Privacy Policy
Last updated: November 5, 2026
This policy explains how Desirafy Agents handles the data you authorize it to access in Google Calendar and the data of the WhatsApp conversations the agent handles. Desirafy Agents is a product of Desirafy, based in Curitiba (PR), Brazil.
1. Google Calendar data we access
When you connect your Google account, you grant three calendar permissions and, to identify the account, the email. We do not request any other calendar-related permission.
- See the list of your calendars (calendar.calendarlist.readonly): we read the name and ID of the calendars you are subscribed to, so you can choose which one the agent uses.
- View free/busy information (calendar.events.freebusy): we check whether you are free or busy at specific times, to offer slots to customers. This check does not return event titles or contents.
- See and edit events (calendar.events): we create, reschedule and cancel the appointments customers request over WhatsApp, on the calendar you chose.
- Google account email and identifier (openid and userinfo.email): used only to show which Google account is connected.
2. What we use this data for
Only to run the scheduling you set up: checking free times and creating, rescheduling or cancelling events on the calendar you chose.
We process this data based on performing the service you contracted and on your consent, given when you connect your Google account (Brazil's LGPD, art. 7, items I and V).
When an appointment is created, the event includes the customer's name, phone number and the notes of the request, so you can see who booked the slot.
We do not sell this data, do not use it for advertising, and do not use your calendar contents to train AI models.
3. WhatsApp conversations handled by the agent
To serve the customer, we store the conversation messages, the transcription of audio messages (not the audio file), contact names and phone numbers, and appointments. This data is used to reply to the customer and record the service.
The agent's knowledge base (documents you upload) is processed by an AI provider to generate embeddings, which let the agent search its content.
4. Where the data is stored
Database: PostgreSQL on Neon, São Paulo region (Brazil). It holds conversations, contacts, appointments and Google tokens.
Google tokens: encrypted before being written. The encryption key is managed by the application's own service.
Support files you upload for the agent (for example, product photos or brochures the agent sends to customers): Cloudflare R2, in a private bucket.
API and WhatsApp connection: Railway, Virginia region (United States). Part of the data processing therefore happens outside Brazil.
AI models and audio transcription: OpenRouter, which receives the conversation context and the customer's audio to reply and transcribe. OpenRouter may process data in the United States or in other countries outside the European Economic Area and the United Kingdom.
We use only models with Zero Data Retention (ZDR): neither OpenRouter nor the model provider keeps prompts and responses after processing.
OpenRouter states that it does not use inputs and outputs to train its own models. Content flagged by illegal-content screening may be retained for human review, where the law requires.
5. How long we keep it
Google tokens: deleted from the database when you disconnect the calendar, and access is revoked at Google.
Conversations, messages and contacts: deleted 12 months after the last message in the conversation, or earlier if you delete the conversation or contact.
Appointments: deleted 12 months after the event ends.
Support files you upload to the agent: kept until you delete them.
When you delete a conversation, we also delete its appointments from our system. The event already created in your Google Calendar is not deleted by us: remove it in Google Calendar if you want.
6. Who we share it with
We do not share your Google data with third parties, except the providers that operate the service:
- Neon: database (São Paulo, Brazil).
- Railway: hosting of the API and the WhatsApp connection (Virginia, United States).
- Cloudflare: website hosting and file storage (R2).
- OpenRouter: AI, embeddings and audio transcription.
- These providers have confidentiality and security obligations compatible with this policy.
7. How to revoke access to Google Calendar
You can revoke access at any time, in either of these ways:
- Inside Desirafy Agents: open the agent, go to the Tools step, in the Google Calendar block, and click Disconnect.
- In your Google Account: https://myaccount.google.com/permissions, then Desirafy Agents and Remove access.
8. How to request deletion
You can delete conversations, contacts and files directly in the app. To request deletion of all data from your account, email desirafy.oficial@gmail.com with the subject "Data deletion", from the email address of the connected Google account. We respond within 15 calendar days and delete tokens, conversations, appointments and files, except what the law requires us to keep.
9. Security
The website and API use HTTPS. The database connection uses SSL. Google tokens are encrypted before being written. Each account's data is isolated from other accounts.
10. How the AI uses the data
To reply to the customer, we send the current conversation context to an AI model through OpenRouter: recent messages, the contact's name, and the free times or the customer's own appointments. We send only what is needed to reply to that conversation.
Audio messages from the customer are sent for transcription, and the transcribed text goes back into the conversation. Documents in the agent's knowledge base are sent to generate embeddings (numerical representations), which let the agent search their content.
11. Audit log and notifications
We record important account actions with the date and the responsible user: connecting or disconnecting Google Calendar, and deleting a conversation.
When the agent hands a conversation to the team, it may notify the account owner by WhatsApp, at the number you registered in the agent settings.
12. How we use Google Calendar information
We use Google Calendar information only to offer the scheduling described in this policy. We do not sell this data and do not use it for advertising.
No person reads this data, except when necessary for security, to comply with the law, or with your consent. Scheduling is performed by the AI.
When an appointment is created, the event receives the customer's name, phone number and request notes. When checking availability, we read only whether a time is busy, without the title or contents of events.
13. Your rights
Under Brazil's General Data Protection Law (LGPD), you may at any time: confirm whether we process your data; access it; correct incomplete or outdated data; request anonymization, blocking or deletion of unnecessary data; request portability; revoke your consent by disconnecting Google Calendar; and learn with which providers we share your data. To exercise these rights, use the contact in section 11.
14. Controller and contact
The data controller is Desirafy, based in Curitiba (PR), Brazil. Contact for questions, deletion requests and exercising your rights: desirafy.oficial@gmail.com.
15. Changes
If we make a material change to this policy, we will notify you in the app or by email before it takes effect.
Google API
Use of information received from Google APIs: Desirafy Agents' use of that information adheres to the Google API Services User Data Policy, including the Limited Use requirements.