Privacy Policy

DUNAS DESENVOLVIMENTO DE SOFTWARE LTDA, enrolled with the Brazilian CNPJ under No. 64.717.332/0001-74 (“NativePort”, “we”, “us” or “our”), is seriously committed to your privacy and to the protection of your personal data. We prepared this notice (“Privacy Policy”) to explain which personal data we process, how we use it, with whom we share it, and how long we keep it.

This Privacy Policy applies to nativeport.ai — our web-access API gateway that gives you and your AI agents a single API key and a unified endpoint for many third-party search, scraping, browser-automation, voice, document-parsing and AI model-inference APIs (“Upstream Providers”), with usage metered as credits against your account (the “Service” or “Platform”). For more information on how the Service works, please see our Terms of Service.

This Privacy Policy does not apply to the Upstream Providers or to any other third-party products, services or content that may be offered, integrated or accessed through the Service. NativePort does not control, endorse or take responsibility for third-party services, content, tools, AI models, systems or platforms, even when they are reachable through our Platform. We recommend that you review the privacy policies of any website, platform or third-party service you interact with — including the Upstream Providers your requests are routed to — before sending data through the Service.

By accessing or using the Service, you (“you” or “User”) acknowledge and agree to the terms of this Privacy Policy, including the legal principles that underpin it. Acceptance of this Privacy Policy is an essential condition for the full use of the features offered.

If you have any questions about this Privacy Policy or about the processing of your personal data, please contact us at [email protected] and we will be glad to help.

Summary Table

This Summary Table is for information purposes only and does not replace reading this Privacy Policy and the Terms of Service in full.

Definitions

To make this Privacy Policy easier to understand, the main terms used are set out below. Every capitalized word has the meaning indicated here whenever it appears in this document.

• ANPD — the Brazilian National Data Protection Authority, the public body responsible for overseeing, implementing and enforcing the LGPD.
• Consent — the free, informed and unambiguous expression by which the data subject agrees to the processing of their personal data for specific purposes.
• Personal Data — any information relating to an identified or identifiable natural person, such as name, identification numbers, email address, IP address, among others.
• Data Protection Officer (DPO) — the person appointed to act as a communication channel between NativePort, data subjects and the ANPD.
• AI / AI Agents — artificial-intelligence systems, statistical models, automated tools or algorithms — including the Upstream Providers and the User’s own agents — capable of analyzing data and generating outputs or recommendations based on patterns.
• Upstream Providers — the independent third-party search, scraping, browser-automation, voice, document-parsing and AI model-inference APIs that the Service routes your requests to.
• LGPD — Brazilian Law No. 13.709/2018, the General Data Protection Law, which governs the processing of personal data, including in digital media.
• Data Subject — the natural person to whom the processed personal data relates.

Collection of Personal Data

We collect certain information when you use the Service. This includes information you provide, information we collect automatically, and information provided by third parties.

Information you provide

• Account data — information you must submit to register and authenticate, including your name and email. Authentication is handled through our identity provider, and you may sign in using email or a supported third-party (social) login. The provision of certain account data is essential to enable access to the Service; without it, registration and use are not possible.
• Request content — everything you (or your AI agents) submit through the gateway to be processed and routed to an Upstream Provider, such as search queries, URLs and pages to scrape or crawl, browser-automation instructions, text to synthesize into speech, documents or document URLs to parse, prompts and messages sent to AI models, parameters and any other inputs — together with the responses returned by the Upstream Provider. This content is necessary to route and fulfill your requests.
• Billing data — when you purchase credits, payment is handled by our third-party payment processor. We receive limited information (for example, confirmation that a payment succeeded, billing country and the last digits of the card), but we do not collect or store full card numbers.
• Communications — information you provide when you contact us through our official channels, including support requests and reports of technical issues.

Data collected automatically

• Usage and metering data — logs and events relating to how and when you use the Service: which endpoint and Upstream Provider you call, timestamps, request status, request size and the credits or units consumed. This data is used to operate, meter, bill and secure the Service.
• Device and technical information — IP address, user-agent, client or SDK information, device type, browser type and version, unique identifiers and network data. Our analytics provider derives an approximate location (country, region and city) from your IP address.
• Website analytics and session recording — on nativeport.ai we record which pages you view, the button you used to sign up and how you arrived (for example, the campaign parameters and click identifiers in the link you followed, such as utm_source, Google’s gclid, Facebook’s fbclid or Instagram’s igshid, and the referring website). We also record sessions on nativeport.ai to see how the pages are used: every piece of text and every form input is masked in your browser before anything is sent, so a recording shows the page layout, scrolling and clicks, never what you read or type. The dashboard at panel.nativeport.ai does not record sessions.
• Advertising click identifier — when you reach nativeport.ai from a Google ad, the link carries a Google click identifier (gclid). We use it only to measure our own ads, as described under Cookies.
• Web fonts — every page on nativeport.ai loads its fonts from Google Fonts (fonts.googleapis.com and fonts.gstatic.com). Your browser requests them from Google directly, so Google receives your IP address and browser information and processes them under its own terms. This happens on every visit, whatever you choose under Your choices about analytics and advertising.
• Diagnostics — error reports, performance metrics and error logs collected through our diagnostics tooling, to identify and fix problems.
• Cookies — cookies are internet files that may be temporarily stored on your devices. On our website and dashboard we use cookies to improve your experience, remember preferences, ease navigation, analyze usage and measure our ads. The Service uses the following types of cookies:
  • Strictly necessary — required for the Service to work, including authentication on the dashboard.
  • Functional — help deliver enhanced features, such as language preferences.
  • Attribution — the first-party np_attr cookie on .nativeport.ai records how you first and most recently reached us (campaign parameters such as utm_source, the referring website and the sign-up button you used), never your name or email. It lasts up to 90 days and lets the dashboard attribute a sign-up to the page or campaign that led to it.
  • Performance / analytics — cookies set by our analytics provider (PostHog) let us understand how the Service is used, including the masked session recordings described above.
  • Advertising measurement — nativeport.ai loads the Google Ads tag (gtag.js) of our Google Ads account. When you arrive from a Google ad, Google stores the click identifier in the first-party _gcl_aw cookie on .nativeport.ai. If you then sign up or claim the welcome credit on the dashboard, the dashboard may report that conversion to Google Ads with the click identifier and an opaque transaction reference. We never send Google your name, email or payment details, and Google’s enhanced conversions feature is turned off. When the tag loads, Google also receives your IP address and browser information and processes them under its own terms.
  • Your choice — the __ph_opt_in_out_ cookie records whether you turned tracking off (see Your choices about analytics and advertising).

Data we do NOT collect

• Precise location — we do not collect precise geolocation (such as GPS). The approximate location described above is derived from your IP address only.
• Full payment card data — we do not store complete card numbers; payment data is handled by our payment processor.
• Sale of personal data — we do not sell your personal data for money. We use the Google Ads click identifier described under Cookies only to measure our own ads; our website analytics also records the other click identifiers a link may carry, such as fbclid and igshid (see Website analytics and session recording above). You can turn both off.
• Upstream Provider credentials are not yours to handle — the credentials used to authenticate with Upstream Providers are injected by us server-side and are never exposed to you, so you never transmit them to us.

Data provided by third parties

• We may receive data from authentication providers, payment processors, fraud-prevention tools, technology service providers, security systems or operational partners that help verify identity, validate information or support the operation of the Service.
• We may process personal data contained in the content of the requests and responses routed through the Service, including where third parties are referenced in that content.
• Where you use the Service together with third-party services, we may receive data through those services. In those cases, the third party’s own terms and privacy policies govern that use.

Personal data of minors

The Service is not intended for individuals under 18 years of age and is permitted only for persons with full legal capacity. If we identify registration, use or provision of personal data by a minor, NativePort may delete the account and remove the associated data, in accordance with applicable law.

Sensitive personal data

NativePort does not request, process or use sensitive personal data in the context of the Service. Exceptionally, the content of the requests and responses routed through the Service may contain sensitive personal data inserted by you. In those cases, the processing is incidental and limited to what is necessary to operate the Service, and NativePort adopts appropriate technical and administrative measures and observes the principles and safeguards of the LGPD.

Purposes for Using Personal Data

We use the information we collect for the reasons below and in accordance with the applicable legal bases.

To perform our contract with you

• Provide and operate the Service, including routing your requests to the relevant Upstream Provider, returning the responses, and metering and charging the credits consumed.
• Create, configure, authenticate and manage your account and API keys.
• Where you enable additional features or integrations, process the information necessary according to your settings and permissions.
• Contact you about your account, including for verification, security, prevention of unauthorized access and relevant operational communications.
• Respond to your requests and questions, including support requests and reports of technical issues.

For our legitimate business interests

• Keep the Service secure, prevent misuse, identify suspicious activity, combat fraud and abuse, and enforce our Terms of Service.
• Analyze how Users interact with the Service, identify useful features, develop new capabilities and continuously improve the experience.
• Send communications about news, updates, features or invitations to participate in tests, surveys or pilots. You can adjust your communication preferences at any time.

Automated screening of the welcome credit

New accounts receive a welcome credit. To stop it from being abused, for example by one person opening many accounts, we screen each new account with automated tools:

• What is screened — a pseudonymised record of signals about the account: its age range, how much of the welcome credit it has used and whether it has bought credits, and whether it shares patterns with other accounts. Those patterns are computed from keyed one-way hashes of the email address and of the network part of the IP address, and from the network operator (ASN). The record carries no name, email address or IP address; its only identifier is a keyed hash of the account ID.
• Who screens it — two AI models from different providers, Anthropic and OpenAI, each assess the same record. They act as our sub-processors for this purpose only.
• What can happen automatically — if both models find no sign of abuse, the welcome credit is released without human involvement. If both find abuse under strict rules we set, the welcome credit may be withheld automatically. Every other outcome goes to a person. A withheld welcome credit does not affect your access to the Service, your account or any credit you paid for, and only a person can release it.
• Your right to a human review — you can ask for a person to review any automated decision about your welcome credit by writing to [email protected].

To comply with our legal and regulatory obligations

• Retain and use your information when necessary to meet legal or regulatory obligations, including responding to requests from authorities, audits, fraud prevention and administrative or judicial requirements.
• When you exercise your rights under the LGPD, we may request additional information to confirm your identity and protect your account and privacy.

To protect life and physical safety

We may collect, use or share personal data when we believe in good faith that it is necessary to protect the life or physical safety of you or others.

Sharing Personal Data with Third Parties

We may share your personal data with:

• Upstream Providers — to fulfill a request, we transmit the relevant request content to the Upstream Provider you invoke (for example, a search query to a search provider, a URL to a scraping provider, or text to a voice provider). Those providers process that content under their own terms and privacy policies. This sharing is limited to what is necessary to execute the feature you requested.
• NativePort group companies (affiliates) — for administrative, operational, support, internal-audit and continuity purposes, your personal data may be shared with entities of the same economic group, in Brazil or abroad, subject to the safeguards required by the LGPD.
• Service providers and operational partners (sub-processors) — we share personal data with third parties that help us run essential aspects of the Service, including: cloud hosting, edge compute and storage (Cloudflare and Amazon Web Services); authentication and identity management (Clerk); payment processing (Stripe); product analytics and session recording (PostHog); advertising measurement (Google, through Google Ads); transactional and account email (Resend); screening of the welcome credit with AI models (Anthropic and OpenAI, see Automated screening of the welcome credit); and fraud prevention, identity verification, user support, security and other necessary technology. These third parties process personal data only under NativePort’s instructions and subject to confidentiality obligations.
• Corporate transactions — in the event of a merger, demerger, acquisition, sale or transfer of assets, or any corporate transaction, your personal data may be transferred to the parties involved, subject to confidentiality and the level of protection required by the LGPD.
• Exercise of rights — your personal data may be shared with lawyers, accountants, consultants or other legal representatives, for the regular exercise of rights or defense in judicial, administrative or arbitration proceedings.
• Judicial or administrative requests — we may share your personal data to comply with court orders, ANPD determinations or requests from any other competent public authority.
• Compliance with legal or regulatory obligations — your personal data may be shared to meet specific legal requirements applicable to NativePort, including tax, consumer, security or data-protection obligations.

NativePort uses its best efforts to ensure that all third parties with whom it shares personal data observe comparable standards of information security and data protection, adopting appropriate contractual and technical measures.

International Transfer of Personal Data

As a rule, NativePort processes and stores personal data on servers located in the United States of America (Cloudflare and Amazon Web Services). International transfers may also occur because our sub-processors and the Upstream Providers your requests are routed to may be located in various countries.

These transfers will always take place in line with the legitimate purposes set out in this Privacy Policy and the legal grounds provided by the LGPD. Where a transfer is made to a country without an adequacy decision from the ANPD, NativePort will adopt appropriate safeguards.

Retention of Personal Data

NativePort processes your personal data securely and only for as long as necessary to achieve the legitimate purposes set out in this Privacy Policy. We may keep your personal data for as long as necessary to comply with legal or regulatory obligations, to perform contracts, to defend our rights in proceedings, while a legitimate interest persists, or until the end of processing.

Specific retention periods

• Account data — retained while your account is active. If your account is deleted, your account data is removed from our servers within 30 days, except where retention is legally required.
• Usage and billing records — retained for the period required to meter usage, process payments and comply with tax, accounting and audit obligations.
• Request and response content — processed transiently to fulfill your requests. Associated request logs may be retained for a limited period (typically up to 90 days) for security, abuse prevention, debugging and metering, after which they are deleted or anonymized, except where longer retention is legally required.
• Diagnostics — error reports and performance data are retained for up to 90 days.

Your choices about analytics and advertising

You can turn off tracking on nativeport.ai in this browser:

• What “Do not track me” turns off — website analytics and session recording on nativeport.ai, the np_attr attribution cookie, the Google Ads tag on nativeport.ai and the ad conversions the dashboard would report to Google. It also deletes the np_attr and _gcl_aw cookies already stored in this browser.
• What stays on — strictly necessary cookies, such as the ones that keep you signed in to the dashboard; the product analytics inside the dashboard (panel.nativeport.ai), which records no sessions; and the usage and billing records the Service needs to meter and charge your requests.
• Global Privacy Control — if your browser sends the Global Privacy Control (GPC) signal, we treat it as the same choice automatically and record it in this browser. While your browser sends GPC, tracking cannot be turned back on from this page.
• Per browser — the choice is stored in a cookie on .nativeport.ai, so it applies to this browser only and is lost if you clear your cookies.

Data Subject Rights

As a data subject, you have the rights guaranteed by the LGPD, which may be exercised by a request addressed to NativePort:

• Right to confirmation — to know whether we process your personal data.
• Right of access — to access the personal data we process about you.
• Right to rectification — to request the correction of incomplete, inaccurate or outdated data.
• Right to anonymization, blocking or deletion — to request the anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law.
• Right to portability — to request the transfer of your personal data to another service or product provider, under ANPD rules.
• Right to deletion of data processed with consent — subject to legal retention obligations.
• Right to information — to be informed about the public and private entities with which we share your data, and about the possibility of not providing consent and its consequences.
• Right to withdraw consent — to withdraw consent previously given.
• Right to review of automated decisions — to request a review of decisions made solely on the basis of automated processing that affect your interests, such as the screening of the welcome credit.
• Right to petition the ANPD — if you are not satisfied with our response, you may petition the ANPD through its official channel.

To exercise any of these rights, send your request to NativePort’s Data Protection Officer at [email protected], including: (i) your full name; (ii) the right you wish to exercise; and (iii) any additional information needed. We may request proof of identity to ensure that data is provided only to the respective data subject.

Security of Personal Data

NativePort adopts technical and administrative measures designed to protect personal data against unauthorized access and accidental or unlawful destruction, loss, alteration, communication or any form of inappropriate or unlawful processing. These measures include encryption in transit (TLS), access controls, data segregation, server-side injection of Upstream Provider credentials so they are never exposed to clients, and continuous monitoring.

Although NativePort uses all reasonable efforts to keep the personal data under its custody secure, no system is completely invulnerable to security incidents, and we cannot guarantee the absolute inviolability of our databases. If you suspect any compromise to the security of your personal data, please contact our Data Protection Officer immediately at [email protected].

Updates to this Privacy Policy

NativePort may update this Privacy Policy at any time, especially to reflect changes in applicable law, in our data-processing practices or in the features of the Service. We recommend that you review this document periodically. Updates take effect on the date they are published. Continued use of the Service after publication will be interpreted as agreement with the updated terms.

How to contact us

If you wish to exercise any of the rights set out in this Privacy Policy and the LGPD, or have questions, suggestions or complaints about the processing of your personal data, please contact our Data Protection Officer:

Data Protection Officer (DPO) — [email protected]

Company — DUNAS DESENVOLVIMENTO DE SOFTWARE LTDA

CNPJ — 64.717.332/0001-74

Address — Av. Paulista 1636, Conj 4, Pavmto 15, Sala 1504, São Paulo, SP 01310-200, Brazil