Privacy Policy
This Policy explains how Lab019 processes your personal data when you use our AI agent platform — chat, voice and access via web or API. We write plainly and follow Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD").
This English text is provided for convenience. The Portuguese version prevails in case of any conflict, and LGPD governs.
1.Who is the controller
The controller of your personal data is INDRA CONSULTORIA EMPRESARIAL LTDA, trading as Lab019, enrolled under Brazilian company registry (CNPJ) No. 04.022.591/0001-59, headquartered in Campinas, São Paulo, Brazil.
The "controller" is the party that decides how and why your data is processed. To exercise rights or ask privacy questions, contact our Data Protection Officer via the channel in section 13.
2.What data we collect
We collect only what is needed to create your account and run the service:
Data you provide
- Sign-up: email and password (stored only as a hash, never in plain text). When you create the account, we also record your acceptance of the Terms of Use and this Policy (date, time, document versions, IP address and browser identifier) to prove consent/contract, as the LGPD requires.
- Interaction content: the text messages and voice-call audio you exchange with the agent, plus the transcripts generated.
- Configuration: agent preferences, connected tools and, if you use BYOK ("bring your own key"), the AI-provider credentials you register.
- Support: what you send us when asking for help.
Data collected automatically
- Usage and telemetry: access logs (date, time, IP, browser/device), message volume, voice minutes, models invoked and error events — used to operate, bill and protect the service.
- Consumption metering: language tokens and audio seconds (STT/TTS) per conversation, to bill your plan and credits.
Payment data
Subscriptions and top-ups are processed by Stripe. Your card data is handled directly by Stripe — we do not store your card number. We keep only transaction identifiers and subscription status to manage your account.
3.Purposes and legal bases
Every processing activity has a purpose and a legal basis under LGPD art. 7. The main ones:
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Create and maintain your account; provide chat and voice | Sign-up, interaction content, configuration | Performance of a contract (art. 7, V) |
| Bill the plan, manage credits and invoicing | Consumption metering, payment data | Performance of a contract (art. 7, V) |
| Security, fraud/abuse prevention, access logs | Usage and telemetry, IP | Legitimate interest (art. 7, IX) and legal obligation (art. 7, II) |
| Comply with legal and regulatory duties (e.g. tax) | Sign-up, transaction data | Legal obligation (art. 7, II) |
| Improve the product (aggregate metrics, bug fixing) | Usage and telemetry | Legitimate interest (art. 7, IX) |
| Marketing communications (news, offers) | Consent (art. 7, I) — optional and revocable |
Where the basis is consent, you may withdraw it at any time without affecting the lawfulness of processing carried out beforehand. Withdrawing marketing consent does not cancel your account or the contracted service.
4.Conversation content and AI models
The platform routes your messages to AI models from different providers (for example, Sabiá/Maritaca, Claude/Anthropic, Gemini/Google and GPT/OpenAI) to generate responses. To do so, the necessary content is transmitted to the provider of the model you (or your configuration) choose.
- We use your conversation content to respond to you and operate the product (including conversation memory and any tools you invoke).
- We do not use your conversation content to train AI models, our own or third parties', and we configure our providers not to retain that content beyond what is needed to process the request, where the provider offers that option.
- In BYOK mode, when you use your own key with a provider, that provider's processing is also governed by its terms and privacy policy.
- Voice calls pass through speech-to-text (STT) and text-to-speech (TTS) services to convert audio to text and back.
6.International transfers
Some processors above are located outside Brazil (for example, in the United States or the European Union). In those cases, the international transfer relies on the grounds of LGPD art. 33 and is backed by adequate contractual data-protection safeguards.
7.How long we keep data
We keep your data only as long as needed for the purposes above or to comply with legal duties:
- Account and conversation content: while your account is active. After closure, we delete or anonymize within a reasonable period, unless a legal retention duty applies.
- Terms/Policy acceptance record: kept for the duration of the relationship and applicable limitation periods, as proof of consent/contract.
- Tax and payment data: for the periods required by law (generally up to 5 years or more, depending on the applicable rule).
- Access logs: for the period set by Brazil's Internet Civil Framework and for security.
8.Your rights
As a data subject, the LGPD (art. 18) grants you the right to:
- confirm the existence of processing and access your data;
- correct incomplete, inaccurate or outdated data;
- request anonymization, blocking or deletion of unnecessary or non-compliant data;
- request portability to another provider;
- request deletion of data processed based on your consent;
- obtain information about who we share your data with;
- withdraw consent; and
- object to processing based on legitimate interest.
To exercise any right, write to privacidade@lab019.ai. We may need to verify your identity first. We respond within LGPD timeframes.
9.Security
We apply technical and organizational measures to protect your data, such as encryption in transit, access control, per-tenant segregation, password hashing and audit logs. Your BYOK keys are handled by a secrets vault and are never shown back in plain text. No system is 100% immune; in the event of a relevant security incident, we will notify data subjects and the ANPD as required by law.
11.Children
The platform is intended for adults (18+) and professional/business use. We do not knowingly collect children's data. If we identify such processing without an adequate legal basis, we will delete the data.
12.Changes to this Policy
We may update this Policy. When a change is material, we will notify you by email or within the product. The current version is always identified at the top of this page by its version date. Continued use after an update means awareness of the new version.
13.Contact and DPO
For privacy questions or to exercise your rights, contact our Data Protection Officer (DPO):
- Email: privacidade@lab019.ai
- Controller: INDRA CONSULTORIA EMPRESARIAL LTDA (Lab019) — CNPJ 04.022.591/0001-59, Campinas/SP, Brazil
You may also lodge a complaint with Brazil's National Data Protection Authority (ANPD).