# Privacy

Version 2026-10-29, in force since 29/10/2026. This is a summary of a translation. The Portuguese version of the policy prevails.

The data controller is BEHEMOTH INTELIGENCIA PARA A MIDIA LTDA (BBI.MEDIA), CNPJ 28.638.470/0001-02, Alameda Mamoré, 535, 11º andar, conj. 1110, Alphaville Centro Industrial e Empresarial, Barueri/SP, CEP 06454-040, Brazil. The data protection officer (DPO) and support share one contact: [suporte@vereda.bot](mailto:suporte@vereda.bot).

Vereda processes account data, work content, content from connected accounts, messages from the WhatsApp and e-mail channels, the record of the acceptance of the terms and technical operating data. On Vereda's WhatsApp line, the messages, audio, photos, PDFs and location you send are delivered by WhatsApp, from Meta, under its own terms. Media files stay on Vereda's server for up to 10 minutes, the time Vereda takes to receive them. Legal bases: performance of the contract, legal obligation and legitimate interest (LGPD, art. 7, V, II and IX). We do not sell personal data or use Vereda content for third-party advertising.

Cookies and measurement technologies (section of 30/09/2026, on vereda.bot and the /start, /start/company, /sign-in and /credits/done pages of app.vereda.bot): necessary cookies are always on; analytics (Google Analytics) and marketing (Google Ads and Meta Ads) only with your consent (LGPD, art. 7, I), and nothing goes to Google or Meta before the choice. With consent, they receive browsing data (pages, date and time, IP, browser and device, where the visit came from) and may keep it in the United States and other countries (art. 33). The choice is changed or withdrawn in "Cookie preferences", in the footer; when withdrawn, we delete the cookies and stored data of those tools. We keep the record of each choice, without IP or account, for 5 years, as proof of consent (art. 8, par. 2).

Meta Platforms (Pixel and Conversions API): with your permission for marketing cookies, Vereda uses the Meta Pixel and sends Meta, from the server, events for interest in a plan, contact, sign-up and purchase. These events carry, when they exist, the hashed e-mail, the IP address, the browser and Meta cookie identifiers. Meta uses this data to measure and show ads. For measurement, Meta acts as Vereda's processor. For its own advertising purposes, Meta follows [Meta's data policy](https://www.facebook.com/privacy/policy/). You can withdraw the permission in the cookie preferences. The browsing data kept for the sending is deleted within 7 days.
- `vereda_consent` (Necessary, Vereda (BBI.MEDIA)): Keeps your cookie choice, for both sites; 12 months.
- `uiLocale, uiAppearance (localStorage)` (Necessary, Vereda (BBI.MEDIA)): Browser storage on app.vereda.bot: chosen language and appearance; Until you clear the browser.
- `_ga, _ga_*` (Analytics, Google LLC (Google Analytics)): Counts visits and measures how the site is used; Up to 2 years.
- `_gcl_au` (Marketing, Google LLC (Google Ads)): Measures whether a Google ad brought the visit or the purchase; 90 days.
- `_fbp, _fbc` (Marketing, Meta Platforms (Meta Ads)): Measures Facebook and Instagram ads, shows Vereda ads and identifies the browser for sending events to Meta; 90 days.

AI providers: to work, Vereda sends the content each task needs to the AI providers in the processor list. By accepting the terms, the customer authorizes this sending. Vereda's text model is from Anthropic or from DeepSeek, according to the service configuration. DeepSeek reads text only. When the model is DeepSeek, images go to Google (Gemini API), which reads them and passes the text to the model. This includes the document pages that the model opens as images. No AI provider uses the data to train models. For Anthropic, this comes from its commercial API terms. For DeepSeek, this comes from the zero data retention agreement it approved for Vereda. It does not train models with the data. For Google, it comes from the Gemini API paid-tier terms. For TypeSafe, it comes from its policy. The providers keep the data for a limited time, under each one's policy. The exception is DeepSeek. Under the zero retention agreement, it does not keep the data after processing the request. It may only keep a temporary cache of the context, for a few hours or days, to speed up the next requests. For Vereda, this agreement applies in place of DeepSeek's public policy.

By default, Google does these tasks with Vereda's key, through the Gemini API:

- the spoken replies and the transcription of audio;
- the description of videos attached to conversations;
- the reading of scanned pages, without text, of knowledge-base PDFs;
- image generation and checking, on the Profissional and Escala plans;
- the search vectors of the memories and of the knowledge-base texts.

When the text model is DeepSeek, which reads text only, Google also reads the images attached to conversations and the PDF, Word or slide pages that the model opens as images, with or without text, and passes the text to the model.

Vereda reads the text of PDFs on its own servers. In the knowledge base, only scanned pages, without text, go to Google. If the customer sets up another service, its policy applies.

Processors and international transfer (LGPD, art. 33, IX): the processors handle data only to provide the service, and some are outside Brazil (United States, China and other countries).
- Anthropic, PBC: One of the AI models for chat and tasks, including reading photos; USA; [https://www.anthropic.com/legal/privacy](https://www.anthropic.com/legal/privacy)
- Hangzhou DeepSeek Artificial Intelligence Co., Ltd. (DeepSeek): One of the AI models for chat and tasks, text only: it does not read images (with DeepSeek, images and the document pages that the model opens as images go to Google (Gemini API), which passes the text to the model); China; [https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html](https://cdn.deepseek.com/policies/en-US/deepseek-privacy-policy.html)
- Google (Gemini API, paid tier): Voice (spoken replies and transcription of audio); description of videos attached to conversations; reading of scanned PDF pages; image generation and checking on the Profissional and Escala plans; memory and knowledge base (search vectors of the texts); reading of images and of document pages opened as images when the text model is DeepSeek, which reads text only; USA and others; [https://ai.google.dev/gemini-api/terms](https://ai.google.dev/gemini-api/terms)
- TypeSafe AI, Inc. (Jev): Short AI decisions: company lookup at sign-up, avatar reactions, tips and the safety check of messages; USA; [https://typesafe.ai/legal/privacy-policy](https://typesafe.ai/legal/privacy-policy)
- Composio: Connection to, and actions in, the apps you connect; USA; [https://composio.dev/privacy](https://composio.dev/privacy)
- Meta (WhatsApp Business Platform): The shop's own WhatsApp Business lines; USA and others; [https://whatsappbusiness.com/policy/](https://whatsappbusiness.com/policy/)
- Meta (WhatsApp): Delivery of WhatsApp messages, under Meta's own terms; USA and others; [https://www.whatsapp.com/legal/privacy-policy](https://www.whatsapp.com/legal/privacy-policy)
- Stripe: Payment; USA; [https://stripe.com/br/privacy](https://stripe.com/br/privacy)
- SMTP2GO: E-mail delivery; New Zealand and others; [https://www.smtp2go.com/privacy/](https://www.smtp2go.com/privacy/)
- Expo (650 Industries, Inc.): Push notifications to the device (title and text of each notice); USA; [https://expo.dev/privacy](https://expo.dev/privacy)
- Google Cloud (Google LLC): Hosting; USA; [https://cloud.google.com/terms/cloud-privacy-notice](https://cloud.google.com/terms/cloud-privacy-notice)
- Meta Platforms (Pixel and Conversions API): Measures ads with sign-up and purchase events, only with your marketing consent; United States; [https://www.facebook.com/privacy/policy/](https://www.facebook.com/privacy/policy/)

Connected accounts: Composio is the processor for the connections to Google (Gmail, Calendar, Drive), Meta (Facebook, Instagram), TikTok, LinkedIn and X. Vereda reads and writes only what the task asks for, nothing is published or sent without the owner's approval, and this data does not train AI models. Access can be revoked in Vereda itself or on each platform's permissions page, and data deletion can be requested at suporte@vereda.bot. Vereda's use and transfer to any other app of information received from Google APIs will adhere to the [Google API Services User Data Policy](https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Data from Google Workspace APIs is not used to develop, improve or train non-personalized AI or machine learning models. On X, Vereda acts only with the customer's express consent, deletes within 24 h X content that was deleted on X or whose deletion was requested, and does not use X content to train models ([X Developer Policy](https://docs.x.com/developer-terms/policy)).

Anonymized usage log: to improve the product's work recipes, we record the employee's role, the name of the recipe used, the outcome and the date. We never record customer text, names, contacts, e-mails, files or conversation content. Each workspace sends BBI.MEDIA only daily summed counts, without identifying the company; the detailed events stay in the workspace and are deleted with it. Legal basis: legitimate interest (Brazil's LGPD, art. 7, IX).

Assistant safety: an automatic classifier, Jev by TypeSafe, checks the messages sent to the team and outside content (e-mails, web pages, files) to detect attempts to manipulate the assistant. The safety log keeps only the type and the date of each block, never the text. BBI.MEDIA receives the number of blocks for each account, to prevent abuse. Keys and passwords are never sent in answers.

Review of the company's recipes: BBI.MEDIA reviews the company's recipes (skills) to keep quality and security. Every hour, the workspace sends a copy of the recipes (name, description, text, source and which employees use them); conversations, customer messages, files and memories are never copied, and BBI.MEDIA never reads the conversations. BBI.MEDIA may edit a recipe; for each edit, the leader tells the owner in the chat with a summary of the change. The copy is deleted together with the workspace.

## Inbound channels: WhatsApp history and the company e-mail

### Who is the controller and who is the processor

In the inbound channels, the company that uses Vereda is the controller of the data of customers and third parties. This applies to the WhatsApp history and to the company e-mail.

BBI.MEDIA is the processor. BBI.MEDIA handles this data on behalf of the company, only to provide the service and only under the company's instructions.

The company answers for the legal basis and for telling data subjects that Vereda handles the history and the e-mail.

### Purpose: the WhatsApp profile

When the owner connects the company's WhatsApp line, Vereda can import the history of one-to-one conversations. The purpose is one only: to build the WhatsApp profile.

The profile is an aggregate summary of how the company serves customers. The support employee and the leader use the profile to answer in the company's style.

Vereda does not use the history for any other purpose. Vereda does not train AI models with the history.

### Minimization

Vereda imports only the text of the messages. Vereda does not import media, such as photos, audio and files. Vereda does not import groups.

The contact's phone number is stored as a hash. The plain number does not stay in the imported history.

### History retention

Vereda deletes the raw history 30 days after the profile is ready. If the profile fails, Vereda deletes the raw history 30 days after the sync ends.

After that, only the aggregate profile stays. The profile stays until the owner disconnects WhatsApp. On disconnect, Vereda deletes the profile.

### Company e-mail: discarded and held

The Vereda e-mail address accepts only messages from authenticated senders that the owner allows. Vereda discards the rest before any AI model reads the content.

For a discarded e-mail, Vereda keeps only the sender, the subject and the date. This data stays 30 days. Only the owner sees this data, in Settings. The body and the attachments are not kept.

A forwarded message that Vereda cannot verify stays held until the owner decides. If the owner does not decide, the held message expires in 14 days and Vereda deletes it.

Retention: the data is kept while the account is active. After cancellation, 90 days for customers who paid for at least one month (notices 30, 7 and 1 day before) and 30 days for accounts that never left the free trial (notices 7 and 1 day before); then everything is deleted. The sign-up data the BBI keeps (e-mail, contact, WhatsApp number, IP and browser of the acceptance) is anonymized 30 days later, and the tax data stays for 5 years, as the law requires. A sign-up that never paid is deleted after 90 days. E-mails received at the company e-mail leave the server and the record after 30 days. Deletion can also be requested from support.

Under Brazil's LGPD (art. 18), you may ask for confirmation, access, correction, anonymization, blocking or deletion, portability, information on sharing and withdrawal of consent, at suporte@vereda.bot.

Read the [full policy](https://vereda.bot/en/privacy/) for every detail.