Privacy Policy

Last updated: «publication date» · In force from: «date»
Originally written in Portuguese. The Portuguese version is the one that prevails; translations are provided for convenience.

This policy describes what Appilots does with personal data. It was written from how the system actually works (what the database stores, where content goes, and how long it stays), not from a generic template.

1. Who we are and in what role

Appilots is operated by «legal entity name», company number «no.», with its registered office at «address».

This policy covers two distinct kinds of processing, and the distinction matters because the rights and duties change:

In the second case the controller is the customer company, not Appilots. We process that data under their instruction and never for our own purposes. If you are an end user of an app that uses Appilots and want to exercise rights over your data, address the request to the company that owns that app; we act on their request.

2. Data we process as controller

This is the data of whoever subscribes to and administers Appilots.

Account and sign-in

Name, email, password (stored only as a hash, never in plain text), and, if you enable it, your authenticator secret (TOTP) and recovery codes, both encrypted at rest. We also record sign-in times and the IP of authentication attempts, to limit brute-force attacks.

Workspace and usage

The name and identifier of your workspace and projects, member roles, API keys you generate (stored as hashes), and an audit record of administrative changes: who created, changed or removed what, and when.

Billing

Your plan, usage counters and your Stripe customer identifier. We do not store card numbers; payment details are processed and held by Stripe.

Purposes and legal bases

3. Data we process as processor

When a customer company installs the SDK, the following passes through us:

Conversation content

The messages an end user writes to the agent, and what the agent replies. They are necessary for the product to work; without them there is no agent.

Screen context

Which screen of the app was open, which elements it contains, and which actions the agent performed. This is what lets the agent act inside the app.

Identifiers the customer chooses to send

If the customer company uses the user-identification feature, it may send us its own identifier along with a free-form set of contact details, typically email, phone or a national ID number. What gets sent is the customer company’s choice, not ours. That data is used solely so their operators can find the person in the dashboard: it is never included in the context sent to the AI model, nor in the agent’s history.

Execution telemetry

Records of each agent step: what was decided, what worked, what failed, what it cost. Here we keep a truncated excerpt of the message text (roughly the first 160 characters), used to group the most common requests in reports. The full message is not stored in that table.

4. Sending data to AI providers

This is the most important section and we ask that it be read.

For the agent to work, conversation content and screen context are sent to a language-model provider. Today we support OpenAI, Anthropic and compatible providers configured by the customer. There are two modes, and they change who is responsible:

• Customer’s own key (BYOK). The customer company configures its own key. The transfer happens under their contract with that provider, and that provider’s terms apply directly.
• Managed mode. Appilots uses its own key and passes the cost through. In this case the transfer happens under our contract with the provider.

In both cases: content leaves Appilots infrastructure, to the chosen provider’s servers, typically in the United States. The customer company must reflect this in its own privacy policy and obtain the appropriate legal basis from its users.

5. Subprocessors

Changes to this list will be announced «notice period» in advance.

6. International transfer

All infrastructure runs in the United States (AWS region us-east-1), as do the subprocessors above. Because the controller is Brazilian, this constitutes an international transfer of data under art. 33 of the LGPD.

7. How long we keep it

Once an account is closed, data is deleted within «period», except what the law requires us to keep.

8. Your rights

The LGPD grants confirmation of processing, access, correction, anonymisation or deletion, portability, information about sharing, and withdrawal of consent.

To exercise them, write to «data protection officer email». We reply within «period».

If you are an end user of a third-party app that uses Appilots, address the request to that company; we are a processor and act under their instruction.

9. Security

Encrypted in transit (TLS) and encrypted at rest. Passwords stored only as hashes. AI provider keys encrypted with a dedicated key. Database with no public access, on a private network. Two-factor authentication available, and login attempt limiting. Administrative access is logged.

No system is immune. In the event of an incident posing relevant risk to data subjects, we will notify those affected and the ANPD as required by art. 48 of the LGPD.

10. Cookies and browser storage

The dashboard uses no tracking cookies. What exists today is browser local storage, split into two categories that are treated differently.

Essential: runs without consent, because without it there is no product

These keys are strictly necessary to operate the service you subscribed to (art. 7, V of the LGPD) and cannot be disabled without preventing sign-in. None of them is shared with third parties.

Usage analytics: only with your explicit consent

Product analytics is off by default. Nothing analytics-related is loaded, and no analytics identifier is created, until you accept in the banner. Declining is as easy as accepting, and the choice can be reversed at any time under Account → Privacy, with equal weight in both directions. All we keep is your choice and the date you made it, including when the choice is “no”, because a refusal has to be demonstrable too. Withdrawing consent stops any further loading immediately and does not make the banner ask again.

Error monitoring

We use Sentry to record application failures. It is configured with no IP collection, no cookies and no request bodies, captures errors only (not navigation) and passes through a redaction layer before sending. We treat this as a legitimate interest in keeping the service working (art. 7, IX), not as usage analytics.

Public website (appilots.com): Google Ads tag

The public pages on appilots.com, this one included, load the Google Ads tag (gtag.js, account AW-18423684148). It is there to measure whether a visit came from one of our ads and whether it led to a conversion action (a sign-up, for example), and to show our ads to people who have already visited the site (remarketing). To do that, Google sets its own cookies in your browser (such as _gcl_au) and receives your IP address, browser identifiers and the URL of the page visited, under the Google privacy policy. This applies to the public website only: the dashboard still has no tracking cookies, as described above.

You can turn off Google ad personalisation at adssettings.google.com and block the tag through your browser settings or a blocking extension. The site works normally without it.

11. Administrative access by the Appilots team

Our team may access your account data only to: provide support you requested, investigate a security incident or outage, comply with a legal obligation, or resolve a billing dispute.

Such access is logged in an auditable way and attributable to a person. We do not access end-user conversation content for commercial purposes, and we do not use your data to train models of our own.

12. Changes and contact

Material changes will be announced by email «notice period» in advance.

Data protection officer (DPO): «name», «email». General contact: «email».