Privacy Policy

1. Who is responsible for your data

HORIZONTEXUBERANTE, UNIPESSOAL LDA, registered in Portugal, operates Tobira. Privacy contact: [email protected].

We are the controller for our platform-account administration, our own billing, security and service-management purposes. When a Company uses Tobira to answer visitors, manage company-scoped chats, collect leads or arrange bookings, that Company generally determines the purposes and Tobira processes its customer data on its behalf under the Data Processing Addendum. The Company's notice identifies its controller and explains its use of visitor data. Where a Company itself acts for another controller, the processing chain must be documented.

Authentication and payments can also involve processing for Tobira's own purposes or a provider's independent purposes. Roles depend on the particular activity, not just the service's name. Ask the Company about its services and visitor records; contact us about Tobira's own processing or for help identifying the correct party. These distinctions follow the EDPB guidance on controllers and processors.

2. Information we process

We do not receive full card numbers through Tobira's checkout forms; Stripe receives payment information. Do not put card numbers or provider keys in chat. Owner authentication uses Clerk. Visitor email sign-in uses Better Auth software running with Tobira's database, not a separate hosted Better Auth service. Visitor sign-in is passwordless.

Guests may optionally leave an email or LinkedIn for follow-up. We do not silently collect guest email. If you sign in, the email you provide is used for your account as described above.

Do not submit unnecessary sensitive information. Message and file contents may contain health, immigration, financial or other sensitive details if you choose to provide them. A Company must establish the appropriate basis and safeguards for such data; this policy does not authorise unrestricted sensitive-data processing.

3. Who can see chats and memory

Public agent profiles and machine-readable public addresses can be read by people and external assistants. Owner-private instructions and owner-only knowledge are excluded from public visitor context. Publicly permitted business knowledge can nevertheless inform an answer.

For Company visitors, the main support chat is visible to the Company team. Where available, additional chats have a private setting. A private setting restricts Company-team access to content; permitted metadata may remain visible. If you choose to share a private chat, request contact or make a booking that requires sharing, the interface explains that the whole chat becomes visible to the team. Information already received by a team cannot be recalled simply by switching privacy later.

Visitor memory is scoped to the Company. Available settings let you view, edit or delete saved facts and disable memory. Disabling memory is not the same as deleting existing saved facts. Facts you add yourself are private by default. Private memory is not included in team-visible main-chat context; communication preferences are also protected from team display. Different Companies do not receive each other's visitor memory merely because the same email is used.

"Private chat" does not mean end-to-end encryption or processing without Tobira infrastructure and AI providers. The Company can read team-visible conversations; authorised Tobira personnel may need limited access for support, security, investigation or legal requests.

4. AI processing, external agents and model training

To produce a reply, the configured AI route can receive your message, relevant conversation history, allowed profile/company knowledge, applicable instructions and enabled visitor memory. File processing can send content or derived evidence to the selected document-processing provider. Voice requires an audio-processing provider. Network matching has a different purpose and uses public agent profile information; buying a site-agent plan does not automatically place that agent in the network.

Depending on the configured route, AI processing uses OpenAI, Google Gemini, OpenRouter and its selected model vendors, or Z.ai (GLM) for enabled test or experimental routes. OpenAI APIs provide speech recognition and realtime voice; connected ChatGPT/Codex services provide agent replies. Configured file-processing routes may also use OpenAI. OpenRouter routes may use Anthropic, Google, DeepSeek or another configured vendor. Direct API and connected ChatGPT/Codex services have different applicable provider terms. Only providers used by an enabled feature receive its data. See Section 6 and the Data Processing Addendum.

If a Company connects its own provider key or external agent, permitted guest context can be sent to that provider or endpoint. Its own notice and arrangements must explain that processing. Private-chat availability is restricted where the owner's external runtime would receive content. A visitor's own MCP assistant is a separate integration, described in Section 8.

Tobira does not itself use customer conversation content to train foundation models. Provider processing, retention and training terms depend on the enabled service and route. We do not give an unconditional no-training or zero-retention guarantee covering every provider and integration. Contact [email protected] for information about the providers relevant to your service.

5. Purposes and legal bases

For processing where Tobira is controller, our bases are performance of the platform contract for account administration and requested services; legitimate interests for proportionate security, abuse prevention and reliability; legal obligations for required accounting and compliance; and consent where optional processing requires it. Our legitimate interests are protecting accounts, preventing misuse and maintaining a reliable service. You may object as explained in Section 11.

Where Tobira is a processor, the Company establishes and discloses its own bases, including any special-category condition. Accepting Terms, asking for a reply, agreeing to immediate paid service and granting marketing-storage consent are different acts.

Optional processing requiring consent must have an appropriate consent mechanism. A legal notice or acceptance of Terms does not itself supply prior consent for optional browser storage. Section 7 explains the attribution behaviour and available controls.

6. Recipients and service providers

Only the recipients relevant to an enabled feature receive its data. The list below identifies provider countries and known processing locations. Global services and downstream model vendors may process data in additional countries; a provider country is not an exclusive storage-location guarantee. Contact [email protected] for details.

We do not sell customer personal data or operate an advertising-data resale service. A visitor-subscription revenue share is a service fee, not a sale of personal information. Attribution can collect gclid and fbclid advertising identifiers when present, as explained in Section 7.

We may disclose information where required by law, to protect rights and security, or in a lawful corporate transaction subject to appropriate safeguards.

7. Cookies and browser storage, including attribution

Tobira uses cookies and browser storage for authentication, chat continuity and preferences. Company-hosted sites may have their own storage and banners, which their own policies cover.

Attribution includes utm_source, utm_medium, utm_campaign, utm_term, utm_content, gclid and fbclid where present, plus timestamps, page paths and a referrer with unrelated query parameters/fragments removed. Campaign parameters are retained in the permitted page URL. Site URL paths can still contain personal information; sanitising query parameters does not guarantee anonymity.

If no refusal signal is detected, the widget can store the first/last source in the browser. This includes an unknown consent state; the code is not universally opt-in. When it detects a refusal, it avoids persistent attribution storage, removes the existing attribution entry and stops carrying over saved visit history. Supported signals include Google Consent Mode denial of ad or analytics storage, Global Privacy Control, an explicit data-tobira-consent="denied" setting or the host site's consent callback. An arbitrary cookie banner is not automatically understood unless it supplies a supported signal.

Refusal does not necessarily suppress all source information for the current page: the loader still assembles current-visit metadata in memory and can pass it to the widget. On an enquiry or booking, source information can be saved in server records and included in owner notifications, Cal.com or payment metadata. The 30-day browser history window is not a 30-day deletion promise for these downstream records. Clearing browser storage does not erase previously submitted records.

Use the host site's privacy controls where integrated, enable GPC or clear browser storage to remove browser-held information. Site operators should connect their banners to a supported refusal signal. Where prior consent is required for nonessential storage, it must be obtained before that storage is used; refusal support and this notice do not replace consent. See CNIL guidance on cookies and other trackers.

Chinese and Japanese landing pages load fonts from fonts.googleapis.com and fonts.gstatic.com. Your browser therefore sends Google a network request, including IP and standard browser information and any referrer allowed by browser or site policy. This request renders the font and is separate from Gemini and Google sign-in. Font loading is not controlled by the attribution refusal switch.

8. Voice, attachments and visitor MCP

Microphone access is requested when you use voice or dictation. Dictation sends audio for transcription and returns an editable draft; it does not automatically send that draft as a chat message. Spoken conversations send audio for realtime processing and can save text transcripts in chat. Realtime voice uses OpenAI. Audio retention depends on the relevant provider and service; we do not promise immediate deletion or zero retention for every route.

Guest uploads are stored in Cloudflare R2 object storage with region auto and may be analysed by AI. Guest files use time-limited signed links and are not additionally encrypted by the application before upload. Owner-knowledge originals use a separate encrypted storage path. Uploads are not automatically public, but a recipient of a valid signed link can access the linked object until it expires. Content-derived evidence or chat answers can outlive the original file.

Where enabled for an eligible paid visitor account, MCP lets your chosen assistant ask the Company agent, list/read your own chats and inspect your package. Create/revoke keys in the widget settings. We store the key's hash, not its full reusable plaintext, and record creation/last-use/revocation metadata. The integration remains scoped to your Company account and does not make your assistant a trusted network peer. Revocation prevents future use of that key; it does not remove copies already received by your assistant provider.

9. Retention and deletion

We retain data for as long as needed for the relevant service purpose and applicable legal duties. Retention depends on the record, enabled service and the Company's instructions. The table below explains the applicable criteria and available controls; session or link expiry does not itself erase all associated records.

Deleting a visitor chat removes its messages and associated extracted file evidence and attempts to delete its stored objects. Failed object deletions are retried by cleanup. This does not erase billing records, independent leads/bookings, memory items, already delivered notifications or provider-held copies. Use their separate controls or make a data request.

For deletion beyond available controls, contact the Company and [email protected]. We will identify the responsible party, any retention obligation and the action taken. Where we act as processor, we assist the Company under the DPA rather than determining its retention independently. Cancellation of payment is not a deletion request.

10. Security and international processing

The application encrypts designated messages, personal profile/private setup fields, memory, knowledge and integration secrets using AES-256-GCM. Some identifiers, emails, public profiles, operational/payment metadata and chat titles are not encrypted by this application layer. Guest-file bytes use storage-provider protections rather than additional application encryption. Owner-knowledge originals are application-encrypted separately. Hashing protects supported access keys and OTPs.

Transport security, authentication, agent/company/account access checks, private-chat controls, signed links, input validation and abuse limits help protect the service. These controls are not a guarantee against every incident or evidence of a certification. No SOC 2, ISO 27001, EU-only hosting or end-to-end encryption claim is made.

Tobira is based in Portugal, but data is stored and processed in the United States: the application and PostgreSQL database run on Railway in region us-west2. Files and attachments use Cloudflare R2 with region auto, which does not establish EU-only storage. AI providers and selected integrations may also process data in other countries identified in Section 6. Transfers from the EEA rely on the European Commission's Standard Contractual Clauses (SCCs) and, where the provider participates and the transfer is covered, the EU-US Data Privacy Framework. SCCs require the appropriate contractual modules, transfer assessments and supplementary safeguards where needed. We do not promise EU-only processing or universal coverage by a single transfer mechanism. Request details at [email protected]; see the European Commission transfer clauses.

For a breach involving Company data, we notify the Company without undue delay and assist its response under the DPA. For our controller processing, we make regulator and individual notifications where required by law. Do not confuse a controller's regulatory deadline with an automatic promise that every incident is reported to every user.

11. Your rights, children and changes

Subject to applicable law, you may request access, correction, erasure, restriction, portability, or object to certain processing. Withdraw consent where it is the basis; withdrawal does not invalidate earlier lawful processing. You may complain to your local supervisory authority, including Portugal's CNPD where appropriate. Contact [email protected]; we normally respond within one month, with any lawful extension explained. Company processing requests may need to be handled by the Company. See the GDPR rights framework.

Visitor settings offer chat export/deletion, memory controls and MCP revocation where enabled. For owner-account export or erasure beyond the interface, contact us. We may verify identity proportionately, without requesting unnecessary data. California residents may also have applicable access, correction, deletion and opt-out rights; we respect supported GPC as described above and do not penalise lawful privacy requests.

The current minimum-age policy is 13 in the United States and 16 in the EU/EEA; the service is not directed to children below the applicable minimum. Report suspected underage data to [email protected].

For material policy changes, we notify affected users and update the effective date, with the existing 30-day advance-notice policy where appropriate. A changed notice does not itself authorise a new purpose or replace required consent.