Privacy

Version 2026-10-29, in force since 29/10/2026

This is a translation. The Portuguese version of this policy prevails.

This policy explains how BBI.MEDIA collects, uses and protects personal data when you use Vereda on the website, in the browser, on WhatsApp or by e-mail. Each customer's data is kept apart: your business's data stays in your workspace, not in a shared pool of the service.

Who is responsible for your data

The data controller is BEHEMOTH INTELIGENCIA PARA A MIDIA LTDA (BBI.MEDIA), CNPJ 28.638.470/0001-02, located at Alameda Mamoré, 535, 11º andar, conj. 1110, Alphaville Centro Industrial e Empresarial, Barueri/SP, CEP 06454-040, Brazil. The data protection officer (DPO) and support share one contact: suporte@vereda.bot. See also the support page.

Data we collect

Depending on how you use Vereda, we collect:

• Account data: name, e-mail, WhatsApp number and authentication records.
• Work content: messages, instructions for the AI employees, tasks, memories and files you give the service.
• Connected accounts: the content a task reads or writes in the accounts you connect.
• Channels: messages received and sent through the channel's WhatsApp and Vereda's e-mail inbox.
• Acceptance of the terms: the accepted version, the date and time, the IP address and the browser.
• Technical data: IP address, browser, session records and diagnostics, used to run and protect the service.
• Browsing on the site, only with your consent: pages viewed and where you came from, through the analytics and marketing cookies (see Cookies).

How we use the data

We use this information to:

• Provide, maintain, protect and troubleshoot Vereda.
• Authenticate you and keep your workspace across every channel.
• Run the tasks, routines and notices you ask for.
• Bill the subscription, answer support and meet legal obligations.

The legal bases are the performance of the contract (LGPD, art. 7, V), compliance with a legal obligation (art. 7, II) and legitimate interest (art. 7, IX) for the security of the service and the anonymized usage log. The site's analytics and marketing cookies depend on your consent (art. 7, I). We do not sell personal data or use Vereda content for third-party advertising.

Cookies and measurement technologies

Section updated on 30/09/2026.

This section covers the vereda.bot site and these pages: the plans page (/start), the company details page after payment (/start/company), the entry page (/sign-in, each company's too) and the return page of a credit purchase (/credits/done). The other app pages, the pages with a single-use link and each customer's workspace use no analytics or marketing cookies.

On the first visit, we ask whether you accept each category. Necessary cookies are always on. Analytics and marketing work only with your consent (LGPD, art. 7, I), and nothing is sent to Google or Meta before your choice. Refusing changes nothing on the site. You can change or withdraw your consent at any time in "Cookie preferences", in the footer; when you withdraw it, we delete the cookies and stored data of those tools from your browser.

We use Google Tag Manager to load the analytics and marketing tools, and Google's consent mode makes each tool follow your choice.

With your consent, Google LLC (Google Analytics and Google Ads) and Meta Platforms (Meta Ads) receive browsing data: pages viewed, date and time, IP address, browser and device type, and which ad or site you came from. They may use this data to measure and show ads, under their own policies, and keep it in the United States and other countries (LGPD, art. 33).

Google and Meta policies: Google, Meta.

Meta Platforms: Pixel and Conversions API

With your permission for marketing cookies, Vereda uses the Meta Pixel and sends Meta, from the server, events for interest in a plan, contact, sign-up and purchase. These events carry, when they exist, the hashed e-mail, the IP address, the browser and Meta cookie identifiers. Meta uses this data to measure and show ads.

For measurement, Meta acts as Vereda's processor. For its own advertising purposes, Meta follows its data policy: Meta's data policy.

You can withdraw the permission in the cookie preferences. The browsing data kept for the sending is deleted within 7 days.

We keep a record of each choice, without IP address or account: a random code kept in your browser, the categories accepted, the version of this section, the language, the site and the date. This record proves the consent (LGPD, art. 8, par. 2) and is deleted after 5 years.

Cookie preferences

AI providers

To work, Vereda sends the content each task needs to the AI providers listed under Processors. When you accept the terms, you authorize this sending.

• What is sent: messages, conversation history, instructions for the AI employees, memories, attachments, screenshots and content from connected accounts, to generate answers and run tasks, including scheduled ones.
• Text model: Vereda's text model is from Anthropic or from DeepSeek, according to the service configuration. DeepSeek reads text only. When the model is DeepSeek, images go to Google (Gemini API), which reads them and passes the text to the model. This includes the document pages that the model opens as images.
• No training: no AI provider uses your data to train models. For Anthropic, this comes from its commercial API terms: it does not use API inputs and outputs to train its models. For DeepSeek, this comes from the zero data retention agreement it approved for Vereda. It does not train models with the data. For Google (Gemini API, paid tier), this comes from Google's terms. For TypeSafe, it comes from its policy.
• Retention at the providers: the providers keep the data for a limited time, to run the service and prevent abuse, under each one's policy. The exception is DeepSeek. Under the zero retention agreement, it does not keep the data after processing the request. It may only keep a temporary cache of the context, for a few hours or days, to speed up the next requests. For Vereda, this agreement applies in place of DeepSeek's public policy.
• Google (Gemini API): by default, with Vereda's key, it does the spoken replies, the transcription of audio, the description of videos attached to conversations, the reading of scanned pages (without text) of knowledge-base PDFs, image generation and checking on the Profissional and Escala plans, and the search vectors of the memories and of the knowledge-base texts. When the text model is DeepSeek, which reads text only, Google also reads the images attached to conversations and the PDF, Word or slide pages that the model opens as images, with or without text, and passes the text to the model. This use follows the same paid-tier terms. Vereda reads the text of PDFs on its own servers. In the knowledge base, only scanned pages, without text, go to Google. If you set up another service, its policy applies.

Processors and international transfer

These processors handle data on our behalf, only to provide the service. Some are outside Brazil (United States, China and other countries). The international transfer relies on art. 33, IX, of the LGPD, because it is needed to perform the contract with you (art. 7, V).

Connected accounts (Composio)

Composio is the processor for Vereda's connections to other platforms. Each platform's authorization screen shows Composio's name, and Composio keeps the access tokens, encrypted.

• What data: Vereda reads and writes only what the task asks for, as in the table below.
• What for: to run the tasks you ask for, such as answering an e-mail, booking a meeting or publishing a post.
• Approval: nothing is published or sent without the owner's approval.
• No training: data from connected accounts does not train AI models.

You can also disconnect an account in Vereda itself. To delete a platform's data, write to suporte@vereda.bot: we delete it without delay and confirm by e-mail.

Vereda's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google Workspace APIs is not used to develop, improve or train non-personalized AI or machine learning models.

On X, Vereda acts on your behalf only with your express consent. Within 24 h we delete X content that was deleted on X or whose deletion you asked for, and we do not use X content to train models. These rules follow the X Developer Policy.

Anonymized usage log

To improve the product's work recipes, Vereda records how the AI employees use those recipes. This shows where a recipe is missing and where a recipe fails.

• What we record: the employee's role (for example, sales or customer service), the name of the recipe used, the outcome (delivered, corrected, abandoned, failed or no role set) and the date.
• What we never record: customer text, names, contacts, e-mails, files or any conversation content.
• How: each workspace sends BBI.MEDIA only daily summed counts, without identifying the company. The detailed events stay in the company's own workspace and are deleted with it.
• Legal basis: legitimate interest (Brazil's LGPD, art. 7, IX).

Assistant safety

An automatic classifier protects the team against attempts to manipulate the assistant.

• What is checked: the messages sent to the team and outside content, such as e-mails, web pages and files. The check uses Jev, by TypeSafe, listed under Processors.
• What is recorded: only the type and the date of each block, never the text.
• Count: BBI.MEDIA receives the number of blocks for each account, to prevent abuse.
• Keys and passwords: are never sent in the team's answers.

Review of the company's recipes

BBI.MEDIA reviews the company's recipes (skills) to keep the quality of the work and the security of the service.

• What is copied: every hour, your workspace sends BBI.MEDIA a copy of the company's recipes: the name, the description, the text of the recipe, its source and which employees use it.
• What is never copied: the team's conversations, your customers' messages, files and memories. BBI.MEDIA never reads the conversations.
• Editing: BBI.MEDIA may edit one of the company's recipes. For each edit, the team leader tells the owner in the chat (and on WhatsApp, when it is connected), with a summary of the change.
• Who has access: only BBI.MEDIA staff with access to the admin panel. Every edit is recorded.
• Legal basis: performance of the contract and legitimate interest in the quality and security of the service (Brazil's LGPD, art. 7, V and IX).
• Retention: the copy is deleted together with the workspace.

WhatsApp and e-mail

On Vereda's WhatsApp line, the messages, audio, photos, PDFs and location you send are delivered by WhatsApp, from Meta, under its own terms. Media files stay on Vereda's server for up to 10 minutes, the time Vereda takes to receive them. On the shop's own WhatsApp Business lines, messages go through Meta's WhatsApp Business Platform. E-mails stay in Vereda's inbox, and outgoing e-mail goes through SMTP2GO. Each channel receives the content needed for the conversation and for the tasks you ask for.

Inbound channels: WhatsApp history and the company e-mail

Who is the controller and who is the processor

In the inbound channels, the company that uses Vereda is the controller of the data of customers and third parties. This applies to the WhatsApp history and to the company e-mail.

BBI.MEDIA is the processor. BBI.MEDIA handles this data on behalf of the company, only to provide the service and only under the company's instructions.

The company answers for the legal basis and for telling data subjects that Vereda handles the history and the e-mail.

Purpose: the WhatsApp profile

When the owner connects the company's WhatsApp line, Vereda can import the history of one-to-one conversations. The purpose is one only: to build the WhatsApp profile.

The profile is an aggregate summary of how the company serves customers. The support employee and the leader use the profile to answer in the company's style.

Vereda does not use the history for any other purpose. Vereda does not train AI models with the history.

Minimization

Vereda imports only the text of the messages. Vereda does not import media, such as photos, audio and files. Vereda does not import groups.

The contact's phone number is stored as a hash. The plain number does not stay in the imported history.

History retention

Vereda deletes the raw history 30 days after the profile is ready. If the profile fails, Vereda deletes the raw history 30 days after the sync ends.

After that, only the aggregate profile stays. The profile stays until the owner disconnects WhatsApp. On disconnect, Vereda deletes the profile.

Company e-mail: discarded and held

The Vereda e-mail address accepts only messages from authenticated senders that the owner allows. Vereda discards the rest before any AI model reads the content.

For a discarded e-mail, Vereda keeps only the sender, the subject and the date. This data stays 30 days. Only the owner sees this data, in Settings. The body and the attachments are not kept.

A forwarded message that Vereda cannot verify stays held until the owner decides. If the owner does not decide, the held message expires in 14 days and Vereda deletes it.

Retention and deletion

• We keep the account data and the workspace content while the account is active.
• After cancellation, the workspace stays paused. If you paid for at least one month, the data stays for 90 days, with e-mail notices 30, 7 and 1 day before deletion. If the account never left the free trial, it stays for 30 days, with notices 7 and 1 day before. Then we delete everything.
• When you delete the account in the settings, the employees, the memories and the workspace data are erased. You can also ask for deletion at suporte@vereda.bot.
• The sign-up data the BBI keeps (e-mail, contact name, WhatsApp number, IP and browser of the terms acceptance) is anonymized 30 days after the workspace is erased. The tax data (document, legal name, address and the link to the payment) stays for 5 years, as the law requires (LGPD, art. 16, I), and is then erased. A sign-up that never paid and never became a workspace is erased after 90 days.
• The e-mails that reach the company e-mail stay on the mail server and in the workspace record for 30 days after they are handled. After that, we erase the text, the sender and the subject, and the copy on the server.
• Some data may be kept when the law requires it, such as payment records. Data already sent to a processor follows its limited retention.

Security

We take technical and organizational measures to protect personal data, such as separation by workspace and encrypted credentials. No system is fully secure.

Data subject rights

Under Brazil's LGPD (art. 18), you may ask for:

• confirmation that we process your data;
• access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary or processed against the law;
• portability of the data to another provider;
• information about whom we share your data with;
• withdrawal of consent.

To exercise a right, write to suporte@vereda.bot. We answer within the LGPD deadlines.

Contact

BEHEMOTH INTELIGENCIA PARA A MIDIA LTDA (BBI.MEDIA), CNPJ 28.638.470/0001-02 (controller).
Alameda Mamoré, 535, 11º andar, conj. 1110, Alphaville Centro Industrial e Empresarial, Barueri/SP, CEP 06454-040, Brazil.
Data protection officer and support: suporte@vereda.bot