This document is not yet in force and binds no one. The passages highlighted in yellow are gaps the company still has to fill, and the legal characterisation depends on professional review. We publish the draft so that what the system does is known while the final text is being prepared.
Privacy Policy
This policy describes what Appilots does with personal data. It was written from how the system actually works (what the database stores, where content goes, and how long it stays), not from a generic template.
1. Who we are and in what role
Appilots is operated by «legal entity name», company number «no.», with its registered office at «address».
This policy covers two distinct kinds of processing, and the distinction matters because the rights and duties change:
| Situation | Our role | Example |
|---|---|---|
| You subscribe to Appilots and use the dashboard | Controller | your name, email, billing details |
| Your company embeds the Appilots SDK in its own app | Processor | messages an end user types into your customer’s app |
In the second case the controller is the customer company, not Appilots. We process that data under their instruction and never for our own purposes. If you are an end user of an app that uses Appilots and want to exercise rights over your data, address the request to the company that owns that app; we act on their request.
2. Data we process as controller
This is the data of whoever subscribes to and administers Appilots.
Account and sign-in
Name, email, password (stored only as a hash, never in plain text), and, if you enable it, your authenticator secret (TOTP) and recovery codes, both encrypted at rest. We also record sign-in times and the IP of authentication attempts, to limit brute-force attacks.
Workspace and usage
The name and identifier of your workspace and projects, member roles, API keys you generate (stored as hashes), and an audit record of administrative changes: who created, changed or removed what, and when.
Billing
Your plan, usage counters and your Stripe customer identifier. We do not store card numbers; payment details are processed and held by Stripe.
Purposes and legal bases
| Purpose | Legal basis (LGPD) |
|---|---|
| Providing the contracted service | performance of a contract (art. 7, V) |
| Billing and invoicing | performance of a contract / legal obligation |
| Security, fraud prevention and abuse limiting | legitimate interest (art. 7, IX) |
| Operational communications about the service | performance of a contract |
| Meeting tax and accounting obligations | legal obligation (art. 7, II) |
3. Data we process as processor
When a customer company installs the SDK, the following passes through us:
Conversation content
The messages an end user writes to the agent, and what the agent replies. They are necessary for the product to work; without them there is no agent.
Screen context
Which screen of the app was open, which elements it contains, and which actions the agent performed. This is what lets the agent act inside the app.
Identifiers the customer chooses to send
If the customer company uses the user-identification feature, it may send us its own identifier along with a free-form set of contact details, typically email, phone or a national ID number. What gets sent is the customer company’s choice, not ours. That data is used solely so their operators can find the person in the dashboard: it is never included in the context sent to the AI model, nor in the agent’s history.
Execution telemetry
Records of each agent step: what was decided, what worked, what failed, what it cost. Here we keep a truncated excerpt of the message text (roughly the first 160 characters), used to group the most common requests in reports. The full message is not stored in that table.
4. Sending data to AI providers
This is the most important section and we ask that it be read.
For the agent to work, conversation content and screen context are sent to a language-model provider. Today we support OpenAI, Anthropic and compatible providers configured by the customer. There are two modes, and they change who is responsible:
- Customer’s own key (BYOK). The customer company configures its own key. The transfer happens under their contract with that provider, and that provider’s terms apply directly.
- Managed mode (AI included). Appilots uses its own key, with the cost included in the plan. In this case the transfer happens under our contract with the provider.
In both cases: content leaves Appilots infrastructure, to the chosen provider’s servers, typically in the United States. Besides the model, in either mode, the user’s message and a summarized screen state are sent to TypeSafe AI, under our contract, to choose the assistant’s next action (section 5). The customer company must reflect this in its own privacy policy and obtain the appropriate legal basis from its users.
«Confirm with each provider, by contract, whether content is used for training, and state it here. For commercial use, OpenAI and Anthropic state that they do not train on API data, but this must be verified against the contract in force and not assumed.»
5. Subprocessors
| Company | What for | Where |
|---|---|---|
| Amazon Web Services | hosting, database, logs | USA (us-east-1) |
| OpenAI / Anthropic | model processing of messages | USA |
| TypeSafe AI | chooses the assistant’s next action from the user’s message and the screen state; does not generate text | «USA: region to be confirmed» |
| Stripe | payments and invoicing | USA / global |
| SendGrid (Twilio) | transactional email | USA |
| Sentry | application error reporting | USA |
| «PostHog» | dashboard usage analytics | «USA: region to be confirmed» |
Changes to this list will be announced «notice period» in advance.
6. International transfer
All infrastructure runs in the United States (AWS region us-east-1), as do the subprocessors above. Because the controller is Brazilian, this constitutes an international transfer of data under art. 33 of the LGPD.
«Decide and state the transfer basis used: ANPD standard contractual clauses, or another art. 33 ground. This gap is legal, not technical, and must be closed before publication.»
7. How long we keep it
| Data | Retention |
|---|---|
| Detailed agent execution telemetry | 90 days |
| Aggregated metrics (no message content) | 365 days |
| Conversations and agent history | while the account is active |
| Account, workspace and projects | while the account is active |
| Administrative audit record | «to be defined: there is no automatic purge today» |
| Tax and billing records | «applicable legal period, typically 5 years» |
Once an account is closed, data is deleted within «period», except what the law requires us to keep.
«Note: audit-record retention is still open in the product and must be decided before publication. Keeping a record of who accessed what indefinitely carries its own privacy weight and conflicts with deletion requests.»
8. Your rights
The LGPD grants confirmation of processing, access, correction, anonymisation or deletion, portability, information about sharing, and withdrawal of consent.
To exercise them, write to «data protection officer email». We reply within «period».
If you are an end user of a third-party app that uses Appilots, address the request to that company; we are a processor and act under their instruction.
«Engineering gap: the account export and deletion endpoints do not exist yet. Until they do, requests are handled manually, and the period promised here has to be compatible with that.»
9. Security
Encrypted in transit (TLS) and encrypted at rest. Passwords stored only as hashes. AI provider keys encrypted with a dedicated key. Database with no public access, on a private network. Two-factor authentication available, and login attempt limiting. Administrative access is logged.
No system is immune. In the event of an incident posing relevant risk to data subjects, we will notify those affected and the ANPD as required by art. 48 of the LGPD.
10. Cookies and browser storage
The dashboard uses no tracking cookies. What exists today is browser local storage, split into two categories that are treated differently.
Essential: runs without consent, because without it there is no product
| Key | What for |
|---|---|
accessToken, refreshToken, tokenExpiresAt | keeping you signed in across reloads |
activeWorkspaceId | remembering which workspace you were using |
appilots_locale | remembering the language you chose |
appilots_consent | recording your own consent choice |
These keys are strictly necessary to operate the service you subscribed to (art. 7, V of the LGPD) and cannot be disabled without preventing sign-in. None of them is shared with third parties.
Usage analytics: only with your explicit consent
Product analytics is off by default. Nothing analytics-related is loaded, and no analytics identifier is created, until you accept in the banner. Declining is as easy as accepting, and the choice can be reversed at any time under Account → Privacy, with equal weight in both directions. All we keep is your choice and the date you made it, including when the choice is “no”, because a refusal has to be demonstrable too. Withdrawing consent stops any further loading immediately and does not make the banner ask again.
Error monitoring
We use Sentry to record application failures. It is configured with no IP collection, no cookies and no request bodies, captures errors only (not navigation) and passes through a redaction layer before sending. We treat this as a legitimate interest in keeping the service working (art. 7, IX), not as usage analytics.
Public website (appilots.com): Google Ads tag
The public pages on appilots.com, this one included, load the Google Ads tag (gtag.js, account AW-18423684148). It is there to measure whether a visit came from one of our ads and whether it led to a conversion action (a sign-up, for example), and to show our ads to people who have already visited the site (remarketing). To do that, Google sets its own cookies in your browser (such as _gcl_au) and receives your IP address, browser identifiers and the URL of the page visited, under the Google privacy policy. This applies to the public website only: the dashboard still has no tracking cookies, as described above.
You can turn off Google ad personalisation at adssettings.google.com and block the tag through your browser settings or a blocking extension. The site works normally without it.
«Confirm with legal counsel the lawful basis for the tag on the public website (prior consent via a banner, or legitimate interest with opt-out) and, if it is consent, make loading conditional on acceptance, as the dashboard already does.»
«When PostHog is actually switched on: describe here exactly what is collected, confirm that session recording is off or masked, and state the hosting region.»
11. Administrative access by the Appilots team
Our team may access your account data only to: provide support you requested, investigate a security incident or outage, comply with a legal obligation, or resolve a billing dispute.
Such access is logged in an auditable way and attributable to a person. We do not access end-user conversation content for commercial purposes, and we do not use your data to train models of our own.
«Pending decision: will the customer be notified when there is administrative access to their workspace? If the answer is no, record it as a deliberate and justified decision, not as an omission.»
12. Changes and contact
Material changes will be announced by email «notice period» in advance.
Data protection officer (DPO): «name», «email». General contact: «email».
Companion document: Terms of Service