Privacy policy
Version of November 7, 2026. Applies to the website duboss.app, the dashboard painel.duboss.app, and the assistant on WhatsApp and Telegram.
In short. Duboss keeps what you tell it, so it can organize and remind you. You can see everything it has kept and delete whatever you want. It only accesses your Google account for what you authorize, and you can disconnect it anytime. We don't sell data, and we don't use what you say for advertising or to train models.
Questions and requests: hello@duboss.app.
1. Who is responsible
The data controller is Hubib Group Limited (British Virgin Islands, company no. 2180721, Carré Chambers, P.O. Box 260, Road Town, Tortola, VG1110), which operates Duboss. Privacy contact: hello@duboss.app. This policy follows Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and, where applicable, the EU General Data Protection Regulation (GDPR).
2. What data we use
| Data | Source | Purpose |
|---|---|---|
| Name, phone number and WhatsApp or Telegram identifier | You, when you start using | Know who is talking and deliver replies |
| What you say or write, including voice notes and their transcription | You | Understand the request; create tasks, appointments, cash entries and reminders |
| Tasks, routines, appointments, cash entries, documents, lists and memories created from your conversations | Generated by the service from what you say | Organize, remind, and show in the dashboard |
| Files you send (receipt photos, PDFs) | You | Store in the space's folder in your Google Drive and link to the entry or document |
| Google account data you authorize: calendar, contacts, emails, files Duboss created | Google, with your authorization | Create and read events, invite people, read and send email at your request, store files |
| Google account email and name | Google, when signing in to the dashboard | Identify you in the dashboard |
| Technical logs: message timestamps, errors, per-person usage | Generated by the service | Keep the service running, measure cost, investigate problems |
| Payment data | Paddle | Billing. We never see or store card numbers |
We don't ask for sensitive data. If you mention it to the assistant (health, for example), it is kept as part of your conversation, for you only, under the same access and deletion rules.
3. Legal basis
We process data to perform the contract with you (provide the service), on the basis of consent when you authorize access to your Google account or invite someone into a space, and on legitimate interest for security, abuse prevention and usage measurement, always proportionately.
4. Google account
Access to your Google account uses Google Sign-In (OAuth). You choose what to authorize, and you can grant only part of it. What each permission does:
- Calendar — read and create events, with guests, in the calendars you choose.
- Contacts — find the right person when you say "call Bruno".
- Drive (only files created by Duboss) — store receipts and documents in each space's folders. Duboss can't see your other files.
- Gmail (read) — read emails to extract deadlines and tasks, when you ask.
- Gmail (send) — send an email you reviewed and approved first.
Access tokens are stored encrypted in our database. You can see connected accounts in the dashboard and in the chat (my connections) and disconnect any of them at any time; you can also revoke access at myaccount.google.com/permissions.
Duboss's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: that data is used only to provide the features you asked for, is not transferred to third parties except as needed to provide them, is not used for advertising, and is not read by humans except with your consent, for security purposes, or as required by law.
5. Artificial intelligence
To understand what you say, Duboss uses language models from external providers (currently Anthropic for text and Groq for audio transcription). Messages are sent to these providers only to process your request, under agreements that prohibit using the data to train models. We do not train models on your data.
6. Who we share with
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database and dashboard functions | United States (Ohio) |
| Anthropic | Language model | United States |
| Groq | Audio transcription | United States |
| Calendar, Contacts, Drive, Gmail, voice for the morning summary, sign-in | Global | |
| Cloudflare | Domain, website and protection | Global |
| Paddle | Payments, invoicing and taxes | United Kingdom / United States |
| Meta (WhatsApp) and Telegram | The messaging channel you chose | Per service |
Data is stored outside Brazil. International transfers follow Article 33 of the LGPD, with contractual clauses and equivalent security measures. We don't sell data and don't share it with advertisers.
Shared spaces. When you invite someone into a space, that person sees what's in that space, according to the role you gave (owner, editor, read-only). Your personal space is never shared. Permissions are enforced by the database, not by the assistant.
7. How long we keep it
- Conversations, tasks, documents and memories: while your account exists, or until you delete them.
- Uploaded files: stored in your Google Drive; the temporary copy on our server is deleted once stored.
- Technical logs: up to 12 months.
- After cancellation: 30 days for you to export or reactivate; then deletion. Tax records stay with Paddle for the legally required period.
8. Your rights
At any time you can: see what we hold about you; correct it; delete it (a memory, a conversation, or the whole account); export it; and withdraw consent, including by disconnecting your Google account. Much of this you can do yourself, in the dashboard or in the chat ("delete the memory about X", "my connections", "delete my account"). For the rest, email hello@duboss.app; we reply within 15 days. You may also complain to Brazil's National Data Protection Authority (ANPD) or your local authority.
9. Security
Encrypted connections (HTTPS), Google credentials encrypted at rest, database access restricted by role and by person, secrets kept out of the code, limited server access. If an incident affects your data, we notify you and the relevant authority within the legal deadlines.
10. Children
Duboss is for people aged 18 and over. We don't knowingly create accounts for minors; if we identify one, we delete it.
11. Cookies
The website uses no tracking cookies and no ads. The dashboard uses only the session cookie needed to keep you signed in.
12. Changes
If this policy changes in a meaningful way, we notify you in the dashboard and in the chat before the change takes effect. The date at the top shows the version in force.