Privacy Policy

Who we are and what this policy covers#

AI Context Orchestrator ("the platform", "we") is operated by Allavanco Comercial Ltda., CNPJ 42.153.299/0001-64, Travessa Maria Quitéria, 110, São José dos Campos, São Paulo, Brazil, ⟦postal code (CEP)⟧. Contact: contato@allavanco.com.br.

This policy covers the web application at app.allavanco.com, its public pages (the docs, the Trust Center and these legal pages), the public apps people publish with it, and the Bridge, the program that pairs a computer with the platform. ⟦Whether it also covers the company's main website, and that site's correct address⟧.

For your account (who you are and how you sign in) we decide how the information is used. For what your organization puts into the platform (its workflows, References, connected services and what its runs process), your organization decides what goes in and what it's for, and we process it to provide the service on its behalf.

Person in charge of data protection (Encarregado, LGPD art. 41): ⟦name and contact of the Encarregado⟧. Until one is named, write to contato@allavanco.com.br.

The short version#

• We keep: your account (name, e-mail), your organization and role, what you choose to save (workflows, projects, library items, shortcuts), your connections' credentials encrypted in the Vault, and the facts about each run (who, when, outcome, token counts), never what the run said.
• We don't keep run content: a run's task, answers and tool results stay in the server's memory for 15 minutes after the run ends, then they're gone.
• AI processing happens at Anthropic, under your organization's own key: when you run a workflow Live or use the Co-Pilot, the text it needs is sent to Anthropic's API with your organization's Claude API key (BYOK).
• Google and Microsoft sign-in give us your name and e-mail only. We never see your password and we don't keep their sign-in tokens.
• No advertising, no analytics trackers, no sale of data. We don't use your content to train AI models.

What we collect and keep#

What passes through without being kept#

• Run content: the task, the agents' answers, their reasoning and the tool results are held in server memory so you can watch the run, and dropped 15 minutes after it ends. The "re-run from this step" copy stays only in your browser tab.
• The Co-Pilot conversation: kept in your browser (up to 7 days, removed when you start over or sign out); each step is sent to our server, forwarded to Anthropic and not kept. We keep only token counts.
• A document you upload to describe a process is read in your browser; only its text travels, inside the Co-Pilot step.
• Voice: the app never receives audio. Speech becomes text in your browser; if your browser uses its maker's online speech service, that service receives the audio under the browser's own terms.
• Files you export are built in your browser.
• A public app's visitor answers are sent to Anthropic under the creator's key to produce the result, and not kept.
• A connection test's inputs and answer go to the service and back to your screen only.

How we use information#

• To provide the platform: sign you in, keep your organization's workspace, run the workflows you start, connect the services you choose and show you the results.
• To keep it safe: control access by role, keep each organization's data separate, limit repeated attempts, record who did what, and investigate abuse or failures from metadata.
• To support you: answer your messages and look at a failed run's facts (never its content).
• To bill a paid plan, when paid plans are on.
• To meet legal obligations, such as tax and accounting records.

We don't sell personal data, show advertising, build advertising profiles or use your content or your connected services' data to train AI models. People at our company don't read your workflows or your connected data unless you ask us to (for example in a support request), it's needed for security, or the law requires it.

Legal bases (LGPD)#

Under Brazil's General Data Protection Law (Lei 13.709/2018, LGPD), we rely on:

• Performing the contract with you or your organization (art. 7 V): your account, your organization's workspace, runs and connections.
• Legitimate interest (art. 7 IX): security, abuse prevention and the activity log, limited to what's needed.
• Legal or regulatory obligations (art. 7 II): tax, accounting and records the law requires us to keep.
• Exercising rights in legal proceedings (art. 7 VI), when needed.

AI providers and the services you connect#

Anthropic (Claude). When a workflow runs Live, when the Co-Pilot takes a Live step, or when the Project Starter proposes a project, the platform sends what that step needs to Anthropic's API: its instructions, the task, the text of its References, earlier steps' answers, tool results and, for the Co-Pilot, the conversation. It goes under your organization's own Claude API key (BYOK), so Anthropic processes it under your organization's agreement with Anthropic, including how long Anthropic retains it. A Simulation sends nothing to Anthropic.

The services you connect (for example Slack, GitHub, Notion, Google Drive). Agents act only through the tools your organization connects and switches on. To call them, Anthropic's MCP connector receives the service's address and the stored credential with each request, and the service receives the tool call. What the tool returns goes back to the agent at Anthropic and to your screen, and is held only with the run's content (15 minutes).

Links in References. Where your organization turned link fetching on, a Live run fetches each Reference's public web address when it starts and sends the page's text to Anthropic with the step.

Each of these services handles data under its own terms and privacy policy. Connect only what a workflow needs, and issue credentials limited to it.

Google user data#

Signing in with Google. We ask Google only for openid, email and profile. Google tells us your name, your e-mail address, whether Google confirmed it, and your Google account id; it also sends a link to your profile picture, which we discard. We use them to sign you in, to match you to your organization and its invitations, and to show your name next to what you do. We keep them while your account exists. We don't keep Google's tokens, we don't receive your password, contacts, files, mail or calendar, and we don't share this information with third parties, other than the providers that host the platform and its backups (listed below).

Connecting Gmail, Google Drive or Google Calendar (not offered yet: this paragraph applies once they are). These connections are separate from sign-in and start only when someone in your organization with permission chooses to connect one. Each asks Google for read-only access to that one service (gmail.readonly, drive.readonly or calendar.readonly), plus your e-mail address to show which account is connected.

• What we store: the access and refresh tokens Google issues, encrypted in your organization's Vault, and the connected account's e-mail address. We don't store your messages, files or events.
• How it's used: only when a workflow step your organization built uses that connection, in a run or a connection test, to read the messages, files or events that step asks for. What is read goes to the agent at Anthropic, under your organization's key, to perform that step, and to your screen; it's held only with the run's content (15 minutes).
• Who it's shared with: only Anthropic, as needed to perform the step you asked for. Never with advertisers or data brokers, never sold, never used for advertising or credit decisions.
• AI models: we don't use data from Google APIs to develop, improve or train generalized AI or machine-learning models.
• People: nobody at our company reads it, unless you ask us to in a support request, it's needed for security or to investigate abuse, or the law requires it.
• Revoking access: remove the connection in Connections; that deletes its tokens from the Vault. Also remove the platform's access in your Google Account (Security → Your connections to third-party apps and services), which stops Google from honouring any token already issued.

AI Context Orchestrator's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements.

Paired computers (Bridge)#

The Bridge runs on a computer your organization pairs with the platform, and only reads the folders its owner allows. We keep the computer's metadata listed above, never its folder paths, its private key, its local log or the files in its folders.

When a workflow step runs on that computer, the step's instructions and task are sent to the computer and held in our server's memory only until the Bridge collects them. Claude Code runs there, read-only, in the allowed folder; Claude Code sends what it reads to Anthropic from that computer, under the account Claude Code uses there. The Bridge sends back only the step's answer, with credential-like text hidden, which joins the run's content for 15 minutes.

Service providers and where data is processed#

Because the platform is hosted in the United States, personal data is transferred outside Brazil. ⟦The LGPD art. 33 mechanism the company relies on for international transfers⟧.

When information is shared#

• Inside your organization: members see the organization's workflows, projects, runs and activity according to their role. An admin manages members and connections.
• When you choose to publish: a public app's form is open to anyone with its link; a package an admin lists in the Community is visible to other organizations, with your organization's name only if the admin chose to show it, and never a person's name.
• With the providers above, only to provide the service.
• When the law requires it, or to protect the rights and safety of users and of the platform, ⟦the company's procedure for requests from authorities⟧.
• ⟦What happens to data in a merger, acquisition or sale of the business⟧.

How long we keep it#

How we protect it#

• Credentials and API keys are encrypted with AES-256-GCM and only decrypted on the server for the request that needs them; their values never reach the browser, an export or a log.
• Every request is checked against your role, and every query is limited to your organization.
• Sign-in goes through Google or Microsoft; sessions are signed, httpOnly cookies.
• Traffic is encrypted with HTTPS.
• Paired computers are bound by keys made on the computer; every job is signed.

No system is perfectly secure. If an incident puts your personal data at risk, we will notify you and, where the LGPD requires it, the national data protection authority (ANPD). The Trust Center explains the architecture in detail.

Cookies and browser storage#

We use only cookies the platform needs to work, plus your display preferences. No analytics, no advertising and no third-party tracking cookies.

Your browser also keeps, in its local storage, the copy of the workflow you're editing, the Co-Pilot draft (up to 7 days) and your preferences. You can clear them in Settings → Data or in your browser.

Your rights#

Under the LGPD (art. 18) you can ask us to:

• confirm whether we process your personal data, and give you access to it;
• correct incomplete, inaccurate or outdated data;
• anonymize, block or delete data that is unnecessary, excessive or processed against the law;
• give you a copy to take to another provider;
• delete data processed with your consent, and tell you about the consequences of refusing consent;
• tell you who we share it with;
• review a decision taken solely by automated means that affects your interests (we take none about you).

Write to contato@allavanco.com.br from the e-mail address of your account. We may ask you to confirm it's you. We'll answer ⟦the response time the company commits to⟧. Deleting an account or an organization is done by our team on request for now; there's no self-service button yet. You can also complain to the ANPD (Autoridade Nacional de Proteção de Dados).

If your organization put information about you into the platform (for example in a workflow), we may refer your request to that organization, which decides about its content.

Organizations and administrators#

An organization's admins invite and remove members, choose roles, connect services and decide what the organization shares. They can see the organization's activity log, including who did what. When a member is removed, their membership ends at once; what they created stays with the organization. An admin can ask us for a copy or the deletion of the organization's data.

Children#

The platform is a work tool for organizations and is not meant for children or teenagers. ⟦Minimum age to use the platform⟧.

Changes to this policy#

When we change this policy, we update the date and the version history below. If a change affects how we use data you already gave us, including data from Google APIs, we'll tell you in the platform before it applies and, where needed, ask for your consent.

Contact#

Allavanco Comercial Ltda. · contato@allavanco.com.br · Travessa Maria Quitéria, 110, São José dos Campos, São Paulo, Brazil.

Version history#