Privacy Policy

TOTVS S.A., CNPJ 53.113.791/0001-22, located at Avenida Braz Leme, 1000 – Casa Verde, São Paulo - SP, CEP 02511-000, Brazil, is the controller of the personal data processed on this platform.

We collect and store the following personal data for every account:

• Name
• Email address
• Company name
• Language preference
• Collection notice version and the time it was shown
• The time of your last activity
• The time an inactivity warning was sent, if any
• API key names, display prefixes, and creation dates (only a one-way hash of each key is stored)
• The date each API key was last used
• Monthly usage: the number of MCP tool calls per month, per day, and per API key
• Logs of the messages your AI agent sends to the MCP server

We use this data to create and secure your account, send access codes and essential account communications, and personalize your experience. We do not use it for advertising. We also use API keys and monthly usage, counted per day and per API key, to authorize MCP requests, enforce the monthly call limit, and show you your usage in your account. We use the logs of the messages your AI agent sends to the MCP server to operate, monitor, and troubleshoot the service and to investigate failures or misuse.

This platform uses the following cookies:

• __Host-tam_session, to keep you signed in
• tam_consent, to remember your analytics choice
• _ga and _ga_<id>, set by Google Analytics only after you accept analytics cookies

While you have not accepted analytics cookies, including after you reject them, Google Analytics still runs without cookies: each page view sends Google a cookieless measurement signal with the page address, the time, and basic browser and device information. Nothing is stored on your device and no identifier links one visit to the next. Google uses these signals to estimate overall site usage.

We share data with the providers that operate this platform: Amazon SES, in the sa-east-1 region, to send email, and Google Analytics, to measure site usage, with cookies if you accept analytics cookies and without cookies otherwise. We never sell your data.

Google processes analytics data, including the cookieless signals sent while you have not accepted analytics cookies, on servers located in the United States.

A pending registration is kept for 24 hours before it lapses.

A session stays valid for 30 days of inactivity, and for 90 days at most regardless of activity.

An account with no activity for 730 days is erased, after a warning sent 30 days before erasure.

Your cookie consent choice is kept for 365 days, and analytics cookies, if accepted, for 365 days.

A one-time access code expires after 10 minutes.

An API key is kept until you revoke it or your account is erased. Daily usage counts are kept until the end of the month they belong to, plus 1 day(s). A month's total and its counts per API key are kept for 3 months after that month ends, plus 1 day(s), then they expire.

Logs of the messages your AI agent sends to the MCP server are kept only as long as needed for the purposes described in this policy.

You can exercise the following rights yourself from your account:

• Access and portability: download your data
• Correction: update your name or company
• Email change: move your account to a new address
• Deletion: erase your account immediately and irreversibly

For any other request, contact our Data Protection Officer.

We reserve the right to suspend accounts and to interrupt the platform, temporarily or permanently, at any time and without prior notice. The service is provided as is, with no guarantee of availability.

Responses generated with the help of artificial intelligence may contain errors or inaccuracies. Always review the output before using it; we are not responsible for the responses produced.

You can reach our Data Protection Officer at dpo@totvs.com.br.

We may update this policy. Material changes require you to accept a new collection notice on your next sign-in.