Privacy Policy

The data controller is COSMOBOTS DESENVOLVIMENTO DE SISTEMAS LTDA, CNPJ 31.415.500/0001-18, at Alameda Tietê, 471, apto. 82, Cerqueira César, São Paulo/SP, CEP 01417-020.

The data-protection officer (encarregado) under LGPD art. 41 is Rafael Pettersen Caixeta. Reach the officer at privacidade@alltherest.world.

• Account: name, email and a password stored only as an argon2id hash. If you sign in with Google or GitHub, we receive your name, email and that provider's identifier.
• Organization: name, members, roles and invitations.
• Work content: projects, goals, tasks, conversations with the agents, uploaded files and your knowledge base.
• Credentials for systems you connect, stored encrypted.
• Data inside the apps installed for you: it lives on your organization's server. We operate the app; we do not use that content for anything else.
• Technical records: IP address, browser, access times and administrative actions.
• Application errors, including the failing code frame, received by an error tracker we host on our own servers.
• AI usage and cost per organization, for plan limits and billing.
• Billing: the payer's CPF or CNPJ, the plans and add-ons contracted, charges and payments, and the invoices issued. Card details stay with Asaas.
• Waitlist: name, email, company, segment and city and, if you give them, phone and message, plus the page and campaign you came from.

• To perform our contract with you: running the service, hosting, operating the apps and supporting you. Basis: LGPD art. 7, V.
• To answer your request to join the waitlist and talk to you about access. Basis: steps prior to a contract, at your request, art. 7, V.
• For security, fraud and abuse prevention, and to improve the platform. Basis: legitimate interest, art. 7, IX.
• To meet legal, tax or authority obligations. Basis: art. 7, II.
• For marketing messages, if you ask for them. Basis: consent, art. 7, I, withdrawable in any message.

We do not sell personal data, and we do not use your content to train AI models.

Data about the people you serve, which enters the apps installed for you or the systems you connect, is processed by us on your behalf. There you are the controller and Resto is the processor, under LGPD art. 5, VI and VII.

As the controller, you set the legal basis for that processing, including for sensitive personal data (LGPD art. 11), and answer for it.

The rules for that processing are in the Data Processing Annex, which is part of these documents.

These are all the third parties that touch customer data. If we add one, it appears here in the same change.

Catalog-app partners, when they hold read access to your environment in the guest role, are also processors for that app's data. The access is shown on your members screen and you can revoke it.

The servers, the database and your organization's own server are in Germany, in Nuremberg. Backups are in Finland, in Helsinki. The AI models run in the United States, at the providers listed above.

That is an international transfer under LGPD art. 33. It relies on performing our contract with you and on contractual clauses with each provider. Ask the data-protection officer if you want the details of those clauses.

• Account and organization data: while the account exists.
• Sessions: 30 days.
• Waitlist: until you ask to leave it, until your account is created, or 12 months without contact, whichever comes first.
• Backups of your organization's apps: 14 days.
• Platform database backups: two full cycles, which today means up to 30 days.
• Error records: up to 90 days.
• Usage and billing records: for as long as tax law requires.
• After a deletion request: we delete within 30 days, and backups expire on their cycles.

Under LGPD art. 18 you may ask for confirmation of processing, access, correction, anonymisation, blocking, deletion, portability, information about who we share with, and withdrawal of consent.

Ask the data-protection officer at privacidade@alltherest.world. We answer within 15 days. You may also complain to Brazil's data-protection authority, the ANPD.

• Credentials for connected systems are encrypted with AES-256-GCM and decrypted only at the moment of use.
• Each organization has its own server and network, isolated from the others.
• Our people's access is the minimum their role needs, and it is logged.
• The platform is monitored continuously, with alerts over two independent channels.
• If a security incident carries real risk, we notify you and the ANPD.

Only what is necessary: a session cookie to keep you signed in, and a theme preference. No advertising cookies and no third-party trackers inside the product.

We count visits and sign-up steps with a tool of our own, hosted on our servers (Umami), with no cookies and without identifying you: we keep the page visited (without invitation codes or identifiers), the country, the kind of device and where the visit came from. The IP address is used only to estimate the country and to count the day's visit, and is not stored. Browsers with "Do Not Track" or Global Privacy Control turned on are left out of the count.

Resto is for people over 18. We do not knowingly collect data about children. If it happens, tell the data-protection officer and we will delete it.

When this policy changes, we publish the new version with its date at the top and tell you. Material changes require acceptance again.