Updated on November 2, 2026
Privacy policy
How WebHub handles the data of people who visit the site, people who use Trato, and the contacts of the companies that use Trato.
Who we are and how to reach us
WebHub is the company that makes Trato, Fiqo and Qiro. In this policy, "we" is WebHub and "you" is anyone who visits the site, creates or uses a Trato account, or is a contact of a company that uses Trato.
For any request about your data, write to privacy@wearewebhub.com. It is also the address of our data protection officer.
The roles: who decides about the data
People who visit the site and people who create a Trato account have their data handled by WebHub, which decides how and why: WebHub is the controller.
The contacts of a company that uses Trato (its customers, the people who write to it) have their data handled on behalf of that company. The company is the controller and decides what comes in, what goes out and why; WebHub is the processor and does only what the service needs. If you are a contact of a company, a request about your data goes to that company first; WebHub helps the company fulfil it.
The WebHub site
The site uses no tracking, no audience measurement and no advertising. There are no third-party cookies, and the fonts are served from our own address.
When you send a form (the free trial, the Fiqo or Qiro pilot, the assisted setup, the demo or the contact form), we keep what you wrote: name, company, email, WhatsApp and the answers in the form, plus the language, the page you came from, the browser and the time. We use that data only to answer what you asked for. Your IP address is not stored: it only enters, scrambled, a counter that limits repeated submissions.
The banner that suggests the Brazilian or the international version keeps your choice in your own browser, with no identifier.
Your Trato account
To create an account, we ask for a name, an email and a password, or sign-in with Google. Through Google we receive only the name and email of the Google account; we ask for nothing else. The password is never kept in readable form.
From the browser we read the language, the country and the time zone so the company starts configured. We also keep the acceptance of the terms: the version of the text, the language and the time.
The session lives in a cookie of Trato itself, needed to keep you signed in. There is no advertising cookie.
To charge for the plan, we keep the billing details the company provides (legal name, tax identification and billing email) and the invoices. The card stays with the payment provider; WebHub keeps only the brand, the last four digits and the expiry date, never the number.
We use your email for what the service needs: confirming the account, recovering the password, inviting someone, billing notices and changes to the service. No promotion unless you ask for it.
The data companies bring into Trato
A company that uses Trato brings the data of its contacts: name, email, phone, organization, language, fields it creates itself, the messages exchanged by email, WhatsApp and the other channels it connects, the team's notes, and the events from its website (a page viewed, a form sent) when it installs the Site tag.
Audio, images and documents sent by a contact come in too. Trato transcribes the audio and describes the image or document for the team to read. The file is kept for 180 days and then leaves storage; the transcript or the description stays as the text of the message.
When creating the account, importing contacts and using the API, the company declares that it has the contacts' consent to reach them and the data deletion mechanisms the law requires. Trato guarantees what is its own: whoever asks to stop goes into Do not contact and receives nothing more, on any channel; every email from Trato carries an unsubscribe link; WhatsApp follows the platform's rules; and Delete permanently erases the contact's data.
How Trato uses language models
Trato writes, classifies and summarizes with language models. To do so, it sends those models the part of the conversation and of the company's context that the task needs, never more than that. The package sent is recorded next to the generated message, so the company knows what Trato saw.
The providers of those models are Anthropic, OpenAI, Voyage AI and TypeSafe, contracted on commercial terms that do not allow the data to be used to train their models. Code decides whom Trato reaches out to, when, through which channel and when the conversation is handed to a person; the model only writes and classifies, and every message goes through checks in code before it leaves.
Who the data is shared with
To work, Trato relies on third-party services, each with access only to what its part needs:
- Railway (the servers and the database) and Cloudflare (delivery, files and this site).
- Amazon Web Services (sending and receiving email), Meta (the WhatsApp Business platform) and Google (sign-in with Google).
- Stripe (card payments).
- Anthropic, OpenAI, Voyage AI and TypeSafe (the language models).
- Sentry (system error logging, with no screen recording and none of the contacts' data).
The servers are in the United States, so data may be transferred to another country. The transfer relies on contractual data protection clauses with each provider. We do not sell data and do not hand it to anyone outside this list, except under a legal obligation.
For how long
The minimum, and only while it serves:
- Account data stays while the account exists. At the end of the free trial without payment, the account becomes read-only for 30 days and then the data is deleted, with notice beforehand. On a paid plan, an overdue charge makes the account read-only on day 30 and deletes the data on day 90, with notice. Whoever cancels keeps the data until the end of the paid period.
- A contact the company deletes permanently leaves at once: their data and the text of the messages are erased; only numbers remain, with nothing that points to the person.
- Messages from people who are not contacts and were read as spam or automatic replies are kept for 30 days and then deleted. An email or phone number that arrives through an event and finds no contact is deleted in 30 days.
- Audio, image and document files are kept for 180 days.
- Submissions of the forms on this site are kept until the team answers and records the contact, and then deleted.
- Database backups are deleted within the short recovery window, and a restore reapplies the deletions made after the restored point.
Your rights
You can ask for confirmation that we process your data, access to it, correction, anonymization or deletion, portability, information about whom we share it with, and the withdrawal of a consent. Write to privacy@wearewebhub.com; we answer within the legal deadline.
If you are a contact of a company that uses Trato, the request goes to that company, which has in Trato the means to fulfil it (Do not contact and Delete permanently). If you prefer, write to WebHub and we forward it to the company.
You can also complain to your data protection authority. In Brazil, it is the ANPD.
Security
Data travels encrypted, each company's access is isolated in the database, passwords are protected by a hash function, secrets stay out of the code, and the WebHub team's access is restricted to what is necessary and logged. No system is infallible: if an incident affects your data, we notify you and the authority as the law requires.
Minors
Trato is for companies. It is not directed at people under 18, and we do not create accounts for them.
Changes to this policy
When the policy changes, we publish the new version here, with the date. A change that affects your rights is announced by email to account holders.