Last updated: October 25, 2026

Privacy Policy

Your privacy matters to Kinbot. This policy describes how we collect, use, and protect your information when you use Kinbot: saving WhatsApp files to your Google Drive and, for teams, recording the conversations of WhatsApp groups.

1. Who we are

Kinbot is operated by Kinbot Tecnologia Ltda. ("Kinbot", "we", "us"), headquartered in Brazil. We act as data controller under the Brazilian General Data Protection Law (LGPD, Lei nº 13.709/2018) and process data of international users in accordance with applicable privacy regulations. For WhatsApp groups recorded by a team, the team decides what is recorded and acts as controller of that data; Kinbot processes it on the team's behalf (processor).

2. Data we collect

  • Identity: your name, e-mail address and profile picture, provided via Google Sign-In.
  • Contact: the WhatsApp phone number linked to your account.
  • Files: files you send to Kinbot via WhatsApp (in a private chat or in groups with file capture turned on). They are processed temporarily and saved to your Google Drive; Kinbot does not permanently store file contents — we only keep name, type, size, origin and date.
  • Group conversations (teams): in WhatsApp groups where a team added its bot number, we record messages (text, author — name and phone —, date, reactions, edits and deletions) and group data (name, description, picture and participants). The team owner or admins can turn message recording off per group or remove the group from Kinbot, which deletes its history.
  • Access data: IP address, browser/device and date of dashboard sign-ins, shown in Settings › Security so you can review and end your sessions.
  • Google Drive metadata: storage quota (used and total space), read only to display it in the dashboard.
  • Usage data: processing status, counters and technical logs — used for operation, security and support.

3. How we use Google user data

Kinbot requests the following Google OAuth scopes and uses them exclusively as described:

  • openid, email, profile — to authenticate you and display your name and profile picture in the dashboard.
  • drive.file — to create, rename, and organise files created by Kinbot in your Google Drive, and to read your storage quota (used/total space) shown in the Connections dashboard. We never read, modify, or delete any pre-existing files in your Drive.

Google user data is never used for advertising, never sold, never shared with third parties beyond the sub-processors listed in Section 5, and never used to train AI models.

4. Purpose of processing

  • To save and organise the files you send to Kinbot in your Google Drive.
  • To record the team's group conversations and show history, search and statistics to team members.
  • To authenticate you and keep your account and sessions secure.
  • To send confirmations and replies via WhatsApp, according to the sending settings.
  • To provide the team API to the integrations the team itself authorises.
  • To improve the service using aggregated metrics.

5. Data sharing and sub-processors

We share data only to the extent necessary to operate the service:

  • Google (Firebase Auth, Firestore, Cloud Run, Compute Engine, Google Drive) — authentication, database, servers, and your file storage.
  • WhatsApp (Meta) — messages travel through WhatsApp's infrastructure. Kinbot connects to the bot numbers as a linked device (WhatsApp Web) and may use the WhatsApp Cloud API.
  • Sentry — technical error monitoring of our services.
  • AI providers — when AI organisation is enabled on your plan, file content and metadata may be temporarily sent for classification, organisation and naming, only to provide the service and within the plan limits. The Free Plan does not use AI.
  • Your team members — the conversations, statistics and settings of the team's groups are visible to all team members.
  • Team integrations — if the team owner or an admin turns on the team API, the systems authorised with the team's keys can access the team data allowed by those keys. The team is responsible for how those integrations use the data.

We do not sell, rent, or otherwise commercialise your data.

6. Group participants

Participants of a group recorded by a team may not have a Kinbot account. The team that adds its bot number to the group is responsible for informing participants and for having a legal basis for the recording. Any participant may request deletion of their data at the e-mail below; the team may also remove the group from Kinbot at any time.

7. Data retention

Your data is retained while your account (or team) is active. A group's conversations are kept until the team removes the group from Kinbot. Upon account closure, data is removed within 90 days unless a longer period is required by law. Files saved to your Google Drive remain there under your control.

8. Your rights

You may request at any time:

  • Access to, correction, or deletion of your personal data, including closing your account.
  • Restriction or objection to processing.
  • Data portability to another service provider.
  • Revocation of consent (where processing is based on consent).
  • Information on who we share your data with.

To revoke Google Drive access at any time, visit myaccount.google.com/permissions and remove Kinbot, or disconnect it from the Connections page in the dashboard. Send other requests to privacidade@kinbot.com.br. We respond within 15 business days.

9. Security

We use TLS 1.2+ encryption in transit and at rest, Firebase Auth for authentication, role- and team-based access controls, sign-in session logging, and API keys stored only as irreversible hashes.

10. Changes to this policy

We will post updates on this page with a new effective date. Material changes will be communicated at least 15 days in advance via WhatsApp or your registered e-mail.

11. Contact and Data Protection Officer

For questions, requests, or to reach our Data Protection Officer:
privacidade@kinbot.com.br