Privacy
Policy.

naturali is operated by Triangulos Tecnologia LTDA, trading as Triangulos Ventures, a company registered in Brazil under CNPJ 32.857.025/0001-00. For the data of your account we are the controller. For the data your agents process on your behalf, you are the controller and we are the processor (the operator, in the words of the LGPD), acting on your instructions.

Questions, requests and complaints about personal data go to contact@naturali.ai. That address also reaches our data protection officer.

This policy applies to naturali.ai, app.naturali.ai, docs.naturali.ai and api.naturali.ai, and to the CLI, SDK and MCP server that talk to the API. It applies whether you reach the service yourself or through an assistant that calls the API for you.

It also describes how we handle the data of the people who talk to your agents on a connected channel, such as WhatsApp or Discord. We call them contacts. You decide what your agents collect from them; this policy describes what we do with it.

Account data. Your email address is your credential: we email a sign-in code to it and keep it to identify you. A name, if you give one. The projects you create, their members and roles, the API keys you mint (stored hashed; the key itself is shown once), your plan, the ledger of credit and spend, and the Stripe customer id and the last digits, brand and expiry of a saved card. Card numbers are entered on Stripe and never reach us.

Content you put in the service. Agent configurations, prompts, documents, files, knowledge, memories, tool definitions, conversations with your agents, messages to the Assistant and the secrets you store. Secrets are encrypted and write-only: the value is never returned once stored.

Records the service produces. Every generation, tool call, approval, trigger firing and run, with its timestamp, model, token counts and cost. An audit log of who did what on the project. These records are what lets you prove what an agent did.

Contact data. When an agent is connected to a channel we receive the identifier the channel gives us (a phone number on WhatsApp, a user id on Discord), the display name the channel sends, and the messages exchanged. We process this on your behalf.

Technical data. Logs of the operations the service performs and the errors it meets, kept for 30 days for security and debugging.

Usage analytics. The marketing site and the app record the pages you visit and the actions you take there, with your browser, device and approximate location, through PostHog (on the marketing site, only after you accept). In the app these are tied to your account. We use them to understand how the product is used and to fix what breaks.

What we do not collect. The sites and the app carry no advertising trackers. Signing in to the app sets one cookie, for your session (see Cookies).

• To run the service: store your content, run your agents, deliver messages on your channels and record what ran.
• To send your prompts and content to the model provider serving a generation, under Model providers.
• To bill: measure runs, storage and model spend, charge your card, keep the ledger and issue statements.
• To email you about the service: sign-in codes, invitations to a project, usage alerts, a refused reply, a price change on something you installed or its withdrawal, a declined auto-recharge, a statement that could not be charged. We send no marketing email unless you ask for it.
• To keep the service safe: detect abuse, enforce the Terms of Service, respond to incidents.
• To meet legal obligations, such as tax and accounting records.

We do not sell personal data, and we do not use your content, your contacts' messages or the records of your runs to train models.

Under the Brazilian General Data Protection Law (LGPD) and, where it applies, the EU General Data Protection Regulation (GDPR), we rely on:

• Performance of a contract for everything needed to provide the service you signed up for and to bill it.
• Legal obligation for the records tax and accounting law require us to keep.
• Legitimate interest for security, abuse prevention and the request logs that make the service debuggable, balanced against your rights.
• Consent where the law requires it, which you can withdraw at any time.

For contact data the legal basis is yours to establish: you are the controller and must have a lawful basis to let an agent process it.

A generation sends the prompt, the relevant knowledge and the conversation to a large language model. On a managed model, that model runs on Amazon Bedrock or Google Vertex AI under our own accounts. Neither uses prompts to train its models. Bedrock does not store them; Vertex AI may cache them for up to 24 hours and may process them in any Google Cloud region. On a model you bring your own key for, the request goes to your provider under your agreement with them.

Embeddings, which turn your documents into searchable vectors, are always computed on our credential.

We share data with the providers we need to run the service, each bound by a contract that limits what they may do with it:

Marketplace.When you install an agent or tool from the marketplace, its runs are recorded in your project and its publisher is told its usage and earnings. What you give it can reach the publisher: a tool calling an HTTP endpoint or MCP server sends their server each call's arguments, and an agent runs on the model provider its publisher configured, possibly under their own agreement. Install only what you trust with that data. As a publisher, handle what your listing receives lawfully.

Project members. Anyone you add to a project can read and write everything in it, including conversations and contact data.

Legal requests. We disclose data when the law requires it, to a court order or a competent authority, and we tell you when we are allowed to.

A change of ownership of the company would transfer the data with it, under this policy, with notice to you.

The service runs on Amazon Web Services in the United States (Ohio), so your data is stored and processed there. Bedrock models run there too; Vertex AI models may run in any Google Cloud region. Transfers out of Brazil and out of the European Economic Area rest on the mechanisms the LGPD and the GDPR provide, including standard contractual clauses with our providers.

Run content, the inputs, outputs and step records of each generation and trace, is kept for the window of your plan: 7 days on Free, 30 on Pro, 90 on Business, and as contracted on Enterprise. A daily sweep erases what is older. The record that a run happened (when, who started it, which model, token counts and cost) is kept as long as the project exists.

Conversations and sessions, including what contacts send, are not covered by that window. They are kept until you delete them or the project, like the configuration (agents, knowledge, tools, memories, documents and files). The audit log is kept for 365 days.

Deleting a project deletes its content, its run records, its channels, its webhooks and its contacts, with their conversations.

Account data is kept while the account exists. To close your account, write to contact@naturali.ai; we delete it within 30 days, except records we must keep for tax, accounting or an open dispute, which are kept for the period the law sets (five years for billing records in Brazil) and nothing else.

Backups. Database backups are kept 7 days; a deleted or overwritten file is kept as a prior version for 90 days.

You can ask us to confirm whether we process your data, to access it, correct it, delete it, port it, tell you whom we shared it with, or stop processing it, and you can withdraw consent you gave. Write to contact@naturali.ai; we answer within 15 days, and sooner where the law asks. We may need to verify that the request comes from you.

You can also complain to the Brazilian data protection authority (ANPD) or, in the EEA, to your local supervisory authority.

If you are a contact of one of our customers' agents, the customer is the controller and the first place to send a request. Write to us if you cannot reach them and we will forward it or act on it as far as our role allows.

Signing in to the app sets one cookie, which carries your session's refresh token. The API sets it as httpOnly and Secure, sends it only to its sign-in endpoints, and it expires after 30 days or when you sign out. It is strictly necessary and needs no consent. The app also sets a first-party PostHog cookie for usage analytics. The marketing site sets it only if you accept the banner; your choice is kept in your browser and can be changed from the footer link.

Data is encrypted in transit and at rest. Secrets are encrypted and write-only. API keys are stored hashed. Access to production is limited to the people who operate it and is logged. A security incident that affects your data is reported to you and, where the law requires, to the authority, without undue delay.

Report a vulnerability to contact@naturali.ai.

The service is for people aged 18 and over. We do not knowingly collect data from anyone younger; if you believe we have, write to contact@naturali.ai and we will delete it.

When this policy changes, the date at the top changes with it. A change that reduces your rights or widens what we collect is emailed to every account at least 30 days before it takes effect.