Privacy Policy

Last updated: July 27, 2026

1. Who We Are

ValorBrain is a product of Valor Digital, headquartered in Brazil. This policy covers how we process personal and organizational data.

2. Data Collected

Account

  • Name, email (Google OAuth or manual signup)
  • Password (bcrypt hash, never plaintext)
  • Company settings (name, address, etc., when provided)
  • Avatar (Google profile, optional)

Ingested content

  • Markdown indexed via watcher
  • Documents via webhook ingest
  • Memories via MCP store tool
  • OAuth connectors (Notion, Drive, etc — when activated)

Usage and operations

  • Transaction logs (billing audit trail)
  • MCP token usage (last_used_at, use_count)
  • Activity feed (handoffs between agents, etc.)

3. How We Use Data

  • Service operation (retrieval, billing, audit)
  • Cross-agent coherence (sharing context across your own agents)
  • Service improvement (anonymized when possible)
  • Transaction and security notifications

4. Multi-Tenant Isolation

Your data is isolated per tenant via Postgres Row-Level Security (RLS). Other tenants cannot view, query or modify your information. The engine runs as role valorbrain_app with permissive tenant-scoped policies enforced by the database.

5. Sharing

We do not sell or hand over your data. Third parties enter the path only when the service needs them, and every one is listed — with what it receives and where it sits — under Subprocessors. In short: the network edge (Cloudflare), the language model that writes the answers, the payment processor, the transactional mail server, and the connectors you authorize yourself. We also hand over data when required by Brazilian law or a valid court order.

6. Where the data sits, and the one exception

Storage:your documents, the vectors built from them and the Postgres database sit on our own hardware in Santa Catarina, Brazil. Embedding, reranking and entity extraction run on that machine's GPU.

The exception: the AI answer is written by a cloud language model outside the country. Each answered question sends it the question and the retrieved passages. Searching your memory sends nothing; only a generated answer does. That is an international data transfer, it is declared in the DPA, and the subprocessor is named.

If you cannot have that exception, run all of ValorBrain in your own environment: optional on the Empresa plan, included on Enterprise. Then no step leaves your perimeter.

7. Retention

  • Active data: as long as the account exists
  • After a deletion request: up to 30 days to erase content and vectors
  • Backups: 14-day rotation, so a copy survives at most that long
  • Access record: kept while the account exists, exportable at any time

8. Your Rights (LGPD)

  • Data access (Settings → Audit Logs)
  • Correction
  • Deletion (Settings → Profile → Delete)
  • Portability (JSON export via API)
  • Consent revocation
  • Complaint to ANPD (Brazil's data protection authority)

9. Security

  • HTTPS required (TLS 1.3)
  • Passwords: bcrypt (cost 10)
  • MCP tokens: SHA-256 hash in DB, raw shown only once
  • JWT signed (HS256, 7-day max)
  • Postgres RLS active, enforced by the database
  • Daily database backup, kept 14 days, inside the same physical perimeter

The detail, including what we do not have yet, is under Security.

10. Cookies

We use only essential cookies (auth). No advertising tracking.

11. Children

The service is not intended for users under 18.

12. Contact and DPO

To exercise your data rights or for privacy questions: [email protected]
Data Protection Officer (DPO): Gustavo Iucksh Santos

← Back to signup