Skip to content

Legal · official document

Privacy Policy

Last updated: October 11, 2026

1. Who We Are

ValorBrain is a product of Valor Digital, headquartered in Brazil. This policy covers how we process personal and organizational data.

2. Data Collected

Account

  • Name, email (Google OAuth or manual signup)
  • Password (bcrypt hash, never plaintext)
  • Company settings (name, address, etc., when provided)
  • Avatar (Google profile, optional)

Ingested content

  • Markdown indexed via watcher
  • Documents via webhook ingest
  • Memories via MCP store tool
  • OAuth connectors (Notion, Drive, etc — when activated)

Usage and operations

  • Transaction logs (billing audit trail)
  • MCP token usage (last_used_at, use_count)
  • Activity feed (handoffs between agents, etc.)

3. How We Use Data

  • Service operation (retrieval, billing, audit)
  • Cross-agent coherence (sharing context across your own agents)
  • Service improvement (anonymized when possible)
  • Transaction and security notifications

4. Multi-Tenant Isolation

Your data is isolated per tenant via Postgres Row-Level Security (RLS). Other tenants cannot view, query or modify your information. The engine runs as role valorbrain_app with permissive tenant-scoped policies enforced by the database.

5. Sharing

We do not sell or hand over your data. Third parties enter the path only when the service needs them, and every one is listed — with what it receives and where it sits — under Subprocessors. In short: the network edge (Cloudflare), the language model that writes the answers, the payment processor, the transactional mail server, and the connectors you authorize yourself. We also hand over data when required by Brazilian law or a valid court order.

6. Where the data sits, and the one exception

Storage: your documents, the vectors built from them and the Postgres database sit on our own hardware in Santa Catarina, Brazil. Embedding, reranking and named-entity recognition (NER) run on that machine's GPU.

The exception: language-model processing happens in the cloud, outside the country. Each answered question sends the model the question and the retrieved passages; a search sends the query text, which the model rewrites (expansion); and stored content goes through the model in automatic background tasks (extraction of entities and observations, consolidation, summaries). That is an international data transfer, it is declared in the DPA, and the subprocessors are named.

If you cannot have that exception, run all of ValorBrain in your own environment (on-prem) under an Enterprise contract. Then no step leaves your perimeter.

7. Retention

  • Active data: as long as the account exists
  • After a deletion request: up to 30 days to erase content and vectors
  • Backups: 14-day rotation, so a copy survives at most that long
  • Access record: kept while the account exists, exportable at any time

8. Your Rights (LGPD)

  • Data access (Settings → Audit Logs)
  • Correction
  • Deletion (Settings → Profile → Delete)
  • Portability (JSON export via API)
  • Consent revocation
  • Complaint to ANPD (Brazil's data protection authority)

9. Security

  • HTTPS required (TLS 1.3)
  • Passwords: bcrypt (cost 10)
  • MCP tokens: SHA-256 hash in DB, raw shown only once
  • JWT signed (HS256, 7-day max)
  • Postgres RLS active, enforced by the database
  • Daily database backup, kept 14 days, inside the same physical perimeter

The detail, including what we do not have yet, is under Security.

10. Cookies

We use only essential cookies (auth). No advertising tracking.

To measure the funnel, we count site visits and sign-ups inside our own product, with no cookies and no third-party trackers. We record the landing page, the campaign tags (utm and ref) and the domain of the site that referred the visit, never the visitor's IP address or identifiers. When a visit ends in a sign-up, that origin is linked to the account created.

11. Children

The service is not intended for users under 18.

12. Contact and DPO

To exercise your data rights or for privacy questions: valorbrain@valor.digital Data Protection Officer (DPO): Gustavo Iucksh Santos