Privacy Policy

SAPIANS Venture Studio — the controller of personal data processed on this platform. We determine the purposes and means of processing in accordance with the LGPD.

Data Protection Officer (DPO): SAPIANS Privacy Team
Dedicated contact: privacidade@sapians.com.br (subject: “Privacidade / DPO”)
Response time: up to 15 business days (Art. 18, §5 of the LGPD)

We follow the principle of data minimization (Art. 6, III of the LGPD): we collect only what is necessary for each purpose.

We do not create behavioral profiles for commercial purposes. We do not make automated decisions with legal effects without provision for human review (Art. 20 of the LGPD).

SAPIANS uses third-party AI models to process queries and generate reports and analyses. This section explains our practices:

3.1 Minimization in AI requests: We send models only the content strictly necessary for the task. We do not include identifiable personal data in requests unless the service context requires it and you have been informed of this.

3.2 No use for training: We do not use your interactions to train our own models. The AI providers we use operate under terms that prohibit using customer inputs for model training — this contractual protection is a criterion for selecting our partners.

3.3 No impactful automated decisions: SAPIANS does not make automated decisions that produce legal effects or significant impacts on you. AI-generated reports and analyses are tools to support your decisions; they do not replace qualified human assessment for regulated professional, legal or financial purposes.

3.4 Content is not stored after processing: Data processed by AI to generate outputs is not retained in our own databases after processing.

We do not sell, rent or monetize your personal data. We share it only with the following partners, strictly necessary to operate the service:

International transfers (Arts. 33–36 of the LGPD): Some of the providers above process data outside Brazil. We adopt the following compliance mechanisms: (a) standard contractual clauses (SCCs) equivalent to those of the European Union, and (b) a requirement that providers meet recognized international security standards.

We do not share data with governments, advertisers or third parties not listed above, except pursuant to a court order or a request from a competent authority under the law.

We do not use tracking, advertising or remarketing cookies. We do not use conversion pixels, fingerprinting or cross-session tracking for commercial purposes.

We use only:

• Session cookies (essential): necessary to keep you authenticated while using the platform. Legal basis: performance of a contract. Deleted when the session ends or after expiration.
• Technical CDN cookies (Cloudflare): necessary for secure content distribution and protection against attacks. Legal basis: legitimate interest. They do not identify you personally.

There is no cookie consent banner because we do not use cookies that require additional consent — all cookies in use have an independent legal basis.

Under Art. 18 of the LGPD, you have the following rights, which you may exercise at any time:

• Confirmation and access: know whether we process your data and obtain a copy of it.
• Correction: update incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion: for data processed excessively or unnecessarily.
• Deletion: request deletion of data processed on the basis of consent, subject to legal retention obligations.
• Portability: receive your data in a structured and interoperable format.
• Information on sharing: know which entities we share your data with.
• Withdrawal of consent: withdraw consent given, without affecting processing prior to withdrawal.
• Objection: object to processing based on legitimate interest when there is a violation of the LGPD.
• Review of automated decisions: request human review of any automated decision that produces effects on you.
• Petition to the ANPD: if your rights are not honored, you may petition the National Data Protection Authority at gov.br/anpd.

How to exercise your rights: email privacidade@sapians.com.br with the subject “Direitos LGPD”. We respond within 15 business days.

After account closure or a deletion request, your identifiable personal data is removed or anonymized. Data that has already been anonymized — which does not allow reidentification — may be retained for statistical purposes.

We adopt technical and organizational measures appropriate to the risk, including:

• encryption in transit (TLS/HTTPS);
• restricted access control under the principle of least privilege;
• secure authentication through SAPIANS ID;
• monitoring of access and anomalies;
• perimeter protection through Cloudflare WAF/DDoS.

Security incidents: In the event of an incident that may pose a relevant risk or harm to data subjects, SAPIANS will notify the ANPD within 3 business days after becoming aware of the event (CD/ANPD Resolution No. 15/2024) and will communicate with affected data subjects clearly and promptly.

The SAPIANS platform is not directed at people under 18 and does not intentionally collect data from children or adolescents (Art. 14 of the LGPD in conjunction with the Brazilian Child and Adolescent Statute — ECA).

If we identify that a minor’s data was inadvertently collected, we will take immediate measures to delete it. If you are responsible for a minor and believe they have provided data on our platforms, contact us at privacidade@sapians.com.br.

When a professional acts both as a platform User and as a specialist co-founder in a SAPIANS project — with an equity stake —, data processing related to the corporate and contractual relationship (due diligence, business communications, agreement documentation) is governed by the specific Co-Founding Agreement and corporate legal obligations, rather than exclusively by this Policy. For questions about data processing in this context, contact us at privacidade@sapians.com.br.

We may update this Policy periodically to reflect changes in our solutions, processing practices or applicable legislation. Substantial changes will be communicated by email at least 30 days in advance. The current version is always the one published on this page, with the update date shown at the top.

For changes that expand the scope of processing based on consent, we will request new authorization before applying them.

SAPIANS Venture Studio
Data Protection Officer (DPO): SAPIANS Privacy Team
Email: privacidade@sapians.com.br (subject: “Privacidade / DPO”)
Response time: up to 15 business days

ANPD portal (petitions and complaints): gov.br/anpd