Privacy Policy

Key definitions:

Many of the terms used in this Privacy Policy (“Policy”) are provided for in Law No. 13.709/2018, known as the General Data Protection Law (“LGPD”). To make it easier to understand and read, we present in this glossary the main terms we use. When reading the terms below—whether in uppercase or lowercase, plural or singular, with or without bold—they should be interpreted as follows:

• Personal Data: Information that identifies a natural person (i.e., an individual), directly—such as name or CPF number—or indirectly—such as address or financial data;
• Sensitive Personal Data: Data about racial or ethnic origin, religious belief, political opinion, union membership or membership in a religious, philosophical, or political organization; data concerning health or sex life; genetic or biometric data, when linked to a natural person;
• Database: Structured set of data, including personal data, established in one or more locations, in electronic or physical form;
• Data Subject: Natural person to whom the personal data that is processed refers;
• Controller: Natural person or legal entity, public or private, responsible for decisions regarding the processing of personal data. In this case, the Controller of the Personal Data entered into the Platform will be the contracting party, which holds the Platform license;
• Processor: Natural person or legal entity, public or private, that processes personal data on behalf of the Controller. In this case, StaryaAI acts as a Processor regarding personal data entered into the Platform by its Users;
• Processing: Any operation performed with personal data, such as collection, production, reception, classification, use, access, reproduction, transmission, distribution, processing, archiving, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction;
• Legal Bases: The legal grounds that legitimize, i.e., allow, the processing of personal data.

If you want to learn more about the General Data Protection Law, you can access it by clicking here. If you have any questions about any concept in this Policy and would like to learn more, you can contact us to clarify any doubts through the contact information provided in the summary box

General terms

General. StaryaAI (PSYCOAI TECNOLOGIA LTDA.), a legal entity registered with the CNPJ/MF under No. 55.078.022/0001-66, headquartered at Avenida Paulista, n° 1106, Sala 1, 16° andar, Bela Vista, São Paulo/SP, CEP: 01.310-914, considers the use of personal data to be a matter of extreme importance and seriousness. For this reason, this Policy was prepared to communicate practices related to the processing of personal data, especially in connection with the collection, use, and processing of information that Users provide through the Platform.

Authorization for Processing. By using the StaryaAI Platform, the User authorizes the processing of personal data and agrees to be bound to the StaryaAI Platform. If you do not accept the practices and policies described in this private instrument, you may not use the Platform.

Regulation. StaryaAI operates in accordance with Brazilian law, including and especially the terms of Law No. 12.965/2014 (“Internet Civil Framework”), Law No. 13.709/2018, and other applicable rules.

Contact. If you have any questions or suggestions about the Platform’s Privacy Policy, the User may contact the personal data protection officer, Mr. Vinícius de Oliveira Reis (“DPO”), by email at dpo@starya.ai

Information Control. This Policy describes which personal data may be processed from Users while they use the Platform services, how this information may be used, and the precautions taken against unauthorized access or use.

Processed personal data

Processing of Users’ Personal Data. StaryaAI may process the following information and/or personal data of Users:

Other processed data. StaryaAI may also collect, store, and use the following information:

• Database record of any files or information uploaded by Users to the Site;
• Site access details and the resources the User accessed;
• Information about the access device used, including, for example, hardware model, operating system and version, file names and versions, preferred language, unique device identifier, advertising identifiers, serial number, device movement information, and network information;
• Server log information that may include information such as the device IP address;
• Browser click mapping, navigation data, statistical and demographic data, among others;
• Site interaction mapping, such as usage time, environments accessed, and options chosen.

How StaryaAI uses processed data.

Use. By accepting this Policy, Users agree that StaryaAI may process the data collected by the Platform in order to:

• Identify and register Users on the Platform and provide services to Users;
• Ensure Platform content is presented in the most efficient way to tailor the User experience, offering more relevant and effective service;
• Ensure user accounts are secure and that access to data is restricted to the Users themselves;
• Help implement general improvements to the Platform;
• Process collected data to identify patterns, improve AI algorithms, and improve service quality;
• Ensure the Platform complies with all applicable regulations and data protection standards;
• Contact and notify Users about changes to the Platform or its policies and terms of use, when necessary;
• Send newsletters and informational emails.

Purpose of Data Processing. The personal data processed by StaryaAI falls under the following purposes and legal bases:

Personal data processor. With respect to Users’ personal data entered into the Platform by designation of the Corporate Client User (Administrator), it is important to note that StaryaAI acts as a data processor. This means StaryaAI does not determine the purposes of processing such data. Responsibility for those decisions lies entirely with the Corporate Client, as it is the Controller of its Users’ personal data on the Platform.

Limitation of responsibility. As a personal data processor, StaryaAI is committed to protecting the security and privacy of the personal data it processes. Appropriate technical and organizational measures are implemented to prevent unauthorized access, disclosure, alteration, or destruction of personal data. However, it is essential that the Controller assumes responsibility for defining the purposes and legal bases for processing such information in accordance with applicable laws.

Data statistics. StaryaAI may use information collected from Users to generate statistics that will be used for continuous improvement of the services offered, ensuring that features and offerings meet Users’ needs more effectively.

AI agent interaction data. Data collected from interactions with AI agents may be used to analyze behavior patterns, improve the overall User experience on the Platform, and enable personalization of action plans and emotional support—adapting to Users’ profiles and individual needs. Finally, statistics will be used to ensure the efficiency and effectiveness of AI agents by improving their response and interaction capabilities.

Data anonymization. Any collected information used to produce statistics, analyses, or studies will undergo an anonymization process. This means any identifiable personal data will be removed or altered so that Users cannot be identified directly or indirectly. StaryaAI commits to using technologies and practices that ensure the anonymization process is irreversible, ensuring anonymized data cannot be reverted to reveal Users’ identities.

Sharing of processed personal data

Sharing. StaryaAI does not disclose to third parties any personal data provided by Users through the StaryaAI Platform, except:

• Cases in which StaryaAI is required to disclose or share processed personal data to comply with a court order, for fraud prevention or other crimes, or in response to an information request by a competent authority, if we understand the disclosure is in accordance with or required by applicable laws, regulations, or procedural rules;
• To protect the rights, property, or safety of StaryaAI and the Platform;
• With law enforcement agents and/or government authorities, if their actions are deemed inconsistent with the provisions in our terms of use, or to protect the rights, property, or safety of StaryaAI, its Users, or others;
• By the User’s own action;
• In the event of a partial or total sale of the business or its assets, or as part of any business reorganization or restructuring, merger, spin-off, or incorporation, in which case StaryaAI may share Users’ information with third parties involved in such transactions, taking the necessary measures to ensure privacy rights continue to be protected under this Policy.

Service providers. StaryaAI also shares personal data with third-party business partners to enable Platform functionalities, as well as to store and back up information (for example, to store cloud data on the servers used).

These providers, under the LGPD, are processors or sub-processors of personal data and, by definition, must process personal data in accordance with the purposes set forth in this Policy. In other words, partners may not use your personal data in other ways or for purposes different from those set forth herein.

Whenever entering into a partnership, StaryaAI carefully evaluates its business partners to identify whether those involved in data processing follow the security standards that StaryaAI deems relevant for processing your information. In addition, whenever possible, StaryaAI establishes specific contractual clauses to protect the confidentiality of your personal data.

Cookies

5.1 What Cookies are. A cookie is a piece of information stored locally on your computer or device that contains information about its activities on the Internet.

5.2 Cookies used. StaryaAI uses cookies to improve the User experience on the Platform, allow device recognition, and help ensure the Platform works correctly. Below we detail the types of cookies used and their purposes:

• Performance Cookies: This type of cookie collects anonymous information about how Users use the Platform in order to optimize it. The information collected by these cookies never contains personal details that could identify you.
• Functional Cookies: Intended to keep the User session active during browsing, ensuring the User remains logged in and that interactions are continuous.
• Preference Cookies: Allow the Platform to remember information that changes the way it behaves or appears. An example is the user’s preferred language, as well as the region they are in.
• Statistics Cookies: Collect information about how Users interact with the Platform, helping improve services and usability. These cookies allow differentiating Users and collecting statistical data about site usage.
• Necessary/Security Cookies: Cookies that are absolutely essential for the proper functioning of the site. These cookies ensure basic functionalities and security features of the site, anonymously.

5.3 Access to Cookies. Access to cookies ends as soon as you close your browser. Users are given the option to accept or refuse cookies.

5.4. Consent for the Use of Cookies. Your acceptance is required before the session starts for Cookies to be used.

5.5. Cookie-free option. The data subject may choose to refuse the use of cookies. If the User chooses not to accept them, access to most information available on the Platform will not be compromised. However, the User may not be able to fully use the services offered.

Access and rights

Access and Rectification of Personal Data. Users have the right to access their personal data processed by StaryaAI, as determined by the LGPD, by contacting the DPO by email: dpo@starya.ai. Requests will be answered during business hours, Monday through Friday, from 8:00 to 20:00, within 15 (fifteen) days, and may be sent by email or letter, as provided in Article 9 of the LGPD, ensuring the following rights:

• Access to data: the data subject has the right to obtain from the controller, upon request, access to the data being processed.
• Anonymization, blocking, or deletion: the data subject has the right to anonymization, blocking, or deletion of their personal data when unnecessary, excessive, or processed in non-compliance.
• Confirmation of processing: the data subject has the right to obtain from the controller, at any time and upon request, confirmation that processing is taking place.
• Correction: the data subject has the right to obtain from the controller, upon request, correction of incomplete, inaccurate, or outdated data.
• Information about sharing: the data subject has the right to be informed with which public or private entities the controller has shared or processed data.
• Objection: the data subject may object to processing in cases of non-compliance with the LGPD.
• Petition against the controller to the ANPD or consumer protection body: the data subject has the right to petition (administrative request) regarding their data against the controller to the national authority.
• Portability: the data subject has the right to data portability to another service provider, or even product provider, in accordance with the national authority (ANPD) regulation, observing trade secrets.
• Review of automated decisions: the data subject has the right to request review of decisions made solely based on automated processing that affect their interests as data subject.
• Withdrawal of consent: the data subject has the right to withdraw consent at any time through an express manifestation, via a free and facilitated procedure.

Exception to Deletion Request. Users have the right to request deletion of their personal data stored on the Platform at any time, except when there is a legal obligation or court decision to maintain storage, pursuant to Articles 18, VI and 16, I of the LGPD.

Inaccurate Information. It is the User’s responsibility to keep their information up to date. If inaccurate, StaryaAI may update or delete it, except when retention is necessary for legitimate commercial or legal purposes.

Necessary Protection Measures. StaryaAI takes the necessary security measures to protect Users’ personal data and safeguard it against loss, misuse, unauthorized access, disclosure, alteration, or destruction.

Password Protection. Users are also responsible for taking appropriate measures to protect their passwords, usernames, and other special access credentials to their personal registration on the Platform.

Notice of changes to the Privacy Policy

Changes to the Privacy Policy. StaryaAI may change this Policy from time to time. Use of processed information is subject to the Privacy Policy in effect. If StaryaAI makes changes to the way it processes personal data, it will notify Users by email.

Tacit acceptance. Minor adjustments to this Policy may occur without significantly affecting how StaryaAI processes personal data, and therefore do not need to be notified.

Communication

Sending Communications. By registering, Users agree that StaryaAI may send notifications, advertisements, service news, and important information about Platform usage to their email that may require their attention.

Opt-out. When receiving an email from StaryaAI, Users will have the option to stop receiving them by using the opt-out option or by requesting it by email.

Anti-spam Policy. The Platform takes necessary precautions to avoid sending unsolicited emails.

Confidentiality. The highest degree of confidentiality is ensured in the processing of data such as the email list during StaryaAI’s regular administration tasks.

Retention and storage of personal data

Retention and storage. The LGPD does not set a specific period for retention of personal data. However, it determines that storage must occur for a reasonable period. StaryaAI will store Users’ data for as long as the User’s registration remains active.

Retention period. Personal data is stored for a period considered adequate based on applicable Brazilian legislation, namely:

• 6 (six) months for Platform activity logs, as provided in Art. 15 of the Internet Civil Framework;
• 5 (five) years for information related to the processing of personal data, as this is the period during which StaryaAI may be inspected and/or sued.

Where retention is necessary, the data subject will be informed about the impossibility of deletion if requested, and the data will not be used for purposes other than those provided in this section.

Preserved data. Retention includes the User’s registration and usage personal data, as well as interaction records and related information, which we keep for 6 (six) years from: (i) cancellation of the User account; or (ii) provision of personal data by the data subject (when not a Platform User) in contact forms or similar.

Important reminder. In cases where there is an administrative or judicial proceeding, supervisory activity, or an ongoing audit, StaryaAI may extend such period until the applicable end.

Security in the processing of personal data

Storage. Users’ personal data and all Platform information are stored and transmitted securely. Only StaryaAI-authorized personnel may access personal information, and they are subject to confidentiality duties and strict respect for your privacy under this Policy.

Information Security. Personal data is transmitted and stored on Microsoft Azure – Brazil servers, and anonymized data may be stored in Microsoft Azure – United States data centers. All interactions performed on the Platform—including those related to transfer and sharing of information with public authorities—are encrypted, subject to data backups, monitoring tools, security policies, and access controls for personnel, using up-to-date security software.

International processing. As your data must be stored in locations compliant with Brazilian law (see LGPD Art. 33), StaryaAI informs and guarantees that the international server used meets the requirements set forth in that legal provision.

Notice. If StaryaAI becomes aware of any security breach affecting itself or the hosting companies it uses—including invasions, data leaks, or any other information security incident—it will notify competent authorities and any affected Users and will provide as much detail as possible regarding the nature and extent of the breach and the compromised data within a reasonable period, pursuant to LGPD Art. 48, § 1.

Our official support channels

Questions or suggestions. If you have questions or suggestions about this Privacy Policy or any other related information, the User may request support by email at dpo@starya.ai.

Support hours. Support hours are from 09:00 to 18:00 (Brasília time, GMT-3). Our support aims not only to solve potential issues quickly and efficiently, but also to seek a friendly solution.

General provisions

User responsibility. Users will be responsible for indemnifying StaryaAI for all costs and damages it may incur as a result of violations of this Privacy Policy caused by them.

Cooperation with authorities. StaryaAI fully cooperates with any authorities or courts that request disclosure of the identity or location of any person who inserted any material into the Platform that violates the clauses set forth in this Policy.

Governing law and jurisdiction. This Privacy Policy is governed by Brazilian law, and the courts of the District of Rio de Janeiro are designated as competent to settle any disputes arising hereunder, to the exclusion of any other, however privileged it may be or may become, and priority should always be given to attempts at resolution through conciliation or mediation.

Limitation of Liability. This Privacy Policy addresses only the processing of personal data provided to the Platform. If the User discloses their information to third-party websites, different rules may apply to the use of their information.