Data Processing & Security
1. Scope
This page consolidates the commitments of Maritaca Inteligência Artificial Ltda. (CNPJ 48.565.396/0001-40) regarding the processing of data submitted by customers to the Maritaca API and other service interfaces, under Brazil's General Data Protection Law (Law No. 13,709/2018, LGPD). It complements the Privacy Policy and Terms & Conditions, and serves as a reference for due diligence and Data Processing Agreements (DPA).
2. Use of data for model training
Data submitted by customers through the API is never used for training, re-training, fine-tuning, continued pretraining, reinforcement learning (RLHF or similar), distillation, model evaluation, or any other purpose involving the development or calibration of AI models belonging to Maritaca AI or third parties. This commitment covers prompts and other input content, model-generated responses, conversation contexts and histories, files attached to requests, and associated usage metadata.
In Web Chat and mobile apps, conversations are stored so users can access them later, but are likewise not used for training, regardless of whether the user is on a paid or free plan.
Data submitted through the API is processed exclusively to handle the customer's request and return the corresponding response. This non-use is a permanent commitment by Maritaca AI and may be formalized contractually in a specific clause of the DPA signed with the customer (see section 8).
3. Retention and disposal
API: prompt and response content is discarded immediately after the output is generated. For billing purposes, we store only the token count for each request. Technical infrastructure logs (IP address, timestamp, token count and approximate geolocation) are retained for up to eighteen months and do not contain prompt or response content. This retention meets the obligation under Article 15 of Brazil's Internet Civil Framework (Law No. 12,965/2014), which requires access records to be retained for at least six months, and serves billing, fraud prevention, security and the regular exercise of rights in legal proceedings, under the LGPD. Error and observability logs may retain request content and are discarded within thirty days.
Web Chat and apps: conversations remain stored for as long as the user keeps them, and retention and disposal periods follow the Privacy Policy.
Once the applicable periods end, data is anonymized or destroyed using data shredding techniques, unless otherwise required by law.
4. Data residency in Brazil (br-sp region)
Models with the br-sp suffix run inference entirely on infrastructure located in Brazil (São Paulo region), so no data submitted in the prompt leaves the country during processing. These are the same Sabiá family models, with the same capabilities and context window. Inference runs in an EVEO data center in São Paulo, and the logs and telemetry associated with this traffic also remain in Brazil.
5. Subprocessors
Maritaca AI uses service providers for specific functions, such as data center and cloud infrastructure, payment processing and operational services, always under contractual confidentiality and data protection obligations equivalent to those undertaken with its customers. The current list of subprocessors is published in Annex III of the DPA, and customers are notified of material changes at least 30 days in advance.
6. Information security
Maritaca AI maintains an Information Security Management System (ISMS) structured according to ISO/IEC 27001:2022 requirements, with technical and organizational controls to ensure the confidentiality, integrity and availability of the data processed. This includes TLS 1.2+ encryption in transit and AES-256 at rest, role-based access control (RBAC), and segregation between production (inference) environments and all model research and development environments.
7. Security incident notification
In the event of a security incident that may pose a relevant risk or harm to customer data, Maritaca AI will notify affected customers at their registered email addresses within 72 hours of confirming the incident, stating the nature of the event, the data potentially affected and the measures taken. Where applicable, notification to the ANPD and data subjects will follow the deadlines in the Security Incident Notification Regulation (Resolution CD/ANPD No. 15/2024).
8. Data Processing Agreement (DPA)
The Maritaca AI DPA is published and incorporated into the Terms & Conditions, applying automatically to all API customers without requiring a signature. It contractually reflects the commitments on this page, including the non-use of data for training and the definition of controller and processor roles. Customers who need a signed copy may request one at the email address below.
9. Contact
10. Version History
- August 2026 (current version)