LGPD Policy

1. Commitment to LGPD

Action Tec Brasil, developer of the FalaAI API, is committed to protecting personal data and fully complying with Brazil's General Data Protection Law (Law No. 13,709/2018).

This policy explains how we handle your personal data collected through this website, your rights as a data subject and how to exercise them.

2. Personal Data Collected

We collect the following personal data when you use our contact forms:

3. Legal Basis for Processing

We process your personal data based on the following legal grounds provided by LGPD:

• Consent (Art. 7, I): When you fill out our forms and expressly accept the processing of your data
• Legitimate Interest (Art. 7, IX): For browsing analysis and improving the website experience
• Contract Execution (Art. 7, V): To respond to your commercial contact requests

4. Processing Purposes

Your personal data is processed for:

• Responding to your commercial contact requests
• Connecting you with authorized FalaAI resellers
• Processing new reseller applications
• Improving the browsing experience on the website
• Sending marketing communications (only with your consent)
• Complying with legal and regulatory obligations

5. Your Rights as a Data Subject

According to Art. 18 of LGPD, you have the right to:

6. How to Exercise Your Rights

To exercise any of the above rights, contact us through official channels:

7. Data Sharing

We do not sell your personal data. We share data only when:

• You request contact from an authorized reseller (data shared with the reseller)
• Required for service providers (hosting, email marketing, analytics)
• Required by law or court order

All third parties that access your data are contractually required to protect it in accordance with LGPD.

8. Data Security

We implement technical and organizational security measures, including:

• Data encryption in transit (HTTPS/TLS)
• Restricted access controls
• Security monitoring
• Regular data backups
• Team training on data protection

9. Data Retention

We keep your personal data only for as long as necessary for the described purposes or as required by law. Form data is kept for up to 2 years, unless deletion is requested or a longer legal retention obligation applies. Conversations, transcriptions and analyses processed in FalaAI (platform) are stored and kept for the retention period of the plan in force at the time of purchase, in accordance with the applicable commercial conditions; once the period ends, the data is deleted. Audio files are client input, disposable at any time.

10. Data Protection Officer (DPO)

Our Data Protection Officer is available to clarify questions about personal data processing:

11. Complaints to ANPD

If you believe your rights have not been respected, you can file a complaint with Brazil's National Data Protection Authority (ANPD):

12. Changes to this Policy

We may update this LGPD Policy periodically to reflect changes in our practices or legislation. The last update date is indicated at the top of this page. We recommend that you review this page regularly.

13. Contracting Entity (CNPJ)

A legal entity is not a data subject under the LGPD: the rights on this page belong to natural persons. The relationship with the contracting entity (CNPJ) is governed by the contract and the Terms of Use. Data export upon termination (.CSV files per entity, via temporary link, within 60 days and as per the contract) is described in item 20 of the Terms of Use.

14. What Portability Is (and Is Not)

Portability is the right to take your personal data to another provider in a structured, machine-readable format (spreadsheet/CSV), so it remains usable outside FalaAI. It is not the same as: (i) access — seeing what data we hold about you; (ii) erasure — deleting your data; (iii) automatic transfer between companies — subject to specific ANPD regulation. Portability covers the data subject's personal data (e.g., account registration and history). It does not cover: third-party data, anonymized data, trade and industrial secrets, and conversations the data subject did not take part in.

15. Who Is Who: Data Subject, Controller, Operator and Contracting Entity

Data subject: the natural person the personal data refers to (you). Controller: who decides on the processing — for conversation data, the CUSTOMER. Operator: who processes on behalf of the controller — Action Tec Brasil (FalaAI and FalaAI API are products). Contracting entity (CNPJ): the legal entity that contracts FalaAI; it is not a data subject under the LGPD and its relationship is contractual (section 13). Authority: ANPD. In practice: (a) natural persons exercise the rights on this page through the stated channel; (b) legal entities follow the contract and the Terms of Use; (c) a data subject whose data appears in a customer's conversations must direct the request to the controller (the customer), with Action Tec Brasil supporting as operator.

13. Roles: controller and processor

For the data of conversations processed by the API, the client is the controller (decides the purpose and legal basis, including as to the data subjects appearing in the conversations) and Action Tec Brasil acts as processor (FalaAI and FalaAI API are products), handling the data only according to the client's instructions and to perform the service.

14. Data subject rights, channel and period

You may exercise your rights via contato_falaai@action.tec.br, with a response period of up to 15 calendar days (art. 19 of the LGPD). The data protection officer (DPO) and WhatsApp are provided in this policy, and you may file a complaint with the ANPD.

15. Sub-processors and sharing

We do not sell personal data. We share data with providers necessary to perform the service (hosting, infrastructure and AI providers that process the content exclusively to generate the result), under protection obligations and without storing content, in addition to legal grounds and court orders.

16. Zero-Storage of API content

FalaAI API does not retain the submitted content (audio, text or result), which is processed and discarded; it keeps only usage, log and audit records, with no content or client data.

17. Marketing consent

Operational communications (account, security and billing) do not depend on consent. Marketing communications depend on optional consent, revocable at any time through a setting in the account and an unsubscribe link in every message.

18. Data deletion and fraud prevention

Data subjects may request the deletion of their personal data. Valid requests are honored; however, to prevent fraud and abuse (for example, recreating an account to obtain free benefits again), Action Tec Brasil may keep an irreversible record derived from the email (hash), without storing the email in plain text, and retain records on legal and tax grounds. Conversation data sent to FalaAI API is not retained (Zero-Storage).