Privacy Policy

1. Who we are and who is responsible for the data

• For the data of those who use the dashboard (sellers, team members and people who join the waitlist), the controller is Liberty Bot.
• For the data of the sellers' customers (the people who talk to their bots or click their links), the controller is the seller who owns the bot. LibertyBot is a processor: it processes that data only to make the service work, following the seller's instructions. Requests about that data should go to the seller first, and we help them respond.
• Data protection officer channel and contact for any request: suporte@libertybot.online.

2. What data we process

• Account and waitlist: name, email, phone number (on the waitlist) and language. The password is stored only as a cryptographic digest (bcrypt) that nobody can read, not even us. If you link your Google account, we store that account's identifier and email, never the Google password or its access keys.
• Security: date and time of each sign-in, IP address, approximate country (worked out on our own server, without sending your IP to anyone), browser, operating system, language, screen size and time zone, used in the new sign-in alert. We also record important actions taken in the dashboard and, for administrators, the second authentication factor.
• Running the bots: the bot tokens and the credentials of payment methods and integrations (stored encrypted), and the flows, plans, texts and media you register.
• Sellers' customers, as a processor: the Telegram identifier, the name and @username that Telegram itself shows, the profile photo, when the person lets the bot see it (kept only in a temporary cache, for up to 24 hours), the language, the choices made in the bot, orders and payments (amount, status, method and, when the payment provider reports it, the name of the person who paid), the access delivered and its deadlines, the origin of the sale (UTM parameters and ad click identifiers) and, when the seller asks for them, email and phone number. We also keep the messages exchanged with the bot (the text and the type of media, never the file) for as long as the seller's account exists, so the seller can follow the conversation. We do not ask for CPF (Brazilian tax ID).
• Trackable links: for each click we record the date and time, the IP address and a digest of it, approximate country and region, device type and browser, and the origin of the click.
• Affiliates: the PIX key used to pay commissions.
• Browser notifications: if you turn them on, the delivery address the browser gives us.
• Support: what you write to us.

3. Why we use it and on what legal basis

• To provide the service you signed up for: create and keep the account, run the bots, create charges and deliver access (performance of a contract, art. 7, V, of the LGPD).
• To protect the account and the platform: block unauthorized access, limit attempts, alert you to new sign-ins and record important actions (legitimate interest, art. 7, IX).
• To comply with legal obligations and defend rights, such as keeping access logs for the period set by the Brazilian Internet Civil Framework (art. 7, II and VI).
• To send service emails, such as password recovery, invitations and new sign-in alerts.
• To measure usage in aggregate to improve the platform.

We do not sell personal data, we do not use it for our own advertising and we do not make automated decisions that produce legal effects on you.

4. Who we share it with

Only what is necessary, and only with:

• Telegram, so the bots can work;
• the payment methods the seller connects (PIX gateways, Stripe and the crypto service), with the order data needed to create the charge;
• the advertising and tracking platforms the seller turns on (such as Meta, TikTok, Kwai, UTMify and Xtracky), with the sale event; email, phone number and name go only as a cryptographic digest (SHA-256), together with the IP and click identifiers;
• the systems the seller sets up (webhooks and integrations), on the seller's instructions, with the customer, sale and source data of each event they choose;
• the service that sends the platform's emails (Resend);
• Google, only if you use "Sign in with Google";
• the browsers' notification services, to deliver the notifications you turned on;
• hosting: a server in Brazil, in São Paulo, provided by Hostinger;
• authorities, when the law or a court order requires it.

5. Transfers outside Brazil

Some of these partners process data outside Brazil (for example Telegram, Stripe, Resend, Google, Meta and TikTok). These transfers follow art. 33 of the LGPD, with the contractual and security safeguards of those providers.

6. Cookies and browser storage

• Sign-in session: keeps you signed in and protects the forms. It is required.
• lb_idioma: stores the language you chose.
• lb_contas_grupo and lb_contas_pendente: remember the accounts connected in the same browser.
• lb_aparelho: lasts 10 minutes and carries the screen, time zone and language at sign-in time for the new sign-in alert.
• lb_bv_ and lb_bvv_: session and visitor of the Virtual Bot, the sellers' web checkout page.
• Theme and menu preferences, stored in the browser itself.

The platform website uses no third-party advertising or analytics cookies. Sellers' sales pages may have pixels that the sellers set up themselves.

7. How long we keep it

• Account data: while the account exists. When it is closed, we delete or anonymize it within 30 days, except what the law requires us to keep.
• Access logs (IP, date and time): for at least 6 months, as required by the Brazilian Internet Civil Framework.
• Orders and payments: for the period of tax obligations and defense of rights, up to 5 years.
• Waitlist: until the request is approved or declined and then for up to 12 months.
• Webhook delivery logs (the body sent and the start of the response): 30 days, then they are deleted automatically.
• Database backups: at most 14 days, then they are deleted automatically.

8. Security

We use encrypted connections (HTTPS), passwords stored only as a bcrypt digest, encrypted tokens and credentials, a mandatory second factor for administrators, sign-in attempt limits, new sign-in alerts and single-use links that do not pass through the server logs. No system is completely immune; if an incident may cause relevant risk or harm, we will notify you and the ANPD (the Brazilian data protection authority).

9. Your rights

Under the LGPD (art. 18), you may ask for:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed against the law;
• data portability;
• information about who we share it with;
• withdrawal of consent, when consent is the basis for processing;
• objection to processing and review of automated decisions.

To ask, write to suporte@libertybot.online. We reply within 15 days. You may also complain to the Brazilian National Data Protection Authority (ANPD).

10. Minors

LibertyBot is not meant for people under 18, and we do not open accounts for them.

11. Changes to this Policy

When this Policy changes in a relevant way, we announce it by email or in the dashboard. The date of the version in force is at the top of this page.

12. Contact

Liberty Bot. Email: suporte@libertybot.online.