Privacy Policy · 2026-10-15

XRESET may offer Google Analytics 4 solely on its public home page for statistics on visits and clicks at limited button positions, and, separately, Meta Pixel solely to record the commercial visit. This offer dated 15 October 2026 updates only these points of the earlier operational addendum, retained below as a record. Publishing this text does not establish that the features are installed or active: each option depends on availability, technical controls and a prior choice.

Each option starts disabled. Before loading the relevant provider or transmitting any data, the home page presents its purpose and a specific choice. Refusing is as easy as allowing, does not prevent product use and can be revised through the same control. Accepting the Policy, purchasing or authorising research/VITA does not authorise these options; allowing Google does not allow Meta. Anyone who refuses remains without transmission to the relevant provider under this offer. To remember the choice, local storage holds only the version, date and Google/Meta options for up to 180 days, without a visitor or account identifier. If saving a refusal fails, we may retain a blocking-only marker in session storage and/or a first-party cookie for up to 180 days, without an identifier. These preference records are not sent to Google/Meta.

Google Analytics 4 is distinct from Google Cloud/Vertex AI used by VITA. If you allow Analytics, Google code measures the visit and limited click position and also generates technical first-visit, session-start and engagement-time events. It receives pseudonymous browser/session identifiers, technical browser/device data and the connection IP address. This is therefore neither anonymous collection nor only two manual events.

For the Google option, the transmitted address is the home page, without query, fragment or referrer. We do not send XRESET account, order, answers, results, health information, research or conversations. Measurement does not follow login, signup, checkout, purchase return, account, assessment, report, shared links, VITA or administration. Analytics has no User-ID, Google Signals, personalisation, remarketing, user-provided data or advertising links. Google Ads, GTM and CAPI are not part of this offer.

Google analytics cookies are limited to the XRESET host. The browser-identifier cookie (xr_ga) lasts up to 30 days from creation, without automatic renewal on new visits. The session-state cookie (xr_ga_7J20EY0HTW) has a lifetime of up to 30 days that may be renewed with activity while optional measurement is active. Configured retention for user and event data is 2 months, without resetting on activity; this period does not apply indiscriminately to aggregate reports. Withdrawal stops new transmissions and removes this option's first-party cookies, without promising automatic retroactive deletion of all data already sent.

The Meta option, if made available, requires its own authorisation and sends only the canonical home-page visit, without query, fragment, sensitive referrer or free-form parameters. Meta receives IP and technical browser/device data, may use existing third-party cookies and associate the visit with your Meta account for measurement, personalisation and ad delivery. Pixel first-party cookies, matching, automatic events and custom audiences are disabled for this offer; we do not send Lead, Purchase, XRESET account, order or personal/health content. A Google choice does not authorise Meta.

Meta terms permit retaining events for up to 2 years. Withdrawal prevents new transmissions by XRESET but does not automatically erase earlier events or Meta-account data/cookies. Google and Meta may process data outside Brazil under each service's processing and transfer terms. This information describes the offer and its limits without certifying contracts or compliance; it does not enable data prohibited by the provider, even after consent.

These are new options based on your informed action: provider information and notice precede the choice and nothing is transmitted to the relevant provider if you refuse. This route does not remove the 30-day notice for automatic provider additions or other substantial changes applying to the existing base without this choice. Expansions of consent-based processing still require new authorisation. The earlier factual correction was not an activation notice, and accepting the new privacy version does not grant these optional authorisations; the Terms do not change.

For access, clarification, withdrawal or deletion concerning each provider, email privacidade@sapians.com.br. Withdrawing an option does not affect contracted access. Separate operational records for authentication, acceptance, purchases, entitlements and care remain separate.

This addendum corrects the factual description of XRESET tracking and diagnostics in sections 4 and 5 and on the cookies and providers pages. For these XRESET facts, it takes precedence over the June 2026 institutional text reproduced below. The other clauses remain in the June institutional edition; this addendum does not extend these facts to other SAPIANS websites or services.

XRESET neither issues nor reuses the xr_v analytics cookie. A previous cookie is expired when a measurement call from the home page is received, checkout is started or account deletion is requested. Authentication, proof of acceptance, purchases, payments and access entitlements retain their own operational records.

Vercel Web Analytics and Speed Insights have been suspended since 15 October 2026. Vercel continues to host the application and process operational logs. GA4, Google Ads, Meta Pixel and CAPI remain unconnected to the application; preparing account resources did not install website collection or create advertising audiences.

Residual commercial counts use limited categories without creating a new link to a visitor, account, session or order. Earlier records may retain these links: pausing collection does not erase history. The retention routine provides for up to 13 months of raw events and daily aggregation; this period and existing copies remain under review, with no new deletion guarantee made by this addendum.

Three VITA operational event types — message sent, answer delivered and technical error — retain the account and session correlation needed to detect failures. Sentry receives operational diagnostics with URL and sensitive-field protection; account identifiers and technical records may remain. These records are pseudonymised, not necessarily anonymous, and are not used to create advertising profiles.

This addendum records a factual correction and a reduction in collection. It does not enable a new advertising integration, create a new legal basis or certify contracts, transfers or compliance. You may request access, clarification or object to processing by emailing privacidade@sapians.com.br.

SAPIANS Venture Studio — the controller of personal data processed on this platform. We determine the purposes and means of processing in accordance with the LGPD.

Data Protection Officer (DPO): SAPIANS Privacy Team
Dedicated contact: privacidade@sapians.com.br (subject: “Privacidade / DPO”)
Response time: up to 15 business days (Art. 18, §5 of the LGPD)

We follow the principle of data minimization (Art. 6, III of the LGPD): we collect only what is necessary for each purpose.

We do not create behavioral profiles for commercial purposes. We do not make automated decisions with legal effects without provision for human review (Art. 20 of the LGPD).

SAPIANS uses third-party AI models to process queries and generate reports and analyses. This section explains our practices:

3.1 Minimization in AI requests: We send models only the content strictly necessary for the task. We do not include identifiable personal data in requests unless the service context requires it and you have been informed of this.

3.2 No use for training: We do not use your interactions to train our own models. The AI providers we use operate under terms that prohibit using customer inputs for model training — this contractual protection is a criterion for selecting our partners.

3.3 No impactful automated decisions: SAPIANS does not make automated decisions that produce legal effects or significant impacts on you. AI-generated reports and analyses are tools to support your decisions; they do not replace qualified human assessment for regulated professional, legal or financial purposes.

3.4 Content is not stored after processing: Data processed by AI to generate outputs is not retained in our own databases after processing.

For XRESET, the information on cookies, tracking and diagnostics in this section has been corrected by the addendum dated 15 October 2026. The June institutional text below is retained as a record and must not be used as a current description of these XRESET processing activities. Read the new options. Read the XRESET addendum

We do not sell, rent or monetize your personal data. We share it only with the following partners, strictly necessary to operate the service:

International transfers (Arts. 33–36 of the LGPD): Some of the providers above process data outside Brazil. We adopt the following compliance mechanisms: (a) standard contractual clauses (SCCs) equivalent to those of the European Union, and (b) a requirement that providers meet recognized international security standards.

We do not share data with governments, advertisers or third parties not listed above, except pursuant to a court order or a request from a competent authority under the law.

For XRESET, the information on cookies, tracking and diagnostics in this section has been corrected by the addendum dated 15 October 2026. The June institutional text below is retained as a record and must not be used as a current description of these XRESET processing activities. Read the new options. Read the XRESET addendum

We do not use tracking, advertising or remarketing cookies. We do not use conversion pixels, fingerprinting or cross-session tracking for commercial purposes.

We use only:

• Session cookies (essential): necessary to keep you authenticated while using the platform. Legal basis: performance of a contract. Deleted when the session ends or after expiration.
• Technical CDN cookies (Cloudflare): necessary for secure content distribution and protection against attacks. Legal basis: legitimate interest. They do not identify you personally.

There is no cookie consent banner because we do not use cookies that require additional consent — all cookies in use have an independent legal basis.

Under Art. 18 of the LGPD, you have the following rights, which you may exercise at any time:

• Confirmation and access: know whether we process your data and obtain a copy of it.
• Correction: update incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion: for data processed excessively or unnecessarily.
• Deletion: request deletion of data processed on the basis of consent, subject to legal retention obligations.
• Portability: receive your data in a structured and interoperable format.
• Information on sharing: know which entities we share your data with.
• Withdrawal of consent: withdraw consent given, without affecting processing prior to withdrawal.
• Objection: object to processing based on legitimate interest when there is a violation of the LGPD.
• Review of automated decisions: request human review of any automated decision that produces effects on you.
• Petition to the ANPD: if your rights are not honored, you may petition the National Data Protection Authority at gov.br/anpd.

How to exercise your rights: email privacidade@sapians.com.br with the subject “Direitos LGPD”. We respond within 15 business days.

After account closure or a deletion request, your identifiable personal data is removed or anonymized. Data that has already been anonymized — which does not allow reidentification — may be retained for statistical purposes.

We adopt technical and organizational measures appropriate to the risk, including:

• encryption in transit (TLS/HTTPS);
• restricted access control under the principle of least privilege;
• secure authentication through SAPIANS ID;
• monitoring of access and anomalies;
• perimeter protection through Cloudflare WAF/DDoS.

Security incidents: In the event of an incident that may pose a relevant risk or harm to data subjects, SAPIANS will notify the ANPD within 3 business days after becoming aware of the event (CD/ANPD Resolution No. 15/2024) and will communicate with affected data subjects clearly and promptly.

The SAPIANS platform is not directed at people under 18 and does not intentionally collect data from children or adolescents (Art. 14 of the LGPD in conjunction with the Brazilian Child and Adolescent Statute — ECA).

If we identify that a minor’s data was inadvertently collected, we will take immediate measures to delete it. If you are responsible for a minor and believe they have provided data on our platforms, contact us at privacidade@sapians.com.br.

When a professional acts both as a platform User and as a specialist co-founder in a SAPIANS project — with an equity stake —, data processing related to the corporate and contractual relationship (due diligence, business communications, agreement documentation) is governed by the specific Co-Founding Agreement and corporate legal obligations, rather than exclusively by this Policy. For questions about data processing in this context, contact us at privacidade@sapians.com.br.

We may update this Policy periodically to reflect changes in our solutions, processing practices or applicable legislation. Substantial changes will be communicated by email at least 30 days in advance. The current version is always the one published on this page, with the update date shown at the top.

For changes that expand the scope of processing based on consent, we will request new authorization before applying them.

SAPIANS Venture Studio
Data Protection Officer (DPO): SAPIANS Privacy Team
Email: privacidade@sapians.com.br (subject: “Privacidade / DPO”)
Response time: up to 15 business days

ANPD portal (petitions and complaints): gov.br/anpd