Privacy Policy

What we process, where each piece of data lives, who else is involved and how you exercise your rights.

Effective from November 1, 2026 · Updated November 7, 2026

This English version is a translation provided for convenience. If it differs from the Portuguese version, the Portuguese version prevails.

1. Overview

GUILHERME VASQUES LTDA, Brazilian taxpayer ID (CNPJ) 62.441.139/0001-28, with offices at Av. Rio Grande do Sul, 2649, Sala B, Jardim Belvedere, Umuarama/PR, Brazil, ZIP 87505-000 (“MEXERICA”, “we”), offers Mexerica: an app and a Hub that run AI agents on the computer or server of whoever installs them (the “Service”).

This policy separates two situations:

• Your account data and access through our cloud: we decide how this data is processed. For it, we are the controller under Brazil’s General Data Protection Law (Law 13.709/2018, “LGPD”).
• What stays in your Hub (conversations, memories, skills, files, bots): it is stored and processed on your own equipment. We do not receive this content in readable form. You decide what goes in and who you share it with.

2. What stays on your computer or server

The Mexerica Hub runs on a computer or server you choose. It holds:

• the bots’ conversations, memories, skills and instructions;
• the files you or the bots use;
• the settings for bots, routines, approval rules and connected apps;
• AI provider keys and app credentials, kept in an encrypted vault whose key is protected by the operating system (for example, the macOS Keychain).

This content is not sent to our cloud. Anyone with access to that equipment, or to copies and backups of it, may access this content. Securing and backing up that equipment is your responsibility.

3. Data we process in our cloud

You only need an account for features that depend on our cloud, such as talking to your Hub from your phone or connecting several computers to the same Hub. In those cases, we process:

• Account: email, name and password. Identity is managed by Clerk, which stores the password securely. We never receive your password. Our cloud keeps the account ID, email, account status and the creation and deletion dates.
• Sign in with Google or another provider: if you choose this, the provider shares basic profile data with Clerk, such as name, email, ID and photo, according to the permissions you approve on its screen. We never receive your Google password.
• Devices: the name you give the device, system type, public key, creation date, last use and any revocation.
• Computers connected to the Hub: name, system, hardware type, software version, public keys, whether it is online and when it was last seen.
• Links and access requests: which device or computer may talk to which Hub, with which permissions, request status (pending, approved, denied, expired or cancelled), dates and pairing verification codes.
• Security logs: who took each relevant action (for example, deleting an account), on which item, with what result and when.
• Usage limits: counters of external triggers received per minute and per day, used against abuse.
• IP address: used at request time to limit sign-up and external trigger attempts. We do not store it. See Retention and deletion for what Cloudflare may log.

We do not sell personal data and do not use it for advertising. The Service is free today, so we do not process billing data.

4. Why we use it and on what legal basis

• Creating and maintaining your account, authenticating you and connecting your devices and computers to your Hub: performance of a contract (LGPD, art. 7, V).
• Protecting the Service (rate limits, security logs, fraud and abuse prevention): legitimate interest (art. 7, IX).
• Sending account messages, such as email verification or password recovery, when Clerk sends them: performance of a contract (art. 7, V).
• Complying with legal obligations and responding to authorities: art. 7, II.
• Exercising rights in legal proceedings: art. 7, VI.

Where processing depends on your consent, you can withdraw it at any time. Withdrawal does not affect what was done before it.

5. Remote access, multiple computers and external triggers

Cloud access is optional. It only works if your Hub is configured to use it. Without that setting, your Hub does not talk to our cloud.

• Traffic between device, computer and Hub: goes through our relay on Cloudflare. Messages are end-to-end encrypted between the device or computer and the Hub. The relay only sees the encrypted content and the metadata needed to deliver it: which device, which Hub, when and how large.
• Waiting box: if the Hub is off, the relay keeps encrypted messages for the Hub for up to 24 hours, with size and count limits. After delivery or the deadline, they are deleted.
• External routine triggers (webhooks): when an outside service calls the address of one of your routines, our cloud receives the trigger and encrypts it immediately with your Hub’s key. It only delivers if the Hub is connected. The content is not stored and is wiped from memory after sending. Only the limit counters and request metadata remain. If the Hub is off, the trigger is refused and the sender can retry.

Encrypting content does not hide metadata. So we do not claim we see nothing: we see what is listed in this section and in section 3.

6. AI providers, apps and WhatsApp

Bots use third-party AI models (for example, Anthropic, OpenAI, Google and xAI) through the engine you already use on your computer, such as Claude Code, Codex, Cursor, Gemini, Grok, OpenCode or Pi, with your account or key. The Hub sends the provider what the bot needs to work: instructions, conversation, relevant memory and tool results. It goes from your Hub straight to the provider, without passing through our cloud. That use follows the provider’s terms and privacy policy, and the provider bills you for it.

When you connect an app (for example, through the Composio integration or an MCP server), the data the bots read or write passes through that service and follows its terms. We do not control what these third parties do with data.

When you give a bot a WhatsApp number, messages exchanged through that number go through WhatsApp’s infrastructure and follow Meta’s terms and privacy policy. You are responsible for having a legal basis to talk to the people who message that number.

7. Telemetry, cookies and this site

The app and the Hub send us no usage telemetry or crash reports. They also do not check our servers for updates automatically. Technical logs stay on your equipment.

This site does not use analytics, advertising or tracking cookies. The sign-in page loads Clerk on this site. It only uses the technical cookies and local storage needed for the session and for Clerk’s and Cloudflare’s (Turnstile) fraud and bot protection. None of it is used for advertising.

8. Who we share data with

We use these processors, which handle data on our behalf:

• Clerk: identity, sign-in, password and account emails;
• Cloudflare: hosting for this site and our cloud, database, relay, DNS and attack protection.

If you choose to sign in with Google, Google processes your sign-in data as a controller under its own terms. AI providers, connected apps and WhatsApp are not our processors. You contract with them directly (section 6).

We may also share data when the law requires it, by order of a competent authority or to defend rights in legal proceedings.

9. International transfers

Clerk and Cloudflare may process data outside Brazil, including in the United States. This includes Cloudflare’s network across many countries. These transfers follow article 33 of the LGPD, with the contractual safeguards these providers offer.

10. Retention and deletion

• Account: kept while it exists. To delete it, use your account page (accounts.mexerica.app/user) or write to privacy@mexerica.app. On deletion, the account is marked as deleted and its devices, computers and links are revoked. Hubs are no longer linked to it, and pending access requests are cancelled.
• Remaining technical records (ID, email and device and computer names): kept for security and possible legal defense. After the account is deleted, they are erased or anonymized within 6 months, unless the law requires otherwise. Only a technical ID with no personal data remains.
• Security logs: deleted within 30 days.
• Server logs: we do not turn on logs for our servers on Cloudflare. As a network provider, Cloudflare may keep its own technical logs, under its privacy policy.
• Relay waiting box: up to 24 hours.
• External triggers: not stored.
• Your Hub’s content: stays on your equipment until you delete it. Deleting your account does not delete what is in your Hub.

11. Security

Connections use encryption in transit (TLS). Messages between device, computer and Hub use end-to-end encryption. New devices and computers must be approved in the Hub itself, and access to our infrastructure is restricted. No system is perfectly secure. If an incident may bring you relevant risk or harm, we will notify you and Brazil’s National Data Protection Authority (ANPD), as the LGPD requires.

12. Your rights under the LGPD

Under article 18 of the LGPD, you may request:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability;
• deletion of data processed with consent;
• information about who we share data with;
• information about the option not to consent and its consequences;
• withdrawal of consent.

You may also object to processing based on other legal grounds if the law is not being followed. To exercise your rights, write to privacy@mexerica.app. We may confirm your identity before responding. We will respond within the LGPD deadlines. You may also file a complaint with the ANPD.

13. Under 18

The Service is meant for people aged 18 or over. We do not knowingly collect data from minors. If you learn of such a case, write to privacy@mexerica.app and we will delete the data.

14. Changes to this policy

We may update this policy when the Service changes. Relevant changes will be announced before they take effect, by email or in the app. The current version is always on this page, with the date at the top.

15. Contact and data protection officer

GUILHERME VASQUES LTDA · CNPJ 62.441.139/0001-28 · Av. Rio Grande do Sul, 2649, Sala B, Jardim Belvedere, Umuarama/PR, Brazil, ZIP 87505-000.

Data protection officer (DPO): Guilherme Vasques, at privacy@mexerica.app.

• Privacy and LGPD rights: privacy@mexerica.app
• Support: support@mexerica.app
• Developers and technical security: developers@mexerica.app
• Everything else: hi@mexerica.app

This policy is governed by Brazilian law. See also the Terms of Use.