clínicas does not send or receive WhatsApp messages (Health Data Addendum (Clínicas), section 9).
9.3 Exceptions only in a product addendum. An AI function may process health data only where a product addendum expressly allows it and under its conditions, as the Health Data Addendum (Clínicas) does for the Clínicas assistant inside its own App, with the patient's consent.
9.4 Information an End User volunteers. If an End User volunteers sensitive information on any channel, the Agent must not ask for more. Where the information is needed for the request, such as a food allergy for an order, the Business uses it only to serve that request. For health questions, the Agent must refer the End User to the Business's staff or to a qualified professional.
9.5 Payments. An Agent may read payment receipts that End Users send. It must not ask for card numbers, passwords or security codes. Payments are made through the Business's own payment methods.
10. Minors
10.1 Not directed at minors. Agents and Messaging are not designed for, or directed at, people under 18. The Business must not direct an Agent at children or teenagers, and must not use Agent Data to profile minors or to target them with advertising.
10.2 The Business's responsibility. If the Business serves minors, it is responsible for complying with the laws that protect them, such as the US Children's Online Privacy Protection Act (COPPA) and, in Brazil, the Digital Statute of Children and Adolescents (ECA Digital, Lei 15.211/2025) and LGPD article 14, including any parental consent those laws require.
10.3 Verita. Verita, SonhoLab's System for schools, does not use Agents or Messaging.
11. Retention and deletion
11.1 Periods. Agent Data is kept for the periods in the Data Retention Schedule, section 3.16:
- (a) in Jesse, Digital Team OS and other Agents, conversations are kept for 12 months on a rolling basis, unless the Business sets a shorter period;
- (b) Restaurant System applies its own, shorter periods, set out in the Data Retention Schedule, section 3.16, and in the DPA, Annex I.
11.2 Shorter periods and deletion on request. The Business can ask for a shorter period and can ask SonhoLab to delete a specific conversation, for example to answer an End User's deletion request, or do so in its settings where the System offers it.
11.3 End of the contract. After a paid plan ends and is not replaced by the Free plan, or after the account is terminated, the Business can export its Customer Data for 30 days, and then SonhoLab deletes it from active systems (Terms of Service, sections 11.6 and 19.4). Deleted data rolls off backups as described in the Data Retention Schedule, section 5.
11.4 The Business's AI Provider. Retention of the data sent to the Business's AI Provider depends on the Business's contract and settings with that provider (section 4.3).
12. The Business's obligations
12.1 Legal basis. The Business must have a legal basis for each processing activity it asks the Agent to perform, under the law of each End User's country.
12.2 Notice to End Users. The Business must give End Users a privacy notice that says:
- (a) who the Business is and how to contact it;
- (b) that an AI assistant answers messages, that SonhoLab hosts it for the Business as its processor, and which AI provider the Business uses;
- (c) where the data is processed, including any international transfer to the AI provider;
- (d) how long the data is kept (section 11);
- (e) how End Users can exercise their rights.
Annex A is a template. It does not replace advice on local law.
12.3 Accurate instructions. The Business is responsible for the information and instructions it gives its Agent, such as prices, availability and policies, and for keeping them up to date.
12.4 Lawful content. The Business must not instruct its Agent to say anything false, misleading, discriminatory or unlawful.
12.5 Monitoring. The Business must review its Agent's conversations and lead notifications regularly and answer contact requests from End Users in a reasonable time.
12.6 Rights requests. End Users exercise their rights with the Business. If SonhoLab receives a request from an End User, it forwards it to the Business without undue delay and helps it answer, as the DPA provides.
12.7 Sector rules. The Business is responsible for the consumer, advertising, professional and sector rules that apply to its own activity.
13. Prohibited uses
The Business must not use an Agent or Messaging for:
13.1 spam, bulk unsolicited messages, or messages to purchased or scraped lists;
13.2 political campaigning, including messages for or against parties, candidates or ballot measures;
13.3 harassing debtors, including threats, shaming, contacting third parties about a debt, or messages at unreasonable hours;
13.4 medical diagnosis, prescriptions or treatment decisions, or legal, financial or tax advice presented as professional advice;
13.5 fraud, phishing, impersonation or collecting credentials;
13.6 illegal lending, gambling, or the sale of illegal or restricted goods;
13.7 discrimination against End Users;
13.8 decisions with legal or similarly significant effects on End Users without human review;
13.9 any use that the Acceptable Use Policy, section 10 of the AI Transparency Notice or Meta's policies prohibit.
14. Accuracy of Agent answers
14.1 Agents make mistakes. An Agent can misunderstand a message, misread a receipt, mistranscribe a voice note or give an outdated price, even when it sounds confident.
14.2 The Business answers for its Agent. The Agent speaks on behalf of the Business. The Business is responsible toward its End Users for what its Agent tells them, for honoring or correcting it as the law requires, and for checking payments before it delivers goods or services.
14.3 THE AGENT IS A TOOL. SONHOLAB DOES NOT PROMISE THAT AGENT ANSWERS, TRANSCRIPTIONS OR RECEIPT READINGS ARE ACCURATE OR COMPLETE. DO NOT RELY ON THE AGENT ALONE TO CONFIRM A PAYMENT.
14.4 Availability. An Agent depends on the messaging channel and on the Business's AI Provider. If the Business's key is invalid, out of credit or limited, the Agent's AI functions stop until the Business fixes it. Meta or a provider may change, limit or stop their services. SonhoLab does not promise uninterrupted service.
15. Security, incidents and impact assessments
15.1 Security. SonhoLab applies the measures in Security and Incident Response and in the DPA, Annex II, to Agent Data it hosts.
15.2 Breach notice. SonhoLab notifies the Business of a personal data breach affecting Agent Data under the DPA. The Business handles the notices to authorities and End Users that the law requires of it, and SonhoLab helps.
15.3 Impact assessment. Large-scale conversations with customers through AI may require a data protection impact assessment (for example, LGPD article 38 or GDPR article 35). On request, SonhoLab gives the Business the information it needs about processing, data flows, subprocessors and security.
16. SonhoLab commitments and suspension
16.1 Commitments. SonhoLab processes Agent Data only to provide the Agent and Messaging to the Business. It does not sell Agent Data, does not use it for its own purposes or its own marketing, does not share it for cross-context behavioral advertising and does not train AI models on it.
16.2 Suspension. SonhoLab may suspend an Agent, or disconnect a number from its service, without prior notice when that is needed to stop spam, messages without the required consent or any use prohibited in section 13; to comply with Meta's requirements or protect the Business's number from a ban; to comply with the law or an order of a competent authority; or to protect End Users or others from harm. SonhoLab tells the Business the reason promptly, unless the law or security prevents it, and restores the service when the cause is fixed. For other breaches, SonhoLab first gives notice and a reasonable time to fix them. Anyone can report misuse to contacto@sonholab.com with the subject "Abuse report".
17. Responsibility and liability
17.1 The Business's responsibility. The Business is responsible for its legal bases, notices and consents, for the information and instructions it gives its Agent, for what its Agent tells End Users, for the messages it sends and for its compliance with Meta's policies and with the marketing, consumer and sector laws that apply to it.
17.2 Indemnity. The Business indemnifies SonhoLab under the Terms of Service, section 22, for claims, fines and penalties arising from a breach of this Addendum, including claims under the TCPA for messages sent without the required consent.
17.3 LIMITATION. TO THE MAXIMUM EXTENT PERMITTED BY THE LAW THAT APPLIES, SONHOLAB IS NOT LIABLE FOR WHAT AN AGENT TELLS END USERS ON THE BUSINESS'S BEHALF, FOR THE INFORMATION AND INSTRUCTIONS THE BUSINESS GIVES ITS AGENT, FOR MESSAGES SENT ON THE BUSINESS'S INSTRUCTIONS, FOR THE ACTS OR OMISSIONS OF THE BUSINESS'S AI PROVIDER OR OF OTHER SERVICES THE BUSINESS CONNECTS, OR FOR DECISIONS OF META ABOUT THE BUSINESS'S ACCOUNT OR NUMBER, EXCEPT TO THE EXTENT THE LOSS IS CAUSED BY SONHOLAB'S OWN BREACH OF THE TERMS OF SERVICE, THE DPA OR THE LAW. IN ALL OTHER CASES, THE LIMITS IN THE TERMS OF SERVICE, SECTION 21, APPLY.
17.4 End Users. No limitation in this Addendum reduces the rights of End Users under data protection or consumer protection law.
Nothing in this Addendum excludes or limits rights that cannot be excluded or limited under the law that applies to you.
Annex A. End User notice template
The Business adapts this text to its country and language. It does not replace legal advice.
AI Notice (first message of each conversation)
How [Business name] uses your messages
- Who we are: [Business name], [tax ID], [address], [contact].
- Who answers: an AI assistant answers our messages. SonhoLab hosts it for us, as our processor. To answer you, your messages are sent to our AI provider, [provider], which may process them in [country or region].
- What we record: your name, phone number, messages and [appointments, orders or receipts], to answer you and [purpose]. Legal basis: [basis].
- How long: we keep conversations for [period].
- Messages you did not ask for: we send them only with your consent. Reply STOP at any time to stop them.
- Your rights: you can ask us to access, correct or delete your information. Contact: [contact].
Version 0.9.6 (preliminary) · Effective 25 October 2026 · © L. M. PEREZ MONTANA (SonhoLab), CNPJ 61.620.014/0001-00. This version is under legal review; we will notify material changes as described in these documents.