Privacy Policy

1. Who is responsible and the roles involved

For the data covered by this Policy, the responsible party is JORGE OGUSHI NETO, inscrito no CNPJ sob o nº 47.675.250/0001-95 (“we”). AIVERYN is the brand of the product, which is in pre-launch, and not a legal entity; in this Policy, “AIVERYN” refers to that party operating the product.

The LGPD distinguishes two roles, and AIVERYN may hold either depending on the situation:

• Controller: when we decide how and why data is processed, for example data of people who contact us through the website, of people who create an account, and data needed to operate and protect the Platform;
• Processor: when we process data on behalf of and under the instructions of the user company, for example the contacts, opportunities, appointments and conversations that the company records or connects on the Platform. In those cases, the user company is the controller and defines the purpose and legal basis; to exercise rights over that data, contact the company you deal with first.

2. Data we may collect

At this time, the public website has no active contact form, and the demo chat on the home page runs in your browser and does not send us what you type. If you write to us by e-mail, we will process the data you send (such as name, e-mail and message) in order to reply.

We collect only what is necessary for each purpose. Depending on how you use it, we may process:

• Data you provide: name, e-mail, phone, company, message and the content of what you send by e-mail or through other contact channels we may make available; registration data (name, e-mail, password) and company data (name, segment, plan) when you create an account;
• Data the user company records on the Platform: contacts, opportunities (leads), appointments, tasks, conversations, labels, settings, automations, team schedules and data about team members and invitations;
• Usage and technical data: IP address, access date and time, browser and device type, pages accessed, operation logs, security events, history of actions on the Platform (who did what and when), and usage and resource consumption measurements. On public forms, we may use irreversible identifiers derived from this data only to limit abuse;
• Data from authorized integrations: information made available by the services you connect, limited to the permissions you grant (for example calendar events, or the e-mail address of the connected account). For e-mail, AIVERYN uses the integration only to send operational messages on the company's behalf, not to read the inbox;
• Communication data: messages and metadata exchanged through connected channels (such as WhatsApp Business), when the user company enables the channel.

We do not request sensitive personal data (such as health, racial origin, beliefs or biometric data). If you or the user company enter this kind of data, the user company is responsible for having a legal basis for it, and we recommend not entering it unless strictly necessary.

3. What we use data for and on which legal bases

We process personal data only for legitimate, specific and disclosed purposes, supported by one of the legal bases in Article 7 of the LGPD:

• Responding to contacts and requests and presenting AIVERYN: preliminary procedures related to a contract, at the data subject's request, and legitimate interest;
• Creating and maintaining your account, authenticating access and providing the Platform: performance of a contract or preliminary procedures;
• Operating integrations, calendar, conversations and automations requested by the user company: performance of a contract and, where applicable, the person's consent or the controller's instructions;
• Security, fraud and abuse prevention, and usage limits: legitimate interest and regular exercise of rights;
• Complying with legal or regulatory obligations and assisting authorities: compliance with a legal or regulatory obligation;
• Improving and measuring the performance and operating cost of the Platform, with aggregated or internal data: legitimate interest;
• Communications about the product and pre-launch that you requested or that match your expectations: consent or legitimate interest, with the option to ask not to receive them.

When the legal basis is consent, you may revoke it at any time (see section 10). We do not sell personal data.

4. Integrations and artificial intelligence

Integrations: AIVERYN connects to third-party tools and services only with the authorization of the user company, and uses the data from those accounts only for the features it enabled. The authorization can be revoked on the Platform or directly in the third-party service. Use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

Artificial intelligence: some features may use artificial intelligence to interpret, summarize, organize or assist with operational tasks, according to the settings and authorizations of the user company. Artificial intelligence is support and does not make final decisions on the customer's behalf, and results should be reviewed by a person. When such a feature is available, we will inform you in this Policy if it changes the processing described here. The current public website does not use artificial intelligence: the demo chat on the home page runs on rules and scripts in your browser.

You keep using your tools and your data stays under your control. AIVERYN connects authorized services and coordinates operational flows according to the company's settings.

5. Who we share data with

We share personal data only when needed for the purposes above, with:

• Infrastructure and technology providers (processors and sub-processors) that help us operate the Platform, such as hosting of the website and servers, cloud authentication and database (for example Google Firebase) and e-mail delivery (for example account confirmation e-mails), always under contracts or terms that require data protection;
• Third-party services that you or the user company connect (for example Google, Apple/iCloud and Meta/WhatsApp), to the extent of the authorized integration;
• Members of the user company itself, according to the permissions it sets;
• Authorities, public bodies or third parties, where there is a legal obligation, a court order or to defend rights in proceedings;
• Possible successors, in case of corporate reorganization, with the same protection for this data.

These providers may change over time; we keep this Policy updated on the categories and may tell you, on request, which providers process your data.

6. International transfers

Some providers and third-party services we use may process or store data outside Brazil. In those cases, we adopt the measures set out in Article 33 of the LGPD, such as using providers that offer adequate safeguards, contractual clauses or other permitted mechanisms, and specific consent when required.

7. Storage and security

We adopt reasonable technical and organizational measures to protect data against unauthorized access, loss, alteration or improper disclosure, including:

• communication protected by HTTPS and login sessions with a protected cookie that browser scripts cannot read;
• separation of each company's data and role-based access control (owner, administrator, member) checked on the server;
• protected storage of integration credentials and authorizations, with application-level encryption;
• logging of actions and security events, usage limits and protection against abusive submissions;
• internal access limited to what is needed to operate and provide support.

No system is completely immune to failure. For this reason we cannot guarantee absolute security, but we work to reduce risks and to respond to incidents.

8. How long we keep data and how to request deletion

We keep data for as long as needed to fulfill the purposes of this Policy, while the account or the relationship with the user company exists, and afterwards for the period required or permitted by law (for example to meet legal obligations, prevent fraud and exercise rights in proceedings).

• contact data received by e-mail: while needed to reply to and follow up on the conversation, or until you ask for deletion, subject to legal obligations;
• account and company data: while the account is active and, after closure, for the period needed for legal obligations and security;
• data the user company records on the Platform: according to the company's instructions and the Platform's terms of use;
• technical and security records: for the period needed for security and to meet legal obligations.

Deletion may not be immediate and may not reach, all at once, technical copies and records we must keep by law. To request deletion of your data or closure of your account, use the channel in section 12; explain what you want and, if necessary, we will confirm your identity before acting.

9. Cookies and browser storage

On the public website we do not use advertising cookies or third-party analytics or tracking tools. The website stores in your browser only your theme preference (light or dark), using local storage, to remember your choice.

In the customer area we use a session cookie needed for login and security, which is removed when you sign out or expires, and small interface preferences (such as the collapsed menu). These items are strictly necessary for operation. If we ever adopt non-essential cookies or tools, we will update this Policy and, where required, ask for your consent.

10. LGPD: principles, rights and incidents

Principles. We process data observing purpose (legitimate, specific and disclosed purposes), adequacy (compatibility with the purposes), necessity (the minimum necessary), free access, data quality, transparency, security, prevention, non-discrimination, and accountability (Article 6 of the LGPD).

Your rights as a data subject (Article 18 of the LGPD). You may request, at any time and upon request:

• confirmation that processing exists;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in non-compliance with the LGPD;
• portability of the data to another provider, where applicable and under the regulations;
• deletion of data processed on the basis of your consent, except where the law allows retention;
• information about the public and private entities with which we share data;
• information about the possibility of not giving consent and the consequences of refusing;
• revocation of consent, at any time, where consent is the legal basis;
• objection to processing carried out on another legal basis, where the law is not being complied with;
• review of decisions taken solely on the basis of automated processing that affect your interests, where applicable.

How to exercise them. Send the request to support@aiveryn.com. We will reply within the periods and in the form set by regulation. If we process your data as a processor on behalf of a user company, we may forward the request to it, as the controller. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

Processors and sub-processors. When we act as controller, we use processors and sub-processors (for example for hosting, authentication, database and e-mail) that process data under our instructions, and we require compatible security and confidentiality measures from them.

Security incidents. If a security incident occurs that may cause relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects, in the form and within the periods required by the LGPD and regulation.

International transfers. See section 6.

11. Children and teenagers

AIVERYN is intended for companies and professionals and is not directed at children and teenagers. If we learn that data of minors was collected improperly, we will take steps to delete it.

12. Contact channel and privacy requests

To exercise your rights, request deletion of data or ask questions about this Policy, write to support@aiveryn.com. For your security, we may ask for information to confirm your identity before handling the request.

13. Changes to this Policy

We may update this Policy, especially as the Platform and its integrations evolve. The date of the last update is at the top; relevant changes will be communicated by reasonable means, such as a notice on the website, on the Platform or by e-mail.