LubiBot Privacy Policy

Effective 20 October 2026. Last updated: 13 November 2026. Versão em português.

1. Who we are

LubiBot (lubi.bot) is a service of AI employees, the "lubis", for small businesses, freelancers and individuals. It is provided by COMAL EDTECH LTDA, CNPJ 69.649.487/0001-34, a Brazilian company headquartered in Itajaí-SC, Brazil ("LubiBot", "we"). We are the controller of the personal data processed in the service. Data protection officer contact (LGPD, art. 41): admin@lubi.bot.

2. Data we process

• Account data: name, email, time zone and any data you provide at sign-up. If you sign in with Google, we receive your name, email and Google account identifier.
• Content you send and what the lubis produce: messages, audio, files, instructions, tasks, routines and deliverables.
• Data from connected services: when you connect a third-party account (for example Google, social networks, stores and other tools you use), we process only the data you authorized on that service's consent screen, and only for the function you requested.
• Website waiting list: name, email, WhatsApp number and company entered in the form on lubi.bot.
• Usage and technical data: access logs, IP address, device, dates and service consumption, for security, operation and billing.

Device calendars, reminders and alarms. We request the corresponding permission when you ask for a function that needs it, not when the app opens. Titles, dates, notes and participants of items you ask us to read may be sent to LubiBot and its AI providers to carry out your request, and become part of the conversation and records described in this policy. On iOS we use the device calendar and Apple Reminders; on Android, the device calendar and Google Tasks for reminders. Alarms use the device system. You can deny or revoke access in system settings and disconnect Google Tasks in LubiBot or your Google account. Other features remain available. Microphone access is requested to record audio, and notifications when enabling alerts or creating an alarm that needs them.

3. How we use data

To provide the service you requested (LGPD art. 7, V), to comply with legal obligations (art. 7, II) and for security and fraud prevention (legitimate interest, art. 7, IX). We do not sell personal data. Your account data, your content and data from connected services are not used for advertising or to train artificial-intelligence models, neither by us nor by the AI model providers we use. On the lubi.bot home page we use the Meta Pixel and the LinkedIn Insight Tag to measure visits and sign-ups coming from ads; they are not used inside the LubiBot service. The campaign source (the link's UTM parameters) is stored with the waitlist sign-up. The Meta Pixel, the LinkedIn Insight Tag and Google Analytics use cookies in your browser for this measurement; you can block or delete them in your browser settings without losing access to the page or the sign-up. The home page also uses Google Analytics to measure visits in aggregate (estimated city and state, and campaign source).

4. Data from Google APIs

What we access.

• Sign in with Google: name, email and Google account identifier, to create and identify your account.
• Google accounts you connect through the LubiBot app (only if you connect and authorize on Google's consent screen; what LubiBot can do depends on the permissions you grant):
  • Google Calendar: view your list of calendars; view, create, update and cancel events; invite guests and, when you choose, notify them; and check your free/busy times to suggest slots.
  • Google Tasks: view your lists and tasks; create, edit, complete, reopen and delete tasks you ask us to manage.
  • Gmail: send the emails you approve. Only if you grant the additional Gmail permissions, also search and read your messages and attachments, write drafts and replies, and organize your inbox: create and apply labels, mark as read or unread, and archive. LubiBot does not permanently delete emails; when you ask and approve, it can move a message to Trash or mark it as spam.
  • Google Drive, Docs, Sheets and Slides: work with the files you pick in the Google file picker or that LubiBot created (read, create, edit and move to Trash); read and edit the documents, spreadsheets and presentations you indicate; and, only if you grant the full Drive permission, search (by file name) and read the other files in your Drive. LubiBot does not permanently delete files.
• Your own Google Cloud app (optional, advanced setup): if you choose to connect a Google Cloud app that you own, the lubis can use the additional permissions you grant to that app, such as Google Ads, Google Analytics and YouTube reports, under the same rules below.

How we use it. Only to do what you ask the lubis, such as reading or sending an email, organizing your calendar or putting together a report. Actions that change data in the connected service, such as sending an email, organizing your inbox or editing a file, only happen after your approval.

How we store it. Access tokens are encrypted in your account's vault and only our server can open them. Content retrieved to fulfil a request stays in your conversation and deliverables, on Google Cloud and Cloudflare servers.

Who we share it with. Only with the providers that run the feature you asked for, and only as needed: Google Cloud (our servers and database, and Model Armor, which screens text written by third parties against prompt injection); Cloudflare (file storage); the providers of the machines where the lubis work (Google Cloud and Hetzner), when the lubi opens a file brought from Google, such as an attachment or a downloaded document; the AI model providers that run the lubis, which we reach through OpenRouter or directly, only to generate the answer; and, when your request needs the web, web search services (such as Yahoo, DuckDuckGo, Bing and Brave Search), which receive the search query, and the websites the lubi opens for you. A search query is sent without your name, email or account identifier, but it can contain words from your content, including Google data, when your request involves it. We do not sell this data or hand it to anyone else. In particular, data from Google APIs is not used for advertising, is not sold or given to data brokers or information resellers, and is not used to determine creditworthiness or for lending.

How we delete it. You can disconnect a Google service in LubiBot (Connectors > the Google service > Disconnect) at any time. Disconnecting deletes the stored credentials from the vault and stops any new access. If it was the last Google service connected with that Google account, LubiBot also revokes the permission at Google; if other Google services stay connected, the permission remains at Google until you disconnect them all or revoke it yourself at myaccount.google.com/permissions. Content already brought into a conversation, a file or a record stays in your account until you close it or ask us to delete it; then section 7 applies. When you close your LubiBot account, we revoke the Google access and delete the connected accounts and the vault. You can also request deletion of your data at admin@lubi.bot. See how to delete your account and data.

Limited Use

LubiBot's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. The use of information received from Google Workspace scopes will adhere to the Google User Data Policy, including the Limited Use requirements. In particular: (a) we use this data only to provide or improve user-facing features; (b) we do not transfer it, except to provide those features with your consent, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets after obtaining your explicit prior consent; (c) we do not use it for advertising; (d) humans do not read it, except with your consent, for security, to comply with the law, or when aggregated and anonymized for internal operations. We do not use data from Google APIs to develop, improve or train AI or machine-learning models (including generalized or foundation models), and the AI model providers we use may not use it for that either.

4A. WhatsApp and Instagram data in the LubiBot CRM

Roles. When your business connects its WhatsApp Business Account or Instagram professional account to LubiBot, your business is the controller of its customers' data and COMAL EDTECH LTDA (LubiBot) acts as a processor, processing that data only to provide the service you requested and on your instructions (LGPD, art. 5, VII, and art. 39). COMAL is the controller of your own LubiBot account data.

What we receive. From WhatsApp: account and phone number identifiers, messages sent and received (text and media), profile name and phone number of contacts who messaged your business, message templates and delivery status. From Instagram: username, account ID and profile picture, media list, Direct messages, comments on your posts, and the posts your business publishes through LubiBot. Access tokens are stored encrypted.

How we use it. Only to display and organize conversations in the CRM, send the replies and notifications and publish the posts your business approves, manage message templates, and keep the service secure. LubiBot's AI features process conversation content only to produce what your business asked for. We do not use this data for advertising, do not sell it, and do not use it to create, train or improve artificial-intelligence models; the AI model providers we use may not use it for that either.

Who we share it with. With Meta (WhatsApp and Instagram), which processes messages under its own terms; with the providers that operate LubiBot, under contract and only to provide the service: Google Cloud (servers and database), Cloudflare (files and media) and the AI model providers that run the lubis, accessed through OpenRouter or directly; and with authorities when required by law. Where data is stored is described in section 6.

Retention. While the account is connected. When you disconnect WhatsApp or Instagram, or close your account, we delete the tokens immediately and messages, contacts and media within 30 days, except what the law requires us to keep (for example, access logs for 6 months, Brazilian Internet Civil Framework, art. 15).

How to request deletion. See the step by step at lubi.bot/en/data-deletion:

1. In LubiBot, go to Connectors, open WhatsApp or Instagram and tap Disconnect.
2. Or email admin@lubi.bot with the subject "Data deletion".

You can also remove LubiBot in Meta's settings (Business Settings > Integrations; on Instagram, Settings > Apps and websites). This cuts our access immediately; to also delete the data already stored, use one of the options above.

End customers of a business that uses LubiBot can ask that business or us; we forward the request to the business and delete according to its instructions.

Your rights. The rights in section 8 (LGPD art. 18) also apply to this data. Data protection officer contact: admin@lubi.bot.

5. Sharing

With the providers that operate the service, under contract and only as needed: Google Cloud (servers, database, sign-in and machines the lubis work on), Cloudflare (files and website), Hetzner (machines the lubis work on), AI model providers (through OpenRouter or directly) and web search providers, Resend (email delivery) and payment processing. Also with services you yourself connected, and with authorities when required by law. Data from Google APIs is shared only as described in section 4.

6. International transfer

The servers, database and files of the service are in Europe: Google Cloud in Belgium (servers, database and the machines where the lubis work), Cloudflare (file storage, in Europe) and Hetzner in Finland (machines where the lubis work). Sign-in (Google Cloud Identity Platform / Firebase Authentication), the AI model providers and the web search providers may process data in other countries, including the United States, to provide the service and generate answers. This transfer happens only to the extent needed to provide the service you signed up for (LGPD art. 33, IX).

7. Retention

We keep data while the account is active. When you close your account, we delete or anonymize the data within 30 days, except what the law requires us to keep, for the legal period. Tokens from connected services stay in the vault until you disconnect the service or close your account.

8. Your rights (LGPD art. 18)

Confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent. Request them at admin@lubi.bot. You can also revoke a connected service's access directly in that service.

9. Security

Encryption in transit, access control and credentials kept in an encrypted vault. No system is 100% secure; in case of a relevant incident we will notify you and the ANPD (Brazilian data protection authority).

10. Minors

The service is not intended for people under 18.

11. Changes

We will notify you by email or in the service before relevant changes to this policy.

12. Contact

COMAL EDTECH LTDA, CNPJ 69.649.487/0001-34, Itajaí-SC, Brazil. Email: admin@lubi.bot.

The Portuguese version is available at lubi.bot/privacidade. In case of conflict, the Portuguese version prevails.