Privacy policy

In a few lines, here is what this policy says:

• BotHub is operated by SYSMJM TECNOLOGIA LTDA, which is responsible for your account data.
• To create an account, we ask only for your name, email address and password, or we use your Google sign-in. Your name and email address are needed to create and use the account: without them, we cannot provide the service. We do not ask for your CPF (Brazilian individual taxpayer number), CNPJ (Brazilian company registration number), phone number or address.
• The data you put into automations, such as spreadsheets, credentials kept in the vault and data about customers, suppliers or employees, belongs to your company. We use it only to run the tasks you set up, provide support, protect the service and comply with the law.
• To operate, we rely on providers such as Stripe (payments), Google (sign-in), Cloudflare (protection of the website, the dashboard and the API) and artificial intelligence services used by some BotHub Cloud automations and by BotHub Cowork while you build an automation. Several of them are outside Brazil.
• With BotHub Cowork, the Windows software, your automations, history, vault and settings stay on your computer, encrypted. When it runs, the task data does not go through our servers.
• When you connect your Google account to BotHub Cowork, it accesses only the spreadsheets and files you choose, straight from your computer. The details are in Google data.
• When you connect an Instagram account or a Facebook Page to BotHub Cowork, it publishes only what your automations put together. The access key stays on your computer. The details are in Meta data.
• If you request approvals through WhatsApp or Telegram in BotHub Cowork, we keep your number or chat and, for a few days, the content of each request. The details are in Approvals through WhatsApp and Telegram.
• The website chat uses OpenAI to generate its replies.
• We do not sell personal data, and we do not use advertising or audience analytics tools.
• Passwords and keys kept in the vault are encrypted (coded, unreadable without the key). No system is infallible, so here we explain what we actually do, including the limits.
• Each type of data has a retention period, explained in How long we keep data. Some of them do not have automatic deletion yet, and some records, such as billing records, are kept even after the account is deleted, because the law requires it.
• You can ask to access, correct, get a copy of or delete your data by writing to [email protected]. We reply within 15 days.

The full text follows. If anything is unclear, write to [email protected].

This policy explains how BotHub processes personal data under the LGPD (Lei Geral de Proteção de Dados Pessoais, Brazil's General Data Protection Law, Law No. 13,709/2018) and the Marco Civil da Internet (Brazil's Internet Civil Rights Framework, Law No. 12,965/2014).

BotHub is an automation platform: robots that carry out routines on websites and systems on the customer's behalf. The service is provided by SYSMJM TECNOLOGIA LTDA, a Brazilian company registered under CNPJ 56.989.396/0001-04.

Questions and requests about personal data go to the privacy channel: [email protected]. This is the channel we use to communicate with data subjects (the people the data is about) and with the ANPD (Agência Nacional de Proteção de Dados, Brazil's National Data Protection Agency).

This English version is provided for convenience. If it differs from the Portuguese version, the Portuguese version prevails.

Read the Terms of use

The LGPD distinguishes between whoever decides about the data (the controller) and whoever processes data on behalf of another company, following its instructions (the processor). BotHub plays both roles, depending on the data:

• Controller: for the data of your account, billing, acceptance of the terms, technical and security logs, support and partner applications. For this data, we decide how it is used and we are accountable for it.
• Processor: for the data you put into automations, such as task inputs, spreadsheets, vault values, verification codes, results and run history. For this data, your company is the controller, and we process it only to carry out what you set up.

When you create and use your account, we process:

• through the sign-up form: your name, email address and password. The password is stored as a hash, a transformation that does not allow the original text to be recovered;
• through Google sign-in: your first and last name, email address, your Google account identifier, the web address of your profile picture and the fact that Google has verified your email address. Through this sign-in, we have no access to your Gmail, your Drive or other data in your Google account. The access you give BotHub Cowork, on your computer, is explained in Google data;
• the confirmation of your email address, with the date it happened;
• the record of your acceptance at sign-up: the version of the documents accepted, the date, the time and the IP address (the number that identifies an internet connection) from which you accepted;
• your account profile, how you signed up (form or Google) and, if you arrived through an automation in the website's catalog, which one;
• the API tokens (access keys) you create. The API is the interface that connects other systems to BotHub;
• service usage data: how many runs you have made and how many of them were counted runs, your free trial balance and your use of resources billed separately, such as artificial intelligence and captcha solving.

Your name and email address are needed to create and use the account. We do not ask for your CPF, CNPJ, phone number, address or date of birth to create an account.

You can correct your name, email address and password in your profile, in the dashboard.

Payments are processed by Stripe. When your account is created, even if you only use the free trial, Stripe receives your name and email address to open the customer record used for billing.

Card details are entered directly on Stripe's payment page and do not pass through our servers. We do not store your card number.

We receive from Stripe what we need to manage your subscription, such as the status of payments and invoices, and we keep the notifications it sends us about these events. We send Stripe each month's usage (counted runs, extra features and the plan minimum), so the charge can be calculated.

At present, a change of name or email address in your profile does not reach Stripe on its own. If you change them, let us know through [email protected] and we will update your Stripe customer record too, so invoices and payment notices go to the right address.

To run automations, we process what you send or set up, through the dashboard or the API:

• the input data of each task and the automations you create or configure;
• the spreadsheets you upload to run an automation in bulk, and your schedules, with the data of each one;
• the passwords, keys, digital certificates and other credentials you keep in the vault, so the robot can sign in to websites and systems on your behalf;
• verification codes, such as those received by text message or generated by an authenticator app, that you enter to unblock a task;
• the result of each run, which may include data and files obtained from the websites accessed, and the history of its steps, with error messages;
• the addresses you provide to receive results in another system (webhooks), with the headers you configure (technical information sent along with the result, such as an access key for your system), and a record of each delivery attempt and of the response received;
• a record of when your own robot is connected, if you use a robot installed on your computer.

This data is used only to run the routines you set up, show the results, deliver them to the addresses you provide, investigate errors, provide support, protect the service and comply with the law.

Knowing the path your data takes helps you understand the safeguards and the risks. In a typical task:

• the input data is stored encrypted in the main tasks table of our database and goes in readable form through a processing queue to a robot;
• the robot runs on dedicated computers operated by BotHub, located in Brazil, which open the websites in a browser. To fill in the websites, it needs the data in readable form. Vault values are decrypted only at that point, in the step that uses each value;
• the robot's browser keeps cookies and sessions from the websites it visits between one run and the next, like an ordinary browser;
• files downloaded during the task stay on the robot's computer only until the end of the run or the start of the next one. The log of what the robot received, did and returned, including the task's input data, is kept on that computer, to investigate errors;
• when the task uses a digital certificate, the robot installs it on the computer so the browser can use it, and at present it remains installed there after the task;
• when the automation saves a file in the result (for example, a PDF or a spreadsheet downloaded from a portal), the file goes to a file storage service and is delivered through a link. This link does not require signing in and does not expire, so treat it as confidential and share it only with people who need it;
• some automations use artificial intelligence, captcha or network (proxy) services, described further below;
• finally, the result returns to our database and is sent to the addresses you provided.

If you use your own robot, installed on your computer, your task data passes through that computer, and the security of that computer and your network is your responsibility.

BotHub Cowork is Windows software. You build automations with the AI, the visual editor or the recorder, and they run on your computer.

• Stays on your computer, with Windows encryption: your automations, run history, vault, email account passwords, printer profiles, Google access and the browser profile Cowork uses. We have no access to this data.
• Goes to BotHub: your sign-in (email or Google), your plan and subscription, the count and result of each run, without the task data, the software version for automatic updates, your AI credit and, if you use backup, the copy of your automations, without the vault values.
• Artificial intelligence: while you build or adjust an automation with the AI, the structure of the page open in the Cowork browser and, when needed, screen captures go, through our servers, to the AI provider (OpenAI), only to build the automation. Vault passwords and protected fields are removed first. Running a ready automation does not use AI.
• Email: Cowork connects directly to the email servers you set up, to read and send messages, without going through our servers.
• Requests from other AIs: when an external AI, such as Claude or Gemini, asks to run an automation in Cowork, the request shows up on your screen and only runs with your approval. What you share with that AI follows the policy of the company that offers it.
• Running on the cloud: if you ask for an automation to run on the BotHub cloud and the request is approved, that automation's data follows the BotHub Cloud rules described in this policy.

This section covers Google sign-in, on the website, the dashboard and BotHub Cowork, and BotHub Cowork's access to Google Sheets and Google Drive, which only happens if you connect your account and authorize it.

• What data we access: with Google sign-in, your name, email address, account identifier and profile picture. In BotHub Cowork, the Google Sheets spreadsheets and Google Drive files you choose for your automations, to read and write.
• How we use it: only for the features you ask for, such as signing in, starting an automation when a new row shows up in a spreadsheet and reading or writing the spreadsheet or file during the automation.
• Who we share it with: in BotHub Cowork, data obtained through the Google APIs goes straight from Google to your computer. It does not go through BotHub's servers and is not sent to the AI provider. We do not sell Google data, we do not use it for advertising and we do not pass it on to third parties.
• How we protect it: the Google access is stored on your computer with Windows encryption, and the connection to Google is always encrypted.
• How long we keep it and how to delete it: the Google access stays on your computer until you disconnect the account in BotHub Cowork or revoke access at myaccount.google.com/permissions. The data in your spreadsheets and files is not stored on BotHub's servers. For Google sign-in data, you exercise your rights as explained in Your rights and how to ask.
• Data obtained through the Google Workspace APIs is not used to develop, improve or train generalized (non-personalized) artificial intelligence or machine learning models.

The use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Google API Services User Data Policy

This section covers connecting an Instagram professional account or a Facebook Page to BotHub Cowork, so your automations can publish to it. The connection only happens if you go through Meta's screen, choose the account or Page and authorize it.

• What data we access: the Instagram account's identifier and username, or the Facebook Page's identifier and name, and the access key (token) Meta issues for publishing. We do not read messages, comments, followers or ad data.
• How we use it: only to publish the post (image and text) your automation put together, to the account or Page you chose, when the automation runs.
• Where it goes: Meta returns the authorization to our servers, which exchange it for the access key (this requires the app secret, which only the server has) and hand it over once to your computer, within 5 minutes. After that, the key is not kept on our servers. Technical logs keep only the permissions granted and the identifiers of the accounts or Pages found, never the key.
• Instagram image: the Instagram API only accepts an image at a public address. So the post image is stored on our servers, at a temporary address, only while Instagram fetches it. It is deleted right after publishing and, if something fails, within 2 hours. On Facebook, the image goes straight from your computer to Meta.
• How we protect it: the access key stays in your computer's vault, with Windows encryption, and is not sent to the AI provider. The connection to Meta is always encrypted.
• We do not sell this data, use it for advertising, pass it on to third parties or use it to train artificial intelligence models.
• How to delete it: click Disconnect under My account › Settings › Social networks in BotHub Cowork to delete the key from your computer, or remove BotHub under Meta Business Suite › Settings › Integrations › Connected apps to cancel the access. If you request deletion through Meta, Meta notifies us and we reply with a confirmation code. Since we do not keep Meta data on our servers, there is nothing else to delete besides the technical logs, which follow the periods in How long we keep data.

The use of this data also follows the Meta Platform Terms.

Meta Platform Terms

This section covers BotHub Cowork automations that ask for an approval before going on, such as approving a post before it is published. The request reaches you on WhatsApp or Telegram, sent by BotHub's number or bot, and you answer by tapping a button or writing.

• How it starts: you register your WhatsApp number and confirm it with a code we send to it, or you connect your Telegram by tapping Start in the chat with BotHub's bot. This registration and confirmation are your consent to receive the messages. We only send messages tied to your automations: requests, reminders and deadline notices.
• What data we keep: the WhatsApp number or the Telegram chat identifier and the name it shows; for each request, the client name your automation provided, the title, the text, the image, the buttons, your answer and the dates it was sent and answered.
• What stays on your computer: the data the automation needs to go on after your answer, such as the caption and the image file, is stored on your computer, encrypted. Only what appears in the message goes to our server.
• How we use it: only to send the request, the reminders and the discard notice, receive your answer and hand it back to your BotHub Cowork. Messages are not sent at night: they wait until the next morning.
• How long: each request stays open for 24 hours. Once it is answered, replaced by a new version or discarded, the text, the image and your answer are deleted from our servers within 7 days (within 30 days if the answer has not reached your computer). The number or chat is kept until you remove it.
• Who else receives it: messages go through Meta (WhatsApp Business Platform) or Telegram, which deliver them to you. These services handle messages under their own policies and may be outside Brazil.
• How to delete it: remove the number or disconnect the chat in My account › Settings, in BotHub Cowork. Open requests are no longer sent and request content follows the period above.

To protect your account and the service, we log security events with the IP address, date, time and what happened, such as a failed sign-in attempt, a rejected sign-up or a blocked request. When the attempt uses an email address that has no account, the log keeps that email address.

We also use the IP address to limit the number of sign-in and sign-up attempts. Each count lasts from a few minutes to one day.

The free trial is available once per email address. For this, we keep a standardized form of the email address used for the trial (in lowercase, without the part after a plus sign and, for Gmail, without the dots), which recognizes variations of the same address.

Technical system errors are also logged and may include the IP address and the error messages from tasks.

We use your account email address for messages about the service: email confirmation, a welcome message with links to the documents you accepted, usage notices for the free trial, declined payments and automations that ended with an error. These messages are part of the service and do not depend on consent. You can turn the notice about automations that ended with an error on or off under My account, in your dashboard.

We record which notices have already been sent to each account, without their content, so we do not repeat the same message.

When you write to [email protected] or [email protected], we keep your message, your email address and whatever is needed to reply and keep a record of the support conversation.

We do not currently send marketing emails. If we start, it will be only with your consent and with an easy way to unsubscribe.

If you apply to the partner program on the website, we keep what you fill in on the form (name, company, email address, phone number, type of partnership, website and message), the language of the page, the date you ticked the confirmation box, your IP address and the browser you used.

We use this data to review your application, reply to you and, if the partnership goes ahead, stay in touch.

The website has a support chat in which an artificial intelligence answers your questions based on the content of the website and the BotHub documentation. If it cannot answer, or if you would rather talk to a person, you can leave your contact details in a form, and our team will reply.

The messages you write are sent to OpenAI (United States), which provides the artificial intelligence model, only to generate the replies. Before they are sent, passages that look like a password, a card number or a CPF are hidden. OpenAI also receives a code generated from your IP address, which does not reveal the IP address, only to identify abuse.

We keep in our database the messages of the conversation (with those passages hidden), the browser you used and that same code, to reply, continue helping you and prevent abuse.

If you use the contact form, we keep your name, the email address or WhatsApp number you provide, your question, the reason for the contact, the page and language you were on, the date you ticked the agreement box, your browser and the same code. Your question and the conversation with the assistant are sent by email to our team.

In your browser, the conversation is kept for up to 24 hours so you can pick up where you left off, as explained in the Cookies section.

Do not write passwords, verification codes, card details or other people's personal data in the chat. The chat does not need them to help, and automation credentials have their own place: the vault in the dashboard.

Artificial intelligence replies may contain mistakes. For important decisions, confirm with our team at [email protected].

The LGPD only allows personal data to be processed on a legal basis, that is, a reason provided for in the law (art. 7). These are our uses and the basis for each one:

• Creating and maintaining your account, giving you access to the dashboard, running automations, delivering results, billing, sending service emails and providing support. Legal basis: performance of the contract with you (art. 7, V).
• Reviewing partner applications and replying. Legal basis: conversations before entering into a contract, held at your request (preliminary steps, art. 7, V).
• Answering your questions in the support chat and the contact request you leave there. Legal basis: performance of the contract, or conversations before entering into a contract, held at your request (art. 7, V).
• Keeping BotHub's billing and accounting records and responding to requests from authorities as provided by law. Legal basis: compliance with a legal obligation (art. 7, II).
• Keeping proof of acceptance of the terms and using service records to defend rights, including in legal proceedings. Legal basis: regular exercise of rights (art. 7, VI), that is, keeping evidence for use in a possible dispute.
• Protecting your account and the service against fraud, abuse and attacks, with security logs, limits on attempts and the control of one free trial per email address. Legal basis: legitimate interest (art. 7, IX), that is, an interest of ours that the law accepts when it respects your rights. We use only what this protection requires, which also benefits you, and you can object through the privacy channel.

For your task data, the legal basis is defined by your company, as the controller. We follow its instructions, given through the configuration of the automations and the Terms of use.

At present, none of the uses described here depends on your consent. If any of them comes to depend on it, we will ask first, separately, and you can withdraw consent whenever you want. Reading this policy is not giving consent: it only explains how we process data.

To be clear:

• We do not sell or rent personal data.
• We do not use advertising tools, ad pixels or audience analytics tools on the website or in the dashboard.
• We do not use your task data for our own purposes, such as advertising, behavioral profiling or sale to third parties.
• We do not ask for sensitive data, such as health data, biometrics, religion or racial origin, for our own use.
• On our servers, we do not access your email, your cloud files or any other data in your Google account beyond what is listed in this policy. BotHub Cowork accesses, on your computer, only the Google spreadsheets and files you choose.

Tasks often carry other people's data, such as the name, email address, phone number, CPF or address of your company's customers, suppliers or employees, in an order, a spreadsheet, a registration record or a document downloaded from a portal.

For this data, your company is the controller and BotHub is the processor. Your company is responsible for:

• having a legal basis to use this data and informing the people it refers to;
• being authorized to use the credentials and accounts it keeps in the vault;
• including sensitive data or data about children and adolescents only when it is essential to the routine and there is a legal basis for it (LGPD, arts. 11 and 14);
• handling requests from the data subjects.

For our part, we process this data only to run the tasks, confidentially, and we help your company respond to data subjects and assess incidents, as far as we are able. The full rules for this processing are in the Terms of use.

If you are not our customer but your data appeared in a task run by a company that uses BotHub, that company makes the decisions about your data, and the best route is to contact it directly. If you write to [email protected], we will, whenever possible, tell you which company is responsible and forward your request to it. We do not delete or hand over this data without the company's instructions, except when the law requires it.

Some automations use external services in specific steps:

• artificial intelligence (currently Google Gemini): reads and interprets text, images and documents, such as a PDF, to extract information, and helps solve captchas. It receives what the step sends: the document or text specified in the automation or, to solve a captcha, an image of the robot computer's entire screen, which may briefly show windows of other tasks that are running;
• captcha solving (currently 2Captcha): a captcha is the "I'm not a robot" test on some websites. The service receives the image of the challenge;
• connection network, or proxy (currently PyProxy): some automations access websites through a Brazilian internet address, and the traffic of those tasks passes through this provider. On websites with HTTPS (the ones that show a padlock next to the address in your browser), the content remains encrypted, and the provider sees the addresses accessed and technical connection data.

We have not yet confirmed that the artificial intelligence plan we use prevents the provider from using the data sent to train or improve its models.

When an automation uses a key from your own account with one of these services, the processing in that service is governed by the contract between your company and the provider.

Artificial intelligence can make mistakes. Check the results of the steps that use it, especially in the first runs.

BotHub does not use tasks to assess people on its own account. The robot does what your company set up. If an automation makes decisions about people, your company, as the controller, is responsible for them, including for requests for review (LGPD, art. 20).

Some of BotHub's security checks are automatic and may reject a sign-up, a sign-in or the free trial, for example when there are many attempts from the same IP address or when the email address has already used the trial. If this happens to you and it looks like a mistake, ask through [email protected] for a review by a person. We explain the criteria used, without the details that would make fraud easier.

To provide the service, we rely on providers. Most of them process data only on our behalf and only for their own role. Some, such as Stripe and Google, also process part of this data as controllers in their own right, under their own policies. In the Terms of use, the providers that process task data are called sub-processors. This list applies to the version of this policy shown at the top of the page:

• Payments: Stripe (United States). Receives your name and email address from sign-up, processes charges and stores card details. Stripe also uses payment data to prevent fraud, under its own privacy policy.
• Sign-in and fonts: Google (United States). Confirms your identity when you sign in with your Google account and delivers the text fonts of the website and the dashboard (Google Fonts), receiving your browser's IP address to do so.
• Protection and delivery: Cloudflare (United States). Sits in front of the website, the dashboard and the API to block attacks and deliver the pages. As a result, the traffic between your browser and BotHub, including what you type in the dashboard, passes through it.
• Hosting: a cloud provider in Brazil, which runs the servers for the dashboard and the API, the database and the processing queues.
• File storage: Amazon Web Services (United States). Stores the files that some automations save in the result and delivers them through a link.
• Email: Hostinger, which sends the service emails and hosts the inboxes of our addresses, where support messages and privacy requests arrive.
• Automation emails: an email delivery service, which sends the emails some automations send, with their attachments.
• Artificial intelligence: Google (United States), through Gemini, in the BotHub Cloud automations that use this step.
• BotHub Cowork artificial intelligence: OpenAI (United States), through our servers. It receives what the AI needs to see on the page while you build or adjust an automation, without the vault passwords, and it does not receive data obtained through the Google APIs.
• BotHub Cowork social networks: Meta (United States), when you connect Instagram or Facebook. It receives the post your automation publishes and, on Instagram, fetches the image from the temporary address on our servers.
• Captcha: 2Captcha, in the automations that use this step.
• Proxy: PyProxy, in the automations that access websites through this network.
• Support chat: OpenAI (United States), which generates the chat replies.

Results you ask us to deliver to other systems go to the addresses you provided, on your instructions.

Within BotHub, only authorized team members access customer data, and only when necessary for support, security and maintenance.

We also share data when required by law, a court order or an authority with legal power to request it, and only what is requested.

If the service comes to be provided by another company, for example through a sale or a reorganization, we will notify you in advance at your account email address, and you may close your account if you disagree.

Several of these providers are located outside Brazil, mainly in the United States, or store data on servers abroad. As a result, part of your data is transferred to other countries, to provide the service you signed up for. Each provider's country is shown in the list above.

These transfers follow the LGPD (art. 33). For your account data, they rely on the transfer being necessary to perform the contract with you (art. 33, IX) or on the standard contractual clauses approved by the ANPD, an official contract model to protect data sent abroad, when the provider's contract includes them. For your task data, which usually belongs to other people, the appropriate mechanism is the ANPD standard contractual clauses in each provider's contract, and we are still checking, provider by provider, whether they are included.

For countries the ANPD recognizes as adequate (countries that protect data to a standard equivalent to Brazil's), that recognition applies.

You can ask through [email protected] for more information about a transfer, including the full text of the clauses used. We reply within 15 days.

For your task data, your company, as the controller, is also responsible for the transfers. We provide whatever information it needs, including the list of providers and countries.

These are the measures in place today:

• an encrypted connection (HTTPS) between your browser and BotHub;
• passwords stored as a hash, never as plain text;
• vault values encrypted with AES-256. They are not shown on screen again once saved. The key that decrypts them belongs to the platform, not to each account, and is kept on our servers and on the robots' computers, with restricted access. The robot decrypts each value only in the task step that uses it;
• task input data stored encrypted in the main tasks table of the database;
• limits on sign-in and sign-up attempts, and security logs to investigate abuse;
• in the dashboard, each account sees only its own data, and team access is restricted to authorized people;
• for those who integrate through the API, an optional encryption key specific to the account, to encrypt values in your system before sending them. We keep this key so the robot can use it at run time, so it is an extra layer of protection, not a barrier to our technical access.

It is also important to know the limits. To run the task, the input data is readable in the processing queue, in the record of tasks that failed in the queue and in the logs on the robot's computer. Spreadsheets (including the copy of each row's data), schedules, verification codes, results and delivery headers are stored without this encryption, with access limited to your account in the dashboard and to the authorized team. No system is completely immune to failures.

You also help protect your account: use a strong password that is yours alone, do not share access to the dashboard and change the passwords kept in the vault if you suspect a problem.

If a security incident involving personal data occurs, we act to contain it and assess the risks.

When an incident may cause significant risk or harm to data subjects, we notify the people affected (at the account email address, when they are our customers) and report it to the ANPD within the deadlines set by regulation.

When the incident involves your task data, we notify your company without delay, with what we know (what happened, which data, how many people and what we did), so it can make the notifications that fall to the controller.

These are the retention periods for each type of data. When the law requires a longer period, the legal period applies:

• Account data: for as long as the account exists. After deletion, we delete or anonymize this data (remove what identifies the person), except what must be kept for the reasons listed below.
• Vault and schedules: for as long as the account exists. They are deleted from our database along with it.
• With BotHub Cowork, what stays on your computer (automations, history, vault, settings and the Google access) stays there until you delete it, disconnect the Google account or uninstall the software.
• Digital certificates installed on the robots' computers: at present they remain installed after the tasks and are not removed automatically when the account is deleted. If you ask, our team removes them.
• Run data (inputs, results, step history, spreadsheets, verification codes and delivery records): for as long as the account exists, so you can look it up and we can investigate errors. At present there is no automatic deletion after a set period.
• Files saved by automations in file storage: at present they are not deleted automatically, and the link keeps working. Download and keep whatever you need.
• Logs on the robots' computers (what the robot received, did and returned in each task): at present they are kept with no automatic deletion period, to investigate errors. They are not separated by customer.
• Security and technical error logs: used to protect the service and investigate abuse. At present they have no fixed automatic deletion period.
• Record of acceptance of the terms: for as long as the account exists and, after the contract ends, for up to 5 years, which is the period set by the CDC (Código de Defesa do Consumidor, Brazil's Consumer Protection Code) for claims about the service, only to defend rights.
• BotHub's billing and accounting records: for at least the period set by tax and accounting law, generally 5 years, even after the account is deleted. Stripe keeps its own data under its own policy.
• Free trial control (the standardized email address): kept even after the account is deleted, only to prevent the trial from being repeated. At present it has no automatic deletion period.
• Partner applications: during the review and, after the reply, to keep in touch about the partnership or to record the reply. At present they have no automatic deletion period.
• Support messages: for the duration of the support conversation and afterwards, to keep a record of it. At present they have no automatic deletion period.
• Chat conversations and contact requests: used to continue helping you and prevent abuse. At present they have no automatic deletion period.

At present, account deletion is handled by our team, on request. The team deletes the account data, the run data in the database and the account's task files in file storage, except what the law requires us to keep and the records listed above that remain after deletion. The logs on the robots' computers are not separated by customer, so we cannot delete them on request: they follow the period shown above.

You can ask us to delete your account at any time through [email protected], writing from your account email address. Before that, download the results you need: BotHub is not a permanent archive of your documents.

Under the LGPD (art. 18), you, as the data subject, can:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data (you can change your name, email address and password in your profile);
• request anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
• request portability, that is, a copy of your data in a format another provider can use;
• request deletion of data processed on the basis of your consent, where there is any;
• know which companies we share your data with;
• know that you may refuse consent and what happens if you do, and withdraw consent you have already given;
• object to processing carried out without consent when it does not comply with the law;
• request a review, by a person, of a decision made solely by automated means that affects your interests.

To exercise these rights, write to [email protected] from your account email address. This is free of charge. We may ask you to confirm your identity before acting on a request, to protect your data.

We reply within 15 days. If we cannot fulfill a request, for example because the law requires us to keep the data, we explain why.

At present, account deletion and copies of data are handled by our team, based on your request to [email protected]. To remove a credential from the vault, write to [email protected], as explained in the Terms of use.

You can also file a complaint with the ANPD and with consumer protection bodies, such as Procon (the consumer protection agencies of Brazilian states and cities).

Cookies are small files a website stores in your browser.

On the public website, BotHub does not set its own cookies and does not use audience analytics or advertising tools. Cloudflare, which protects the website, may set its own technical cookies to tell human visitors apart from bots. Fonts come from Google Fonts, which receives your browser's IP address to deliver them.

In the website chat, the conversation is kept in your browser (in local storage, a space similar to a cookie) for up to 24 hours, so you can pick up where you left off.

In the dashboard, where you sign in to your account, we use:

• a session cookie, needed to keep you signed in. It expires when you close your browser or after a period of inactivity;
• the cookie for the "Lembrar-me" ("Remember me") option, set when that box is ticked at sign-in (it is ticked by default). It keeps you signed in even after you close your browser, until you sign out, and may last more than a year. If you do not want it, untick the box when signing in;
• on the automation creation screens, a cookie that keeps the fields you typed in "Gerar teste" ("Generate test") for 30 days, to fill in the form next time;
• on some screens, parts of the page (programs and videos) loaded from other companies' services, such as YouTube, which receive your browser's IP address and, in YouTube's case, may set their own cookies.

BotHub's cookies are not used for advertising. If you block cookies in your browser, you will not be able to sign in to the dashboard.

BotHub is a tool for businesses, intended for people aged 18 or over. The service is not directed at children or adolescents, and we do not address any communication to them.

If we learn that an account belongs to someone under 18, we close the account and delete the data, except what the law requires us to keep.

Data about children and adolescents that appears in a customer's tasks is the responsibility of the customer company, as the controller.

When this policy changes, we publish the new version on this page, with its number and date at the top.

Significant changes, such as a new use of data or a new type of provider, are announced at your account email address before they take effect, with a summary of what changed.