Privacy Policy

For account, billing, website, support, security, and product-operation data, the controller is AutoTalk, CNPJ 51.389.524/0001-57, Jaguariuna, Sao Paulo, Brazil. Privacy requests can be sent to [email protected].

When a customer uses AutoTalk to manage conversations, contacts, workflows, files, API data, and AI automations for its own business, that customer is normally the controller of the end-customer data. AutoTalk acts as operator/processor and handles that data to provide, secure, support, and maintain the platform according to the customer's configuration and lawful instructions.

AutoTalk does not use customer content to train AutoTalk-owned models. Customer content may be sent to the AI provider selected or configured by the customer, such as OpenAI, Anthropic, Google Gemini, DeepSeek, or OpenRouter, only to provide the requested feature, debug failures, secure the service, or comply with law. Provider behavior may also be governed by the customer's own provider agreement when the customer uses bring-your-own-key.

AutoTalk uses necessary cookies and similar technologies for authentication, session security, CSRF protection, language/theme preferences, and app operation. The app also uses Google reCAPTCHA for abuse prevention, Firebase Cloud Messaging for push notifications when enabled, and Sentry for error, performance, and masked replay diagnostics. Sentry replay is configured to mask text, inputs, and media. In line with the data minimization principle (LGPD Art. 6, III), Sentry is configured to limit automatic personal-data collection: authentication tokens and session headers are not transmitted to Sentry. User identifiers, IP address, and request metadata are sent only to the extent necessary for diagnostics, security, and abuse prevention.

We share personal data with subprocessors only as needed to provide, secure, bill, monitor, and support AutoTalk. This includes hosting, database, storage, messaging, AI, payment, email, analytics, monitoring, secrets, and anti-abuse providers. The current list is available on the Subprocessors page.

Data may be hosted or processed in Brazil, the United States, Canada, Europe, and other locations where AutoTalk or its subprocessors operate. AutoTalk uses contractual, technical, and organizational safeguards for international transfers, including provider agreements, access controls, encryption in transit, tenant isolation, and vendor due diligence.

AutoTalk applies TLS/HTTPS, access controls, tenant isolation, secret management, logging, monitoring, backups/provider durability, and operational security controls. AutoTalk personnel and authorized contractors access customer data only on a need-to-know basis for support, debugging, security, legal compliance, abuse prevention, and service operation.

We retain account, company, billing, operational, and customer content while the account or company remains active and as needed for legal, tax, security, billing, dispute, backup, and audit purposes. Customers can configure retention policies for certain data categories. When a company deletion is requested, AutoTalk schedules deletion and permanently purges company-scoped data after the configured deletion process, currently up to about 60 days. Some limited records may be retained longer where required by law, security, billing, or dispute handling.

Under the LGPD, data subjects may request confirmation of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, review of automated decisions where applicable, objection to irregular processing, and revocation of consent. They may also petition the ANPD. If your data was processed by an AutoTalk customer, we may direct the request to that customer as controller. Send requests to [email protected].

AutoTalk is a business platform and is not intended for children. Customers are responsible for ensuring that their use of AutoTalk, including any sensitive or regulated data in conversations, complies with applicable law and required consents.

We may update this policy as the product, law, or subprocessors change. Material changes may be communicated through the app, website, email, or policy update. Continued use after the effective date means the updated policy applies.