Privacy Policy

Catech Labs Tecnologia Ltda. ("Catech Labs", "we", "our") takes your privacy seriously. This Privacy Policy describes how we collect, use, protect, and share personal information when you access our website or use our AI infrastructure platform.

This policy applies to personal data of visitors and individual users. The processing of data submitted by corporate customers to the platform ("Customer Content") is governed by the applicable service agreement.

Trust Highlights (TL;DR)

If you are short on time, here is what you need to know about how we handle your data:

• Your data is yours: We do not claim ownership of your inputs or outputs.
• Total Isolation: Each customer operates in an isolated environment ("tenant"), ensuring that data is never mixed with data from other customers.
• Legal Sovereignty: We are fully committed to the LGPD, with a focus on protecting professional and financial data.

1. Our Data Philosophy

At Catech Labs, we build AI infrastructure for professional markets based on three non-negotiable commitments:

1. Customer Sovereignty: Your data belongs to you. We act only as contractually bound custodians.
2. No Training: We do not use your Customer Content — documents, inputs, or outputs — to train third-party language models or our own generic models.
3. Privacy by Design: Security and data isolation are integrated into every layer of our architecture from the start, rather than added as an afterthought.

2. Legal Bases and Purposes

We transparently map how each data-processing activity is grounded in the requirements of the LGPD (Article 7). This structure ensures that your data is processed only for legitimate and stated purposes:

For activities based on legitimate interest — especially security and fraud prevention — Catech Labs has conducted a Legitimate Interest Assessment (LIA), which remains available to the ANPD. In these cases, you may object to the processing under Article 18, paragraph 2, of the LGPD through the channels listed in Section 13.

3. Definitions

• Personal Data: Any information that identifies or may identify a natural person.
• Sensitive Personal Data: Data concerning racial or ethnic origin, religious belief, political opinion, membership in a trade union or religious, philosophical, or political organization, health or sex life, genetic data, or biometric data. Catech Labs does not intentionally request or collect sensitive data through its public channels.
• Customer Content: Documents, data, and materials submitted by corporate customers for processing on the platform.
• Processing: Any operation performed on personal data — collection, storage, use, sharing, or deletion.
• LGPD: The Brazilian General Data Protection Law (Law No. 13,709/2018).
• Data Protection Officer (DPO): Our Data Protection Officer, as provided for in Article 41 of the LGPD.

4. Information We Collect

4.1 Information You Provide

• Contact and Account Data: Name, corporate email, job title, company, and telephone number when you register, request a demonstration, or contact us.
• Communications: The content of messages sent through contact forms, email, or technical support.

4.2 Automatically Collected Information (Tracking Tools)

We collect technical data through automated tools to ensure the security and performance of the website:

• Server Logs: IP address, browser type and version, operating system, internet service provider (ISP), referring and exit URLs, date and time stamps, and clickstream data.
• Tracking Technologies: We use web beacons (pixel tags), third-party scripts, and cookies to understand how you interact with our content.
• Analytics: We use analytics tools for usage and browsing-behavior metrics.

4.3 Third-Party Information and Social Integrations

We may receive data from public sources or business partners (such as LinkedIn or CRM tools) for lead enrichment and personalization of B2B offers. This processing is based on Catech Labs' legitimate interest in B2B commercial prospecting, not on consent. In compliance with the information duty under Article 9, together with Article 7, paragraph 3, of the LGPD, when we collect your data from third parties or publicly accessible sources, we will inform you within a reasonable period and through appropriate means of the data source, the specific purposes of processing, and how to exercise your rights, including the right to object.

4.4 Customer Content

Customer Content is processed exclusively to perform the contracted functions in a tenant-isolated environment. Any personal data contained in it is handled with the same security safeguards applicable to personal data in general.

4.5 Children and Adolescents' Data

Our services and this website are intended for professionals and corporate customers (B2B) and are not directed to children or adolescents. Catech Labs does not intentionally collect personal data from minors. If we become aware that a child's or adolescent's data was collected inadvertently, we will take the appropriate steps to delete it, always in the minor's best interests, under Article 14 of the LGPD.

5. How We Use Your Information

We use the collected data to:

• Provide Services: Operate, maintain, and improve our AI infrastructure platform.
• Professional Relationships: Process requests for demonstrations, partnerships, and technical support.
• B2B Communications: Send product updates and technical newsletters, always with an opt-out option.
• Cybersecurity: Protect against denial-of-service (DDoS) attacks and fraud.
• Regulatory Compliance: Meet ANPD requirements and judicial orders.

6. Data Protection and Artificial Intelligence

This is the core of our technological differentiator:

• Tenant Isolation: Inputs, outputs, and session contexts of your AI agents remain confined to your customer's logical environment and inaccessible to other tenants.
• Zero Retention (configurable): We offer operating modes in which interaction logs are not retained after a session ends, configurable under the customer's data policy.
• No Reuse for Training: Your Customer Content is never used to improve third-party or Catech Labs base models outside the contractual scope.
• Model Providers (Subprocessors): We use leading infrastructure and model providers through Enterprise APIs that contractually guarantee that data will not be used for training.

7. Sharing and Data Transfers

We do not sell your personal data. We share it only with strictly necessary partners:

• Infrastructure and Hosting: Cloud partners that host our platform under strict confidentiality agreements.
• B2B Operations Tools: CRM and support providers that process data on our instructions.
• International Transfers: Because we use global cloud infrastructure, your data may be processed outside Brazil — notably in the United States, where providers such as Cloudflare, Google, and AI model providers are located. These international transfers comply with Article 33 of the LGPD and take place under Standard Contractual Clauses approved by the ANPD, under ANPD Resolution CD/ANPD No. 19/2024.

8. Security and Integrity

We implement technical and organizational measures aligned with international standards:

• Technical Security: AES-256 encryption for data at rest and TLS 1.3 for data in transit.
• Edge Security: Web Application Firewall (WAF) implementation and continuous monitoring.
• Organizational Security: Periodic team training and access audits.
• Access Control: Mandatory multifactor authentication (MFA) for internal operators.
• Incident Communications: If a security incident may cause relevant risk or harm to data subjects, we will notify the ANPD and affected data subjects within a reasonable period, under Article 48 of the LGPD.

9. Your Choices and Rights

In accordance with Articles 9 and 18 of the LGPD, as a data subject you may exercise the following rights at any time before Catech Labs:

• Confirmation that your data is being processed;
• Access to your data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
• Portability of your data to another service or product provider, upon express request;
• Deletion of personal data processed based on consent, subject to legally permitted retention;
• Information about public and private entities with which Catech Labs has shared your data;
• Information about the possibility of refusing consent and the consequences of doing so;
• Withdrawal of consent under Article 8, paragraph 5, of the LGPD.

To exercise any of these rights, contact our DPO through the channels listed in Section 13. We will respond to requests in simplified form immediately or, when a complete response requires more detail, within 15 (fifteen) days of receipt, under Article 19 of the LGPD.

You also have the right to petition the Brazilian National Data Protection Authority (ANPD) at any time regarding the processing of your data, under Article 18, paragraph 1, and Article 55-J of the LGPD.

In addition to the rights above, you have the following operational choices:

• Do Not Track: We respect your browser's "Do Not Track" settings.
• Marketing Opt-Out: Every marketing email includes an unsubscribe link.
• Cookie Controls: You can manage your preferences through our Cookie Policy.

10. Data Retention

We retain your personal data only for as long as necessary:

• Account Data: For the duration of the contractual relationship and for up to 5 years afterward.
• Access Logs: 6 (six) months, in compliance with Article 15 of the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014).

11. Changes to This Policy

We may periodically update this Policy to reflect technological or regulatory changes:

12. Third-Party Applications

We respect and protect your privacy as described in this Policy. We share personal data with third parties only as described here — and we do not and will not sell your personal data. Catech Labs shares your data with third parties only with your express consent or under another lawful basis under applicable law. The categories of third parties include hosting and cloud providers, marketing agencies, and subcontractors involved in fulfilling our contractual obligations to customers.

12.1 Cloudflare

Cloudflare is a service of Cloudflare, Inc. ("Cloudflare") that provides a content delivery network (CDN), DDoS protection, and cybersecurity services. Cloudflare accelerates the delivery of static and dynamic content through a worldwide network of data centers. The service captures technical information about each request in system logs, including the IP address, approximate geolocation of the server that handled the request, country, and date/time. More information: https://www.cloudflare.com/privacypolicy/

12.2 Google Analytics

We use Google Analytics to analyze your use of the website. The generated information (such as the time, location, and frequency of visits, including your IP address) is transmitted to and stored by Google. We use the "anonymizeIp" extension to anonymize your IP address before transfer. You can prevent cookies from being installed by adjusting your browser or using the opt-out add-on: https://tools.google.com/dlpage/gaoptout

12.3 Google Tag Manager (GTM)

Google Tag Manager is a system that allows us to centrally manage the JavaScript and HTML tags used for tracking and analysis, such as Google Analytics. GTM facilitates the integration and management of these tools while respecting user opt-out settings. More information: https://policies.google.com/privacy

13. Contact and Data Protection Officer (DPO)

For questions or to exercise your rights:

Email: [email protected]
Address: São Paulo, SP — Brazil