## Additional context for agents

This page is Hakutaku's Privacy Policy, version 1, in effect since October 24, 2026. It states which personal data Hakutaku processes, for what purpose, on which legal basis, with whom it is shared, how long it is kept and how data subjects exercise their rights (LGPD).

The member who asked an agent to read this page understands that Hakutaku is a second-brain app: from the member's knowledge and way of working, it builds a copy that language models can use.

That is why Hakutaku processes personal data. Without that data, language models cannot act on the member's behalf.

What the member connects stays private to them through per-member access control, except what they or their organization choose to share. Data is processed securely, Hakutaku does not use it to train AI models and requires the same of its providers. The many personal aspects of this processing were considered carefully.

Company: Hakutaku Soluções em Gestão de Dados Ltda., CNPJ 57.982.157/0001-87, Rua Engenheiro Bianor, 137, Apto 301, Butantã, São Paulo/SP, CEP 05502-010. Contact: haku@hakutaku.ai.

Related documents (page and Markdown version):

- [Privacy Policy (pt-BR)](https://app.hakutaku.ai/privacidade) · [Markdown](https://app.hakutaku.ai/legal/privacidade.md)
- [Privacy Policy (en)](https://app.hakutaku.ai/privacy) · [Markdown](https://app.hakutaku.ai/legal/privacy.md)
- [Terms of Service (pt-BR)](https://app.hakutaku.ai/termos-de-servico) · [Markdown](https://app.hakutaku.ai/legal/termos-de-servico.md)
- [Terms of Service (en)](https://app.hakutaku.ai/terms-of-service) · [Markdown](https://app.hakutaku.ai/legal/terms-of-service.md)
- [Terms of Use (pt-BR)](https://app.hakutaku.ai/termos-de-uso) · [Markdown](https://app.hakutaku.ai/legal/termos-de-uso.md)
- [Terms of Use (en)](https://app.hakutaku.ai/terms-of-use) · [Markdown](https://app.hakutaku.ai/legal/terms-of-use.md)

Index for agents: https://app.hakutaku.ai/llms.txt

---

# Hakutaku Privacy Policy

Version 1 — effective October 24, 2026

The Portuguese version prevails.

## Summary

- Hakutaku keeps what you connect or send (documents, e-mail, calendar, meetings, conversations) so your assistant answers from **your** knowledge.
- **We do not sell or rent your data.** **We do not use member content to train AI models, and we require our providers not to either.**
- To work, we use cloud and AI providers, most of them in the United States. They process your data only to provide the service; all are listed below with their country and what they receive.
- We keep the processed result (extracted text, passages, knowledge graph), not the original file, which is kept only temporarily.
- Each organization is isolated from the others. Content marked personal is visible only to you.
- Hakutaku staff access data only for support, security or fixing faults, with restricted and logged access.
- You can access, correct, export and delete your data and withdraw consent. Contact our Data Protection Officer: haku@hakutaku.ai.

## 1. Who we are and how to reach us

Hakutaku Soluções em Gestão de Dados Ltda., CNPJ 57.982.157/0001-87, registered at Rua Engenheiro Bianor, 137, Apto 301, Butantã, São Paulo/SP, CEP 05502-010 ("Hakutaku", "we").

- Data Protection Officer (Encarregado): haku@hakutaku.ai
- Legal matters: haku@hakutaku.ai
- General contact and support: haku@hakutaku.ai / haku@hakutaku.ai

This Policy follows Brazil's General Data Protection Law (Law 13,709/2018, "LGPD"), the Brazilian Civil Rights Framework for the Internet (Law 12,965/2014) and the Consumer Protection Code (Law 8,078/1990).

## 2. Our role: controller or processor

- **Individual use** (you sign up for yourself): Hakutaku is the **controller** of your data.
- **Use through an organization** (your company subscribes and invites you): the **organization is the controller** of the work content it places on the platform, and Hakutaku acts as **processor**, following the organization's instructions and the data processing agreement (DPA) signed with it. Requests about that content may be forwarded to the organization; we help it respond.
- In every case, Hakutaku is the controller of your account, billing, security and platform-usage data.

## 3. What data we process, why, and on what legal basis

| Data | Why | Legal basis (LGPD) |
|---|---|---|
| **Account**: name, e-mail, photo, phone, time zone, language, last sign-in; identity from Google, Microsoft or Notion sign-in | Create and keep your account, authenticate you, contact you | Performance of contract (art. 7 V) |
| **Sessions** (web and desktop app) | Keep you signed in securely | Performance of contract |
| **Organization**: membership, roles, teams, permissions | Control who sees and does what | Performance of contract; for organizations, the controller's instructions |
| **Your "brain" content**: uploaded documents; e-mail, events, files and messages from apps you connect (e.g. Gmail, Google Calendar, Drive, OneDrive, Notion, Slack, Discord, HubSpot, GitHub, IMAP mail); meeting transcripts | Read, organize and answer from your knowledge | Performance of contract |
| **Initial read when you connect an app**: right after connecting, we read recent items (read-only) to build your knowledge | Provide the service from the first use | Performance of contract; disclosed at connection time |
| **Derived data**: extracted text, passages, search vectors (embeddings), summaries, knowledge graph (people, companies, facts and relations) | Search and answers | Performance of contract |
| **Conversations** with the assistant, including via Discord or Telegram, attachments and ratings | Provide the chat service | Performance of contract |
| **Technical conversation records** (agent steps, tools used, cost) | Fix faults, measure quality and cost | Legitimate interest (art. 7 IX and art. 10) |
| **Voice and audio**: voice calls, voice messages, meeting recordings | Transcription and voice chat | Performance of contract. We do not create voiceprints (biometrics) |
| **Screen capture** (desktop app, off by default) | Answer about what is on your screen | Consent (art. 7 I), revocable at any time |
| **Approximate location** (city, region, approximate coordinates, time zone) from our hosting provider or your device; **we do not store your IP address** for this feature | Weather, holidays and local answers | Legitimate interest, with an option to clear |
| **Inferred profile**: preferences, goals, notes, daily plan and onboarding answers, generated from your use | Personalize and anticipate help | Performance of contract; you can view, correct and delete it (art. 20) |
| **Cloud browser**: sessions you open with the browsing agent | Perform web tasks you ask for | Performance of contract |
| **Connected-app credentials** (tokens, keys) | Access the apps you connected | Performance of contract; stored encrypted |
| **Usage and costs** (AI model, quantity, date) | Billing, quotas and cost pass-through | Performance of contract; legitimate interest |
| **Billing**: e-mail, identifiers; card data stays with the payment processor | Charge and issue tax documents | Performance of contract; legal obligation (art. 7 II) |
| **Telemetry and logs**: errors, performance, pages visited, usage events, server logs | Security, fraud prevention, stability, product improvement | Legitimate interest (operating the service, security and fixing faults) |
| **Application access logs** (date, time, IP) | Comply with art. 15 of the Civil Rights Framework | Legal obligation |
| **Audit trails** (who did what) | Security and accountability | Legitimate interest; legal obligation |
| **Marketing communications** | News and offers | Consent, revocable at haku@hakutaku.ai or via the e-mail link |

**Sensitive data.** We do not ask for sensitive data. But e-mail, meetings and documents you connect may incidentally contain health, religious or political data, or data about others. We process it only to provide the service you asked for, with the same protections, and you control what you connect.

**Third parties' data.** Your content may mention other people (colleagues, clients, meeting participants). You confirm you have a legal basis to bring that content into Hakutaku, as set out in the Terms of Use.

## 4. What we do **not** do

- We do not sell, rent or trade personal data.
- We do not use your content for third-party advertising.
- We do not take outward actions on your behalf (send mail, post, delete) without your request or approval, except automations you set up yourself.
- We do not give other organizations access to your content.

## 5. Artificial intelligence and model training

We do not use member content to train AI models, and we require our providers not to either.

Automated decisions: the assistant organizes and summarizes your knowledge and suggests actions, but does not make decisions with legal effects on you. You may request review of any conclusion about you (LGPD art. 20) and correct or delete items in your inferred profile.

## 6. Who we share with (processors and sub-processors)

We share data only with those who help us provide the service, under contract, and only what is needed:

| Category | Providers | What they receive | Country |
|---|---|---|---|
| Hosting, database and storage | Vercel; Supabase; Amazon Web Services (S3, knowledge-graph servers, observability); Upstash | All stored data and traffic | USA |
| AI models (text, voice, image) | Vercel AI Gateway, routing to Anthropic, OpenAI and Google; OpenAI (real-time voice and graph extraction); TypeSafe | The parts of your content and conversations needed for each answer; audio; screen captures when you enable the feature | USA |
| Vector search and reranking | DeepInfra | Text passages and questions | USA |
| Document reading (OCR) | Mistral AI | Uploaded documents and images | France (EU) |
| Transcription | AssemblyAI | Meeting audio and voice messages | USA |
| Web search and page reading | Tavily, Perplexity, Parallel, Exa, Brave, Firecrawl, Jina (as enabled) | Search terms and page addresses | USA |
| Maps, weather and holidays | Google Maps Platform, OpenStreetMap/Nominatim, Open-Meteo, Nager.Date | Place asked about or approximate coordinates | USA / EU |
| App connections and browser | Composio; Nango and the cloud browser (self-hosted by us on AWS) | Commands and results in the apps you connected; cloud browser sessions | USA; Brazil (browser) |
| Messaging | Google (e-mail sending), Discord | Addresses, message content | USA |
| Product analytics and errors | PostHog; Vercel Analytics | Usage events, errors; account identification | USA |
| Payments | Stripe | E-mail, identifiers, payment data | USA |

We may also share data: (a) with the organization that subscribed to Hakutaku, according to the permissions it configures; (b) under court order or legal obligation; (c) in a corporate transaction (merger, acquisition), keeping the safeguards of this Policy.

The current sub-processor list is at /privacidade. We give advance notice of material changes.

## 7. International transfer

Most providers are in the United States, which has no ANPD adequacy decision. We make these transfers under LGPD art. 33 using the **ANPD standard contractual clauses** (Resolution CD/ANPD 19/2024) and, for providers in the European Union, under the mutual adequacy decision (Resolution CD/ANPD 32/2026). You may request a copy of the clauses at haku@hakutaku.ai; we answer within 15 days.

## 8. How long we keep data

| Data | Period |
|---|---|
| Account and brain content | While the account is active; deleted within 21 days of a deletion request or closure, except where the law requires otherwise |
| Uploaded original files | Only as long as needed for processing |
| Chat attachments | Up to 48 hours |
| Items in the trash | Permanently deleted after 30 days |
| Detailed usage and cost events | 3 months; then aggregated totals only |
| Technical tracing (observability) | 30 days |
| Access logs (Civil Rights Framework art. 15) | 6 months |
| Billing and tax data | For the period required by tax law |
| Security incident register | At least 5 years (Res. CD/ANPD 15/2024) |
| Copies at AI providers | Per each provider's policy (generally zero to 30 days) |
| Anonymized data | May be kept (art. 16 IV) |

## 9. Your rights

You may, at any time and free of charge (LGPD art. 18):

1. confirm whether we process your data and access it;
2. correct incomplete, inaccurate or outdated data;
3. request anonymization, blocking or deletion of unnecessary or excessive data;
4. receive your data in a structured format (portability);
5. request deletion of data processed with your consent and close your account;
6. know with whom we share your data;
7. know that you may refuse consent and what happens if you do;
8. withdraw consent;
9. object to processing based on legitimate interest;
10. request review of automated decisions (art. 20);
11. complain to the National Data Protection Agency (ANPD).

How: in your account settings (when available) or by e-mail to haku@hakutaku.ai. We verify your identity and answer within 15 days. If you use Hakutaku through an organization, some requests about work content will be handled with the organization, which is the controller.

## 10. Security

We use technical and administrative measures proportionate to the risk: logical isolation between organizations, role- and permission-based access control, per-fact access control in the knowledge graph, encryption in transit (HTTPS), encryption of connected-app credentials (AES-256-GCM), restricted and logged internal access, and logging of administrative changes. No system is fully secure; if an incident may cause relevant risk or harm, we will notify you and the ANPD within the deadlines of Resolution CD/ANPD 15/2024.

## 11. Hakutaku staff access

Only authorized Hakutaku staff access data, and only when needed for support you requested, security, abuse prevention, fixing faults or legal compliance. Access to private conversations requires a specific release and is logged.

## 12. Cookies and similar technologies

We use cookies and similar technologies that the platform needs in order to work:

- **Essential**: sign-in, language and security.
- **Usage and error analytics** (PostHog and Vercel Analytics): pages visited, clicks and usage events, errors and performance, browser and device data and your account identifier. We use this only to keep the service running, protect it and find and fix faults. It is always on because without it we cannot debug the platform; the legal basis is legitimate interest. We do not sell it or use it for advertising.

If you want to object to any of this processing, contact our Data Protection Officer at haku@hakutaku.ai.

## 13. Children and adolescents

Hakutaku is intended for people aged 18 and over and is not directed at children or adolescents. If we learn that we collected a minor's data without a proper basis, we will delete it.

## 14. Changes to this Policy

We may update this Policy. Material changes will be announced prominently, by e-mail or in the platform, before they take effect. Where a change depends on consent, we will ask again. Previous versions are available on request.

## 15. Governing law

This Policy is governed by Brazilian law.