Data Processing Agreement (DPA)
This Data Processing Agreement (“DPA”) forms part of and supplements the Terms & Conditions (“Main Agreement”) between Maritaca Inteligência Artificial Ltda., CNPJ 48.565.396/0001-40 (“Maritaca AI”), and each Maritaca API customer (“Customer”), and governs the processing of personal data by Maritaca AI on the Customer's behalf within the Maritaca API (“Services”), under Law No. 13,709/2018 (“LGPD”).
This DPA applies automatically to all API customers, without requiring a signature, upon acceptance of the Terms & Conditions or use of the Services. Customers who need a signed copy of this same document may request one at info@maritaca.ai.
1. Definitions
The terms “personal data”, “data subject”, “controller”, “processor”, “processing”, “anonymization” and “security incident” have the meanings assigned to them by Article 5 of the LGPD. “Input” means prompts, messages, documents, files and other content submitted by the Customer to API routes; “Output” means responses generated by the models as a result of those calls.
2. Subject Matter and Roles of the Parties
2.1. For the purposes of this DPA, the Customer acts as Controller of any personal data contained in Inputs or, when processing such data on behalf of third parties, as Processor duly authorized by the respective Controller. Maritaca AI acts as Processor (or subprocessor, as applicable), processing such data exclusively on the Customer's behalf and to provide the Services.
2.2. Maritaca AI will process personal data only in accordance with this DPA, the Main Agreement and the Customer's documented, lawful instructions, and will inform the Customer if it considers that an instruction violates applicable law.
2.3. The description of processing (nature, purpose, duration, categories of data and data subjects) is set out in Annex I.
3. Non-Use of Data for Model Training
3.1. Maritaca AI expressly, formally and unequivocally declares that data submitted by the Customer through the API is never used for training, re-training, fine-tuning, continued pretraining, reinforcement learning (RLHF or similar), distillation, model evaluation, or any other purpose involving the development, improvement or calibration of AI models belonging to Maritaca AI or third parties.
3.2. The commitment in clause 3.1 covers: (a) Inputs; (b) Outputs; (c) conversation contexts, message histories and files attached to requests; and (d) usage metadata associated with requests, with respect to its use in training pipelines.
3.3. Data submitted through the API is processed exclusively to handle the Customer's request and return the corresponding Output.
4. Retention and Disposal
4.1. The content of Inputs and Outputs is discarded immediately after the Output is generated. For billing purposes, Maritaca AI stores only the token count for each request.
4.2. Technical infrastructure logs (IP address, timestamp, token count) do not contain Input or Output content and are retained for up to 18 (eighteen) months, in accordance with the obligation under Article 15 of Law No. 12,965/2014 (Brazil's Internet Civil Framework) and for billing, fraud prevention, security and the regular exercise of rights.
4.3. Error and observability logs may retain request content and are discarded within 30 (thirty) days.
4.4. Upon termination of the Main Agreement, Maritaca AI will delete any Customer content remaining in its systems within 30 (thirty) days, unless retention is legally required, using secure disposal techniques.
5. International Transfers
5.1. When Maritaca AI uses cloud infrastructure outside Brazil, international transfers will comply with Article 33 and subsequent provisions of the LGPD, through standard contractual clauses or another mechanism providing equivalent protection.
6. Subprocessors
6.1. The Customer grants general authorization for Maritaca AI to engage the subprocessors listed in Annex III, which operate under contractual confidentiality and data protection obligations equivalent to those in this DPA.
6.2. Maritaca AI will notify customers of material changes to the subprocessor list at least 30 (thirty) days in advance, during which time the Customer may raise a reasoned objection.
6.3. Maritaca AI remains responsible to the Customer for the acts and omissions of its subprocessors relating to the processing covered by this DPA.
7. Information Security
7.1. Maritaca AI maintains an Information Security Management System (ISMS) structured according to ISO/IEC 27001:2022 requirements, with the technical and organizational controls described in Annex II, including segregation between production (inference) environments and all model research and development environments.
7.2. Maritaca AI ensures that persons authorized to process personal data are subject to confidentiality obligations.
8. Security Incidents
8.1. In the event of a security incident that may pose a relevant risk or harm to personal data processed on the Customer's behalf, Maritaca AI will notify the Customer at its registered email address within 72 (seventy-two) hours of confirming the incident, stating at least: the nature of the event, the categories of data and data subjects potentially affected, the measures taken or proposed, and a point of contact for further information.
8.2. Notification of the incident to the ANPD and data subjects, when legally required, is the Customer's responsibility as Controller, subject to the deadlines in Resolution CD/ANPD No. 15/2024. Maritaca AI undertakes to provide reasonably necessary cooperation and information.
9. Data Subject Rights
9.1. Since Input and Output content is discarded immediately after processing, Maritaca AI's ability to respond directly to data subject requests is limited. Nevertheless, Maritaca AI will provide the Customer with reasonable assistance in handling requests under Article 18 of the LGPD and will forward to the Customer any requests it receives directly concerning processing on the Customer's behalf, without responding directly to the data subject unless instructed otherwise.
10. Evidence and Audits
10.1. Upon reasonable request and no more than once every 12 (twelve) months, Maritaca AI will provide the Customer with information and evidence demonstrating compliance with this DPA, including responses to security questionnaires.
10.2. On-site or independent third-party audits may be conducted by prior agreement on scope, cost and date, with at least 30 (thirty) days' notice, without access to data belonging to other Maritaca AI customers.
11. Liability
11.1. The Parties' liability under this DPA is subject to the limitations and exclusions set out in the Main Agreement.
12. Term
12.1. This DPA remains in force for the duration of the Main Agreement and, where applicable, for as long as Maritaca AI retains personal data processed on the Customer's behalf.
13. Changes and General Provisions
13.1. This DPA is governed by the laws of the Federative Republic of Brazil. Any conflicts between this DPA and the Main Agreement regarding personal data processing will be resolved in favor of this DPA.
13.2. Material changes to this DPA will be communicated 30 (thirty) days in advance, and previous versions will remain available for consultation.
Annex I — Description of Processing
Nature of processing: receipt, ephemeral computational processing to generate Outputs using language models, and immediate disposal of content.
Purpose: provision of Maritaca API inference Services under the Main Agreement.
Duration: the term of the Main Agreement, subject to the retention periods in clause 4.
Categories of data and data subjects: defined by the Customer according to the content of Inputs submitted to the Services. The Customer undertakes not to submit categories of data for which it has no legal basis.
Annex II — Technical and Organizational Measures
- TLS 1.2+ encryption for data in transit and AES-256 for data at rest;
- Role-based access control (RBAC) and the principle of least privilege;
- Segregation between production (inference) environments and model research and development environments;
- An ISMS structured according to ISO/IEC 27001:2022 requirements, with periodic internal audits;
- Immediate disposal of Input and Output content after processing (clause 4.1);
- Confidentiality obligations applicable to all personnel with access to personal data.
Annex III — Authorized Subprocessors
| Subprocessor | Function | Location |
|---|---|---|
| Google Cloud | Cloud infrastructure (inference, API and storage) | Brazil, United States and European Union |
| EVEO | Data center in Brazil (inference infrastructure) | Brazil |
| New Relic | Infrastructure monitoring and logs | United States |
| Auth0 (Okta) | Account authentication | United States |
| Stripe | Payment processing | United States |
| SendGrid (Twilio) | Transactional email | United States |
Optional features invoked by the Customer (web search, document reading and OCR, and Chat voice features) may involve additional specialized providers located in the United States, subject to the same confidentiality and data protection obligations in this DPA. The list identifying these providers is supplied upon request under clause 6.
Version History
- August 2026 (current version)