Privacy Policy

GR Negócios Digitais (CNPJ: 29.691.265/0001-65), responsible for the XBASE platform, is committed to protecting the privacy and personal data of its users, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018) and other applicable regulations.

This Policy describes how we collect, use, store and protect your personal information when you use our platform.

We collect the following categories of data:

• Registration data: name, email, phone number and information provided at the time of registration;
• Usage data: information about how you interact with the platform, including access logs, pages visited and features used;
• Agent data: settings, prompts, knowledge bases and content entered by the user to operate the AI agents;
• Technical data: IP address, browser type, operating system and device information;
• Payment data: processed by third-party payment providers, with no direct storage of card data on our servers.

We use your personal data to:

• Provide, operate and maintain the platform and its services;
• Process registrations and manage user accounts;
• Provide technical support and customer service;
• Send relevant communications about the service, updates and news;
• Improve the user experience and enhance features;
• Comply with legal and regulatory obligations;
• Prevent fraud and ensure the security of the platform.

We do not sell, rent or trade your personal data. We may share information in the following situations:

• Service providers: technology partners required to operate the platform (hosting, including third-party VPS servers for allocating agents, payment processing, LLM model providers and AI services);
• Legal obligation: when required by law, court order or a competent authority;
• Protection of rights: to protect the rights, property or safety of GR Negócios Digitais, its users or the public.

When you connect a Google account to XBASE, we access only the data needed for the feature you turned on, and only after you authorize it on Google's consent screen:

• Sign in with Google: name, email and profile photo, to create and identify your account;
• Google Calendar: free/busy lookups and creating, changing and cancelling the events of meetings that you or your agents schedule through the platform;
• Google Business Profile: reading and editing your business profile information (name, categories, description, phone numbers, website, address, hours and status) and reading and replying to reviews, always triggered by an action you take on the platform;
• YouTube: identifying your channel and uploading the videos you choose to publish or schedule;
• Google Ads: reading campaigns and metrics of the ad accounts you connect.

• Storage: Google access tokens are encrypted on our servers. Business Profile data is read from Google each time it is used and is not copied to our database; meeting events are stored only to show your calendar on the platform;
• No sale or advertising: we do not sell, rent or use data received from Google APIs for advertising, and we do not share it with third parties, except infrastructure providers needed to run the feature or when required by law;
• No AI training: data received from Google APIs is not used to develop, improve or train generalized artificial intelligence or machine learning models. AI agents in your account use it only to perform the task you configured;
• Human access: our team reads this data only with your consent (for example, in a support request), to investigate abuse or security issues, or when required by law.

You can disconnect a Google account at any time under Integrations on the platform, which deletes the stored tokens, or revoke access at https://myaccount.google.com/permissions. To request deletion of data linked to your Google account, use the contact in section 12.

XBASE's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure or destruction. The measures adopted include:

• Encryption of data in transit and at rest;
• Role-based access control;
• Continuous monitoring of the infrastructure;
• Regular backups and recovery plans.

Although we use reasonable efforts to protect your information, no system is 100% secure. In the event of a security incident, we will notify the affected users and the competent authorities as required by the LGPD.

In accordance with the LGPD, you have the following rights regarding your personal data:

• Confirmation that your data is being processed;
• Access to the personal data collected;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data;
• Portability of the data to another provider;
• Deletion of data processed with your consent;
• Withdrawal of consent at any time.

To exercise any of these rights, contact us through the channels listed in the Contact section below.

Your personal data will be retained for the period needed to fulfill the purposes described in this Policy, or as required by legal, contractual or regulatory obligations. Once the processing ends, the data will be deleted or anonymized.

The platform uses cookies and similar technologies to improve the browsing experience, analyze the use of the service and personalize content. You can manage your cookie preferences in your browser settings.

The XBASE platform is not directed at anyone under 18 years of age. We do not knowingly collect data from minors. If we identify any inadvertent collection, we will delete the data immediately.

We reserve the right to update this Privacy Policy at any time. Significant changes will be communicated through the platform or by email. We recommend reviewing this page periodically.