Privacy policy

TengiFlow is operated by Gabriel Leite Borba, an individual, who is the controller of your data. For anything about your data, including reaching the person responsible for data protection, write to contact@tengiflow.com.

• Account data: name, email and password (stored encrypted). If you sign in with Google or Microsoft, we receive the account’s name and email.
• Content you and your team put into TengiFlow: tasks, lists, comments, attachments, logged hours and, if you use that feature, meeting audio.
• Payment data: processed by Stripe. TengiFlow never receives or stores your card number.
• Technical data: access logs (IP address, browser, date and time), required by Brazilian law, and the cookies needed to keep you signed in.

• Providing the service you signed up for: creating your account, storing your work, sending notifications and due date reminders (performance of contract).
• Billing for a paid plan, when there is one (performance of contract).
• Keeping the service secure and running, and preventing fraud and abuse (legitimate interest).
• Complying with legal obligations, such as keeping access logs for the period required by law (legal obligation).

When you use an AI feature (for example, asking for a task summary, assigning a task to the AI or asking your workspace a question), the content needed for that answer is sent to the Vercel AI Gateway, which routes it to the provider of the model used for that feature: Anthropic, Google, OpenAI or other open-model providers. Meeting audio sent for transcription goes to ElevenLabs. If you set up your own AI key, the content goes to that key’s provider.

Web search in the “Ask” feature, when used, sends the question to the Tavily search service. Besides the features someone in the workspace triggers, the AI runs on its own in two cases: each person’s daily summary and the tasks assigned to it.

Only with the providers that make the service work, and only what each of them needs:

• Supabase: database, sign-in and files.
• Vercel: hosting for the website and the app.
• Stripe: payments.
• Resend: sending emails.
• AI and search providers, as described above.

We do not sell personal data. We may also share data when a law or court order requires it.

Some of these providers store or process data on servers outside your country, mainly in the United States, including the processing of AI features and transcription. In those cases the transfer is done as permitted by law for the performance of our contract with you, and under the providers’ contractual safeguards.

For as long as your account exists. If you delete a workspace, its content is deleted. If you delete your account, the workspaces only you use are deleted; what you created in someone else’s workspace (tasks, comments, attachments) stays there, no longer linked to you. In both cases, we keep what the law requires us to keep longer, such as access logs (6 months) and billing tax records. Deleted data may remain in our providers’ backups until those backups expire.

You can, at any time: confirm whether we process your data; access it; correct incomplete or wrong data; ask for anonymization, blocking or deletion of unnecessary data; ask for portability; know who we share it with; withdraw consent; object to processing, including processing based on our legitimate interest; and ask us to restrict processing.

To exercise any of these rights, write to contact@tengiflow.com. You can also complain to your data protection authority (in Brazil, the ANPD).

We only use the cookies needed for you to sign in and stay signed in. Your theme (light or dark) and language preferences are stored in your own browser. We don’t use advertising or tracking cookies.

Data travels encrypted (HTTPS), access to a workspace’s content is restricted to its members, and AI keys you add are stored encrypted.

If this policy changes in a way that affects your rights, we’ll let you know by email or in the app before the change takes effect.