Privacy Policy

Last updated: October 27, 2026. Courtesy translation of the Portuguese version, which prevails if there is any discrepancy.

In short

Datafala turns natural language questions into SQL. It does not connect to the customer’s database and does not run SQL: it returns the query for the customer’s system to run.
On the website, we use Google Analytics to measure visits in aggregate, only if you accept cookies.
In the service, we store the data the customer registers in the panel (database structure, context, examples) and the question history, to operate and audit the service.
We do not sell personal data and we do not use customer content to train AI models.
Questions and requests about your data: contato@tisolutio.com.br.

1. Who we are and who this policy applies to

Datafala is a service operated by TI Solutio. This policy explains how we process personal data, under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018), in three environments:

Website (datafala.com.br): public pages presenting the product.
Panel (app.datafala.com.br): the area where customers register the database schema, the business context, examples, API keys and the AI provider key.
API: the interface customers’ systems use to send questions and receive the SQL.

2. Our role in the processing

We are controllers of the website data, the panel access accounts and the commercial relationship with customers.

As for the questions a customer’s end users ask through the API, and the data the customer registers in the panel, we act as processors: we process this data on the customer’s behalf and according to their instructions. The customer is the controller and answers to their own users for this processing. Data subject requests about this data should be made to the customer first; if they reach us, we will forward them to the customer.

3. What data we process and why

Data	Purpose	Legal basis (LGPD)
Website browsing: pages viewed, visit source, device and browser type, approximate location and Google Analytics cookie identifiers	Measure audience and improve the website	Consent (art. 7, I), given in the cookie notice
Contact: name, email, company and the content of the message you send us	Reply, present the product and negotiate the contract	Preliminary procedures to a contract (art. 7, V) and legitimate interest
Panel account: name, email, password (stored only as a hash) and access logs	Authenticate, protect the account and provide the contracted service	Performance of a contract (art. 7, V)
Security logs: date and time, IP address, event type and a fingerprint (hash) of the email, never the email in plain text, the password or the request contents	Prevent fraud and abuse, investigate incidents	Legitimate interest and compliance with a legal obligation (art. 7, II, and the Brazilian Internet Civil Framework, art. 15)
Customer content: database structure (DDL), business context, examples, questions sent to the API, generated SQL, ratings and comments	Generate the SQL, show the history and the prompt to the customer, measure quality and provide support	Performance of a contract, as a processor on the customer’s behalf
Billing data: legal name, CNPJ (Brazilian company tax ID), financial contact	Invoice and meet tax obligations	Performance of a contract and legal obligation

Datafala does not need personal data from the records in the customer’s database: it works only with the structure (tables and columns) and the text of the questions. We recommend that customers advise their users not to include sensitive personal data in questions, and not to register real personal data in examples or in the business context.

To count the customer’s active users, the API receives with each question an opaque identifier of the person, generated by the customer from its own internal ID (never a name or email). We store only a code computed with a secret specific to each customer, without the original value and without any link to the question history. Because the customer can still relate this code to the person, it is treated as personal data.

4. AI providers

To generate the SQL, Datafala sends the language model (LLM) provider chosen by the customer a prompt with the database structure, the context, the examples and the question. This uses the customer’s own API key, and the provider’s processing follows the contract and privacy policy between the customer and that provider. We store the provider key encrypted and only decrypt it at the moment of the call.

5. Cookies

Website: Google Analytics sets cookies (such as _ga and _ga_*) to distinguish visitors and sessions. It is only loaded if you click "Accept" in the cookie notice; declining does not affect your use of the site. Your choice is stored in your browser, and you can change it at any time: .
Website language: when you choose a language with the flags, we set the datafala_lang cookie with the language code (pt-BR, en or es) for one year, so the site opens in that language on your next visits. It does not identify you, is not used for analytics and, because it is needed to remember a choice you made, does not depend on the cookie notice. Without this cookie, on your first visit to the home page the language is chosen from your browser language or, failing that, from the approximate country reported by Cloudflare; that country is used only at that moment and is not stored.
Panel: we only use strictly necessary cookies to keep the session authenticated (HttpOnly, valid for a few hours and deleted on logout).

6. Who we share data with

We do not sell or rent personal data. We share only what is necessary with:

Infrastructure: a cloud server provider in Brazil, where the application and the database run, and Cloudflare, which delivers the website and protects traffic.
Google, for Google Analytics on the website.
Hostinger, which delivers by email the messages sent through the website contact form.
AI provider chosen by the customer, as described in section 4.
Authorities, when there is a legal obligation or a court order.

7. International transfers

Some of these providers, such as Google, Cloudflare and many AI providers, may process data outside Brazil. In these cases the transfer relies on the grounds in art. 33 of the LGPD, such as contractual clauses and safeguards offered by the providers. When the AI provider is chosen by the customer, it is up to the customer, as controller, to assess that transfer.

8. How long we keep data

Account data and customer content: for as long as the contract lasts. At the end, we delete the customer’s space and data, except what the law requires us to keep.
Access logs: at least 6 months, as required by the Brazilian Internet Civil Framework.
Count of the customer’s active users (code per person and month): 13 months, then deleted.
Commercial contact data: up to 2 years after the last interaction, or until you ask for deletion.
Billing data: for the period required by tax law.
Google Analytics data: according to the retention period configured in the tool.

9. Security

We adopt technical and administrative measures to protect data, including: HTTPS-only traffic; isolation of each customer’s data in its own database schema; passwords stored as hashes; API keys stored as hashes and shown only once; encrypted AI provider keys; usage limits per key and per customer; and security event logs without sensitive content. The generated SQL goes through a validation that only allows read queries over tables and columns authorized by the customer. No system is completely immune to incidents; if an incident with relevant risk occurs, we will notify those affected and the ANPD, as required by art. 48 of the LGPD.

10. Your rights

Under art. 18 of the LGPD, you can request, at any time:

confirmation that we process your data, and access to it;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
portability of the data to another provider;
information about who we share your data with;
objection to processing based on legitimate interest, and review of decisions made solely on the basis of automated processing.

Send your request to contato@tisolutio.com.br. We may ask for information to confirm your identity before fulfilling it. You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).

11. Data Protection Officer (DPO)

The communication channel with the data protection officer is the email contato@tisolutio.com.br.

12. Children and teenagers

Datafala is a service for businesses and is not intended for people under 18.

13. Changes

We may update this policy to reflect changes in the service or in the law. The date at the top indicates the last revision. Relevant changes will be communicated to customers through the panel or by email.