01
Who we are
Grabatus Serviços de Estatística e Matemática Ltda., headquartered in São Paulo, Brazil, is the controller of the personal data processed on grabatus.com, in the API and in the MCP server. In this policy, Grabatus, we and Services refer to that whole.
The Data Protection Officer (DPO) is Rodolpho Macedo, at contato@grabatus.com. This is the channel for any request or question about your data, in any country.
When you upload files containing personal data of third parties, such as your company's customers or employees, you are the controller of that data and Grabatus acts as processor, handling it only according to your instructions.
02
Data we collect
| Category | What it is | Source |
|---|---|---|
| Account | Name, email, avatar and password (stored only as a hash). With social login, the identifier of the Google or GitHub account. | You |
| Files and analyses | The files you upload, the parameters you choose and the results generated. | You |
| Assistant | Conversations with the platform assistant and the business facts you ask it to remember. | You |
| Payment | Plan, billing history and customer identifier at Stripe. We never receive or store the card number. | You and Stripe |
| Communication | Messages sent through contact forms, surveys and community posts. | You |
| Usage and device | IP address, browser type, pages visited and logs of API and MCP calls. | Automatic collection |
We do not ask for sensitive data, such as health, biometrics, racial origin, religion or political opinion, nor identity documents or bank details. Do not upload files with this kind of information; if you need to analyze them, anonymize first.
03
Purposes and legal bases
We process personal data only for the purposes below, each with its basis in the LGPD (Law No. 13,709/2018) and its GDPR equivalent.
| Purpose | LGPD | GDPR |
|---|---|---|
| Create the account and run the analyses you contracted | Performance of contract (art. 7, V) | Contract (art. 6.1.b) |
| Transactional emails, such as analysis completed | Performance of contract (art. 7, V) | Contract (art. 6.1.b) |
| Billing, invoicing and tax obligations | Contract and legal obligation (art. 7, II and V) | Contract and legal obligation (art. 6.1.b and c) |
| Answer messages and support requests | Legitimate interest (art. 7, IX) | Legitimate interest (art. 6.1.f) |
| Security, fraud prevention and auditing | Legitimate interest (art. 7, IX) | Legitimate interest (art. 6.1.f) |
| Usage measurement and advertising | Consent (art. 7, I) | Consent (art. 6.1.a) |
We do not make automated decisions that produce legal effects on you. Model results support your decision; they are not a decision of ours about you.
04
Who we share with
We do not sell or rent personal data. The categories of recipients below receive only what is needed to provide the service, under contract and with a duty of confidentiality.
| Recipient | What for |
|---|---|
| Google Cloud · Amazon Web Services | Storage of files and results, encrypted at rest, and processing of the analyses. |
| Hostinger | Hosting of the application and the database. |
| Stripe | Payment processing. Never receives the content of your files. |
| Anthropic | Language model behind the platform assistant. Receives the conversation messages and the result summaries needed to answer. |
| Google Workspace | Sending transactional emails and customer support. |
| Google Analytics · Microsoft Clarity · Google Ads | Usage and campaign measurement. Loaded only after your consent. |
| Google and GitHub (login) | Authentication, when you choose to sign in with one of these accounts. |
We may also disclose data when required by law or by order of a competent authority, to protect the rights and safety of users, or in the event of a merger, acquisition or sale of assets, in which case you will be notified beforehand.
05
International transfers
Grabatus operates from Brazil and uses providers with infrastructure in other countries, mainly the United States. Your data may therefore be processed outside the country where you live.
These transfers are made with the safeguards provided by law: standard contractual clauses with providers, technical security measures and, where the law requires it, your specific consent. You can ask the DPO for more information about the safeguards.
07
Retention periods
We keep personal data only for as long as each purpose requires. After that, it is deleted or anonymized.
| Type of data | Period | Reason |
|---|---|---|
| User account | While the account exists | Performance of the contract |
| Uploads and results | Until you delete them, or 90 days after the account is cancelled | Performance of the contract |
| Payment history | 5 years after the last transaction | Tax obligation |
| Contact messages | 2 years | Legitimate interest |
| API and MCP audit logs | 90 days | Security |
| OAuth tokens | Access: 1 hour. Refresh: 30 days, rotated on every use | Security |
08
Security
We use encrypted connections (HTTPS), encryption at rest for files, passwords stored only as hashes, per-account access control and audit logs. Internal access to data is restricted to what is needed to operate and provide support.
No system is fully immune to incidents. If a security incident occurs that may bring relevant risk or harm to you, we will notify you and the competent authorities within the periods set by law. On your side, keep your password secret and revoke access you no longer use.
09
Your rights
Wherever you are, you can ask at any time, free of charge:
- Confirmation and access: know whether we process your data and receive a copy.
- Correction: update incomplete, inaccurate or outdated data.
- Deletion: erase your data, except what the law requires us to keep, such as tax records.
- Portability: receive your data in a structured, machine-readable format.
- Objection and restriction: object to processing based on legitimate interest or ask for it to be restricted.
- Withdrawal of consent: withdraw consent for measurement and advertising, without affecting what was done before.
How to exercise them
Write to contato@grabatus.com from your account's email address. We may ask you to confirm your identity before acting. You can also act on your own: delete uploads from the dashboard or through the DELETE /api/v1/{service}/uploads/{id}/ endpoint, and delete the whole account in settings or through the DELETE /api/v1/profiles/me/ endpoint.
Exercising a right never results in worse treatment, a different price or loss of access to the service. The following sections detail what each law adds.
10
Brazil · LGPD
If you are in Brazil, the General Data Protection Law (Law No. 13,709/2018) applies. In addition to the rights above, art. 18 guarantees anonymization or blocking of unnecessary data, information about who we share your data with, and information about the possibility of not consenting and the consequences of that.
- We respond to requests within 15 days.
- The DPO (art. 41) is the channel between you, Grabatus and the National Data Protection Authority (ANPD).
- If you believe your request was not addressed, you can complain to the ANPD at gov.br/anpd or to consumer protection bodies.
11
European Union and United Kingdom · GDPR
If you are in the European Economic Area, the United Kingdom or Switzerland, Regulation (EU) 2016/679 (GDPR) and the equivalent local laws apply. Grabatus is the controller and the legal bases for each processing activity are in section 3.
- You have the rights in arts. 15 to 22: access, rectification, erasure, restriction, portability, objection and the right not to be subject to solely automated decisions.
- We respond within one month, extendable by two more in complex cases, with prior notice.
- Transfers outside the European Economic Area use the standard contractual clauses approved by the European Commission or another valid mechanism.
- You can lodge a complaint with the data protection authority of the country where you live or work, without prejudice to talking to us first.
12
United States · CCPA and state laws
If you live in California or another state with a consumer privacy law, such as Virginia, Colorado, Connecticut, Utah and Texas, we offer the rights below even when the law does not require us to.
- Know, correct and delete: know the categories and the specific data we collect, where it came from, what we use it for and who we share it with, correct it and delete it.
- Sale and sharing: we do not sell personal data. Advertising tools are loaded only with your acceptance; declining in the cookie notice is equivalent to opting out of having your data sold or shared for behavioral advertising.
- Sensitive data: we do not collect or use sensitive personal information to infer characteristics about you.
- Non-discrimination: you do not receive a different service or price for exercising your rights.
- Authorized agent and appeal: an agent can make the request on your behalf, with written authorization. If we deny a request, you can appeal by replying to the same email and, if the denial is upheld, contact your state's attorney general.
We respond within 45 days. In the last 12 months we collected the categories described in section 2: identifiers, commercial information, internet activity and the content you upload. The purposes are in section 3 and the recipients in section 4.
13
China · PIPL
If you are in mainland China, the Personal Information Protection Law (PIPL) applies. We process your information based on your consent and on what is necessary to perform the contract with you.
- Processing outside China: Grabatus does not keep servers in mainland China. Your data is sent to Brazil and to the countries of the providers in section 4, and processed for the purposes in section 3. By creating an account and using the Services, you specifically consent to this transfer; without it we cannot provide the service.
- Your rights: know about and decide on the processing, restrict or refuse it, consult and copy your data, transfer it, correct it, delete it, withdraw consent and ask for an explanation of these rules.
- Sensitive information and minors: we do not ask for sensitive personal information and do not knowingly process data of minors under 14.
- Contact: requests are handled by the DPO, at contato@grabatus.com.
14
MCP connectors and AI assistants
When you connect Grabatus to a third-party AI client, such as Claude.ai or ChatGPT, through our MCP server, the rules below apply in addition to the rest of this policy.
Categories of data
- Account identifier (email) linked to the OAuth authorization.
- Files you choose to send through the connector.
- Analysis parameters provided by you.
Purposes
Exclusively to run the analysis you asked for. The content of your files is not used to train models, build profiles, show ads or for any other purpose.
Categories of recipients
- Google Cloud Storage and Amazon S3, with storage encrypted at rest.
- Stripe, for billing only. Never receives the content of the files.
- The AI client that started the OAuth authorization, which receives only the result of the requested analysis.
Retention periods
- OAuth access tokens: 1 hour. Refresh tokens: 30 days, rotated on every use.
- Uploaded files and results: until you delete them, or 90 days after the subscription is cancelled.
- Audit logs of MCP calls, without file content: 90 days.
Your controls
- Revoke any connector at any time in authorized applications.
- Delete any upload from the dashboard or through the
DELETE /api/v1/{service}/uploads/{id}/endpoint. - Request full deletion of the account at contato@grabatus.com.
Through the connectors we never collect payment card data, health information, identity document numbers, passwords or authentication codes. What the AI client does with the answers it receives follows its own privacy policy.
15
Minors
The Services are aimed at companies and professionals and are not intended for anyone under 18. We do not knowingly collect data from children and teenagers. If you believe a minor has given us data, let us know and we will delete it.
16
Changes and contact
We may update this policy to reflect changes in the Services or in the law. The date at the top indicates the version in force. Relevant changes are announced by email or on the platform before they take effect, and when the law requires it we will ask for new consent.
This policy is part of the Terms of Service. Questions, requests and complaints: contato@grabatus.com or the contact page.
In case of any discrepancy between translations, the Portuguese version prevails.