Privacy policy

In a few lines, here is what this policy says:

• BotHub is operated by SYSMJM TECNOLOGIA LTDA, which is responsible for your account data.
• To create an account, we ask only for your name, email address and password, or we use your Google sign-in. Your name and email address are needed to create and use the account: without them, we cannot provide the service. We do not ask for your CPF (Brazilian individual taxpayer number), CNPJ (Brazilian company registration number), phone number or address.
• The data you put into automations, such as spreadsheets, credentials kept in the vault and data about customers, suppliers or employees, belongs to your company. We use it only to run the tasks you set up, provide support, protect the service and comply with the law.
• To operate, we rely on providers such as Stripe (payments), Google (sign-in), Cloudflare (protection of the website, the dashboard and the API) and artificial intelligence services used by some automations. Several of them are outside Brazil.
• The website chat uses OpenAI to generate its replies.
• We do not sell personal data, and we do not use advertising or audience analytics tools.
• Passwords and keys kept in the vault are encrypted (coded, unreadable without the key). No system is infallible, so here we explain what we actually do, including the limits.
• Each type of data has a retention period, explained in How long we keep data. Some of them do not have automatic deletion yet, and some records, such as billing records, are kept even after the account is deleted, because the law requires it.
• You can ask to access, correct, get a copy of or delete your data by writing to [email protected]. We reply within 15 days.

The full text follows. If anything is unclear, write to [email protected].

This policy explains how BotHub processes personal data under the LGPD (Lei Geral de Proteção de Dados Pessoais, Brazil's General Data Protection Law, Law No. 13,709/2018) and the Marco Civil da Internet (Brazil's Internet Civil Rights Framework, Law No. 12,965/2014).

BotHub is an automation platform: robots that carry out routines on websites and systems on the customer's behalf. The service is provided by SYSMJM TECNOLOGIA LTDA, a Brazilian company registered under CNPJ 56.989.396/0001-04.

Questions and requests about personal data go to the privacy channel: [email protected]. This is the channel we use to communicate with data subjects (the people the data is about) and with the ANPD (Agência Nacional de Proteção de Dados, Brazil's National Data Protection Agency).

This English version is provided for convenience. If it differs from the Portuguese version, the Portuguese version prevails.

Read the Terms of use

The LGPD distinguishes between whoever decides about the data (the controller) and whoever processes data on behalf of another company, following its instructions (the processor). BotHub plays both roles, depending on the data:

• Controller: for the data of your account, billing, acceptance of the terms, technical and security logs, support and partner applications. For this data, we decide how it is used and we are accountable for it.
• Processor: for the data you put into automations, such as task inputs, spreadsheets, vault values, verification codes, results and run history. For this data, your company is the controller, and we process it only to carry out what you set up.

When you create and use your account, we process:

• through the sign-up form: your name, email address and password. The password is stored as a hash, a transformation that does not allow the original text to be recovered;
• through Google sign-in: your first and last name, email address, your Google account identifier, the web address of your profile picture and the fact that Google has verified your email address. We have no access to your Gmail, your Drive or any other data in your Google account;
• the confirmation of your email address, with the date it happened;
• the record of your acceptance at sign-up: the version of the documents accepted, the date, the time and the IP address (the number that identifies an internet connection) from which you accepted;
• your account profile, how you signed up (form or Google) and, if you arrived through an automation in the website's catalog, which one;
• the API tokens (access keys) you create. The API is the interface that connects other systems to BotHub;
• service usage data: how many runs you have made and how many of them were counted runs, your free trial balance and your use of resources billed separately, such as artificial intelligence and captcha solving.

Your name and email address are needed to create and use the account. We do not ask for your CPF, CNPJ, phone number, address or date of birth to create an account.

You can correct your name, email address and password in your profile, in the dashboard.

Payments are processed by Stripe. When your account is created, even if you only use the free trial, Stripe receives your name and email address to open the customer record used for billing.

Card details are entered directly on Stripe's payment page and do not pass through our servers. We do not store your card number.

We receive from Stripe what we need to manage your subscription, such as the status of payments and invoices, and we keep the notifications it sends us about these events. We send Stripe each month's usage (counted runs, extra features and the plan minimum), so the charge can be calculated.

At present, a change of name or email address in your profile does not reach Stripe on its own. If you change them, let us know through [email protected] and we will update your Stripe customer record too, so invoices and payment notices go to the right address.

To run automations, we process what you send or set up, through the dashboard or the API:

• the input data of each task and the automations you create or configure;
• the spreadsheets you upload to run an automation in bulk, and your schedules, with the data of each one;
• the passwords, keys, digital certificates and other credentials you keep in the vault, so the robot can sign in to websites and systems on your behalf;
• verification codes, such as those received by text message or generated by an authenticator app, that you enter to unblock a task;
• the result of each run, which may include data and files obtained from the websites accessed, and the history of its steps, with error messages;
• the addresses you provide to receive results in another system (webhooks), with the headers you configure (technical information sent along with the result, such as an access key for your system), and a record of each delivery attempt and of the response received;
• a record of when your own robot is connected, if you use a robot installed on your computer.

This data is used only to run the routines you set up, show the results, deliver them to the addresses you provide, investigate errors, provide support, protect the service and comply with the law.

Knowing the path your data takes helps you understand the safeguards and the risks. In a typical task:

• the input data is stored encrypted in the main tasks table of our database and goes in readable form through a processing queue to a robot;
• the robot runs on dedicated computers operated by BotHub, located in Brazil, which open the websites in a browser. To fill in the websites, it needs the data in readable form. Vault values are decrypted only at that point, in the step that uses each value;
• the robot's browser keeps cookies and sessions from the websites it visits between one run and the next, like an ordinary browser;
• files downloaded during the task stay on the robot's computer only until the end of the run or the start of the next one. The log of what the robot received, did and returned, including the task's input data, is kept on that computer, to investigate errors;
• when the task uses a digital certificate, the robot installs it on the computer so the browser can use it, and at present it remains installed there after the task;
• when the automation saves a file in the result (for example, a PDF or a spreadsheet downloaded from a portal), the file goes to a file storage service and is delivered through a link. This link does not require signing in and does not expire, so treat it as confidential and share it only with people who need it;
• some automations use artificial intelligence, captcha or network (proxy) services, described further below;
• finally, the result returns to our database and is sent to the addresses you provided.

If you use your own robot, installed on your computer, your task data passes through that computer, and the security of that computer and your network is your responsibility.

To protect your account and the service, we log security events with the IP address, date, time and what happened, such as a failed sign-in attempt, a rejected sign-up or a blocked request. When the attempt uses an email address that has no account, the log keeps that email address.

We also use the IP address to limit the number of sign-in and sign-up attempts. Each count lasts from a few minutes to one day.

The free trial is available once per email address. For this, we keep a standardized form of the email address used for the trial (in lowercase, without the part after a plus sign and, for Gmail, without the dots), which recognizes variations of the same address.

Technical system errors are also logged and may include the IP address and the error messages from tasks.

We use your account email address for messages about the service: email confirmation, a welcome message with links to the documents you accepted, usage notices for the free trial, declined payments and automations that ended with an error. These messages are part of the service and do not depend on consent. You can turn the notice about automations that ended with an error on or off under My account, in your dashboard.

We record which notices have already been sent to each account, without their content, so we do not repeat the same message.

When you write to [email protected] or [email protected], we keep your message, your email address and whatever is needed to reply and keep a record of the support conversation.

We do not currently send marketing emails. If we start, it will be only with your consent and with an easy way to unsubscribe.

If you apply to the partner program on the website, we keep what you fill in on the form (name, company, email address, phone number, type of partnership, website and message), the language of the page, the date you ticked the confirmation box, your IP address and the browser you used.

We use this data to review your application, reply to you and, if the partnership goes ahead, stay in touch.

The website has a support chat in which an artificial intelligence answers your questions based on the content of the website and the BotHub documentation. If it cannot answer, or if you would rather talk to a person, you can leave your contact details in a form, and our team will reply.

The messages you write are sent to OpenAI (United States), which provides the artificial intelligence model, only to generate the replies. Before they are sent, passages that look like a password, a card number or a CPF are hidden. OpenAI also receives a code generated from your IP address, which does not reveal the IP address, only to identify abuse.

We keep in our database the messages of the conversation (with those passages hidden), the browser you used and that same code, to reply, continue helping you and prevent abuse.

If you use the contact form, we keep your name, the email address or WhatsApp number you provide, your question, the reason for the contact, the page and language you were on, the date you ticked the agreement box, your browser and the same code. Your question and the conversation with the assistant are sent by email to our team.

In your browser, the conversation is kept for up to 24 hours so you can pick up where you left off, as explained in the Cookies section.

Do not write passwords, verification codes, card details or other people's personal data in the chat. The chat does not need them to help, and automation credentials have their own place: the vault in the dashboard.

Artificial intelligence replies may contain mistakes. For important decisions, confirm with our team at [email protected].

The LGPD only allows personal data to be processed on a legal basis, that is, a reason provided for in the law (art. 7). These are our uses and the basis for each one:

• Creating and maintaining your account, giving you access to the dashboard, running automations, delivering results, billing, sending service emails and providing support. Legal basis: performance of the contract with you (art. 7, V).
• Reviewing partner applications and replying. Legal basis: conversations before entering into a contract, held at your request (preliminary steps, art. 7, V).
• Answering your questions in the support chat and the contact request you leave there. Legal basis: performance of the contract, or conversations before entering into a contract, held at your request (art. 7, V).
• Keeping BotHub's billing and accounting records and responding to requests from authorities as provided by law. Legal basis: compliance with a legal obligation (art. 7, II).
• Keeping proof of acceptance of the terms and using service records to defend rights, including in legal proceedings. Legal basis: regular exercise of rights (art. 7, VI), that is, keeping evidence for use in a possible dispute.
• Protecting your account and the service against fraud, abuse and attacks, with security logs, limits on attempts and the control of one free trial per email address. Legal basis: legitimate interest (art. 7, IX), that is, an interest of ours that the law accepts when it respects your rights. We use only what this protection requires, which also benefits you, and you can object through the privacy channel.

For your task data, the legal basis is defined by your company, as the controller. We follow its instructions, given through the configuration of the automations and the Terms of use.

At present, none of the uses described here depends on your consent. If any of them comes to depend on it, we will ask first, separately, and you can withdraw consent whenever you want. Reading this policy is not giving consent: it only explains how we process data.

To be clear:

• We do not sell or rent personal data.
• We do not use advertising tools, ad pixels or audience analytics tools on the website or in the dashboard.
• We do not use your task data for our own purposes, such as advertising, behavioral profiling or sale to third parties.
• We do not ask for sensitive data, such as health data, biometrics, religion or racial origin, for our own use.
• We do not access your email, your cloud files or any other data in your Google account beyond what is listed in this policy.

Tasks often carry other people's data, such as the name, email address, phone number, CPF or address of your company's customers, suppliers or employees, in an order, a spreadsheet, a registration record or a document downloaded from a portal.

For this data, your company is the controller and BotHub is the processor. Your company is responsible for:

• having a legal basis to use this data and informing the people it refers to;
• being authorized to use the credentials and accounts it keeps in the vault;
• including sensitive data or data about children and adolescents only when it is essential to the routine and there is a legal basis for it (LGPD, arts. 11 and 14);
• handling requests from the data subjects.

For our part, we process this data only to run the tasks, confidentially, and we help your company respond to data subjects and assess incidents, as far as we are able. The full rules for this processing are in the Terms of use.

If you are not our customer but your data appeared in a task run by a company that uses BotHub, that company makes the decisions about your data, and the best route is to contact it directly. If you write to [email protected], we will, whenever possible, tell you which company is responsible and forward your request to it. We do not delete or hand over this data without the company's instructions, except when the law requires it.

Some automations use external services in specific steps:

• artificial intelligence (currently Google Gemini): reads and interprets text, images and documents, such as a PDF, to extract information, and helps solve captchas. It receives what the step sends: the document or text specified in the automation or, to solve a captcha, an image of the robot computer's entire screen, which may briefly show windows of other tasks that are running;
• captcha solving (currently 2Captcha): a captcha is the "I'm not a robot" test on some websites. The service receives the image of the challenge;
• connection network, or proxy (currently PyProxy): some automations access websites through a Brazilian internet address, and the traffic of those tasks passes through this provider. On websites with HTTPS (the ones that show a padlock next to the address in your browser), the content remains encrypted, and the provider sees the addresses accessed and technical connection data.

We have not yet confirmed that the artificial intelligence plan we use prevents the provider from using the data sent to train or improve its models.

When an automation uses a key from your own account with one of these services, the processing in that service is governed by the contract between your company and the provider.

Artificial intelligence can make mistakes. Check the results of the steps that use it, especially in the first runs.

BotHub does not use tasks to assess people on its own account. The robot does what your company set up. If an automation makes decisions about people, your company, as the controller, is responsible for them, including for requests for review (LGPD, art. 20).

Some of BotHub's security checks are automatic and may reject a sign-up, a sign-in or the free trial, for example when there are many attempts from the same IP address or when the email address has already used the trial. If this happens to you and it looks like a mistake, ask through [email protected] for a review by a person. We explain the criteria used, without the details that would make fraud easier.

To provide the service, we rely on providers. Most of them process data only on our behalf and only for their own role. Some, such as Stripe and Google, also process part of this data as controllers in their own right, under their own policies. In the Terms of use, the providers that process task data are called sub-processors. This list applies to the version of this policy shown at the top of the page:

• Payments: Stripe (United States). Receives your name and email address from sign-up, processes charges and stores card details. Stripe also uses payment data to prevent fraud, under its own privacy policy.
• Sign-in and fonts: Google (United States). Confirms your identity when you sign in with your Google account and delivers the text fonts of the website and the dashboard (Google Fonts), receiving your browser's IP address to do so.
• Protection and delivery: Cloudflare (United States). Sits in front of the website, the dashboard and the API to block attacks and deliver the pages. As a result, the traffic between your browser and BotHub, including what you type in the dashboard, passes through it.
• Hosting: a cloud provider in Brazil, which runs the servers for the dashboard and the API, the database and the processing queues.
• File storage: Amazon Web Services (United States). Stores the files that some automations save in the result and delivers them through a link.
• Email: Hostinger, which sends the service emails and hosts the inboxes of our addresses, where support messages and privacy requests arrive.
• Automation emails: an email delivery service, which sends the emails some automations send, with their attachments.
• Artificial intelligence: Google (United States), through Gemini, in the automations that use this step.
• Captcha: 2Captcha, in the automations that use this step.
• Proxy: PyProxy, in the automations that access websites through this network.
• Support chat: OpenAI (United States), which generates the chat replies.

Results you ask us to deliver to other systems go to the addresses you provided, on your instructions.

Within BotHub, only authorized team members access customer data, and only when necessary for support, security and maintenance.

We also share data when required by law, a court order or an authority with legal power to request it, and only what is requested.

If the service comes to be provided by another company, for example through a sale or a reorganization, we will notify you in advance at your account email address, and you may close your account if you disagree.

Several of these providers are located outside Brazil, mainly in the United States, or store data on servers abroad. As a result, part of your data is transferred to other countries, to provide the service you signed up for. Each provider's country is shown in the list above.

These transfers follow the LGPD (art. 33). For your account data, they rely on the transfer being necessary to perform the contract with you (art. 33, IX) or on the standard contractual clauses approved by the ANPD, an official contract model to protect data sent abroad, when the provider's contract includes them. For your task data, which usually belongs to other people, the appropriate mechanism is the ANPD standard contractual clauses in each provider's contract, and we are still checking, provider by provider, whether they are included.

For countries the ANPD recognizes as adequate (countries that protect data to a standard equivalent to Brazil's), that recognition applies.

You can ask through [email protected] for more information about a transfer, including the full text of the clauses used. We reply within 15 days.

For your task data, your company, as the controller, is also responsible for the transfers. We provide whatever information it needs, including the list of providers and countries.

These are the measures in place today:

• an encrypted connection (HTTPS) between your browser and BotHub;
• passwords stored as a hash, never as plain text;
• vault values encrypted with AES-256. They are not shown on screen again once saved. The key that decrypts them belongs to the platform, not to each account, and is kept on our servers and on the robots' computers, with restricted access. The robot decrypts each value only in the task step that uses it;
• task input data stored encrypted in the main tasks table of the database;
• limits on sign-in and sign-up attempts, and security logs to investigate abuse;
• in the dashboard, each account sees only its own data, and team access is restricted to authorized people;
• for those who integrate through the API, an optional encryption key specific to the account, to encrypt values in your system before sending them. We keep this key so the robot can use it at run time, so it is an extra layer of protection, not a barrier to our technical access.

It is also important to know the limits. To run the task, the input data is readable in the processing queue, in the record of tasks that failed in the queue and in the logs on the robot's computer. Spreadsheets (including the copy of each row's data), schedules, verification codes, results and delivery headers are stored without this encryption, with access limited to your account in the dashboard and to the authorized team. No system is completely immune to failures.

You also help protect your account: use a strong password that is yours alone, do not share access to the dashboard and change the passwords kept in the vault if you suspect a problem.

If a security incident involving personal data occurs, we act to contain it and assess the risks.

When an incident may cause significant risk or harm to data subjects, we notify the people affected (at the account email address, when they are our customers) and report it to the ANPD within the deadlines set by regulation.

When the incident involves your task data, we notify your company without delay, with what we know (what happened, which data, how many people and what we did), so it can make the notifications that fall to the controller.

These are the retention periods for each type of data. When the law requires a longer period, the legal period applies:

• Account data: for as long as the account exists. After deletion, we delete or anonymize this data (remove what identifies the person), except what must be kept for the reasons listed below.
• Vault and schedules: for as long as the account exists. They are deleted from our database along with it.
• Digital certificates installed on the robots' computers: at present they remain installed after the tasks and are not removed automatically when the account is deleted. If you ask, our team removes them.
• Run data (inputs, results, step history, spreadsheets, verification codes and delivery records): for as long as the account exists, so you can look it up and we can investigate errors. At present there is no automatic deletion after a set period.
• Files saved by automations in file storage: at present they are not deleted automatically, and the link keeps working. Download and keep whatever you need.
• Logs on the robots' computers (what the robot received, did and returned in each task): at present they are kept with no automatic deletion period, to investigate errors. They are not separated by customer.
• Security and technical error logs: used to protect the service and investigate abuse. At present they have no fixed automatic deletion period.
• Record of acceptance of the terms: for as long as the account exists and, after the contract ends, for up to 5 years, which is the period set by the CDC (Código de Defesa do Consumidor, Brazil's Consumer Protection Code) for claims about the service, only to defend rights.
• BotHub's billing and accounting records: for at least the period set by tax and accounting law, generally 5 years, even after the account is deleted. Stripe keeps its own data under its own policy.
• Free trial control (the standardized email address): kept even after the account is deleted, only to prevent the trial from being repeated. At present it has no automatic deletion period.
• Partner applications: during the review and, after the reply, to keep in touch about the partnership or to record the reply. At present they have no automatic deletion period.
• Support messages: for the duration of the support conversation and afterwards, to keep a record of it. At present they have no automatic deletion period.
• Chat conversations and contact requests: used to continue helping you and prevent abuse. At present they have no automatic deletion period.

At present, account deletion is handled by our team, on request. The team deletes the account data, the run data in the database and the account's task files in file storage, except what the law requires us to keep and the records listed above that remain after deletion. The logs on the robots' computers are not separated by customer, so we cannot delete them on request: they follow the period shown above.

You can ask us to delete your account at any time through [email protected], writing from your account email address. Before that, download the results you need: BotHub is not a permanent archive of your documents.

Under the LGPD (art. 18), you, as the data subject, can:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data (you can change your name, email address and password in your profile);
• request anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law;
• request portability, that is, a copy of your data in a format another provider can use;
• request deletion of data processed on the basis of your consent, where there is any;
• know which companies we share your data with;
• know that you may refuse consent and what happens if you do, and withdraw consent you have already given;
• object to processing carried out without consent when it does not comply with the law;
• request a review, by a person, of a decision made solely by automated means that affects your interests.

To exercise these rights, write to [email protected] from your account email address. This is free of charge. We may ask you to confirm your identity before acting on a request, to protect your data.

We reply within 15 days. If we cannot fulfill a request, for example because the law requires us to keep the data, we explain why.

At present, account deletion and copies of data are handled by our team, based on your request to [email protected]. To remove a credential from the vault, write to [email protected], as explained in the Terms of use.

You can also file a complaint with the ANPD and with consumer protection bodies, such as Procon (the consumer protection agencies of Brazilian states and cities).

Cookies are small files a website stores in your browser.

On the public website, BotHub does not set its own cookies and does not use audience analytics or advertising tools. Cloudflare, which protects the website, may set its own technical cookies to tell human visitors apart from bots. Fonts come from Google Fonts, which receives your browser's IP address to deliver them.

In the website chat, the conversation is kept in your browser (in local storage, a space similar to a cookie) for up to 24 hours, so you can pick up where you left off.

In the dashboard, where you sign in to your account, we use:

• a session cookie, needed to keep you signed in. It expires when you close your browser or after a period of inactivity;
• the cookie for the "Lembrar-me" ("Remember me") option, set when that box is ticked at sign-in (it is ticked by default). It keeps you signed in even after you close your browser, until you sign out, and may last more than a year. If you do not want it, untick the box when signing in;
• on the automation creation screens, a cookie that keeps the fields you typed in "Gerar teste" ("Generate test") for 30 days, to fill in the form next time;
• on some screens, parts of the page (programs and videos) loaded from other companies' services, such as YouTube, which receive your browser's IP address and, in YouTube's case, may set their own cookies.

BotHub's cookies are not used for advertising. If you block cookies in your browser, you will not be able to sign in to the dashboard.

BotHub is a tool for businesses, intended for people aged 18 or over. The service is not directed at children or adolescents, and we do not address any communication to them.

If we learn that an account belongs to someone under 18, we close the account and delete the data, except what the law requires us to keep.

Data about children and adolescents that appears in a customer's tasks is the responsibility of the customer company, as the controller.

When this policy changes, we publish the new version on this page, with its number and date at the top.

Significant changes, such as a new use of data or a new type of provider, are announced at your account email address before they take effect, with a summary of what changed.