Privacy Policy
1. Scope and Controller
This Policy applies to all interactions with Web Chat, the Maritaca API, on-premise distributions of Sabiá models, and the management and documentation platform. For registration, billing and technical-log data and for Web Chat and app content, the controller is Maritaca Inteligência Artificial Ltda., CNPJ 48.565.396/0001-40. For content submitted by customers through the API, Maritaca AI acts as a processor, handling the data solely on the customer's behalf under the Data Processing Agreement (DPA).
2. Data Collection Channels
We only collect information necessary for the service, originating from registration (name, email, company, password hash), user content (prompts, texts, files), technical logs (IP, timestamp, token count, approximate geolocation), cookies, support records, and payment processors (e.g., Stripe). We do not collect data from public databases, nor do we request sensitive data or data of minors at registration. Personal data contained in content submitted by users or API customers is processed solely to provide the service, as described on the Data Processing & Security page and in the DPA.
3. Retention
Registration data is kept while the account is active, plus five years. Web Chat and app conversations remain stored for as long as the user keeps them and are deleted within thirty days after the conversation or the account is deleted. Content sent to the API is discarded immediately after the output is generated, though error logs may retain request content for up to thirty days. Technical logs last eighteen months; financial records, ten years per tax law. Specific commitments for data sent to the API, including immediate disposal of prompt content and data residency in Brazil (br-sp), are described on the Data Processing & Security page.
4. Legal Bases
We execute the contract to provide the service; protect legitimate interests to prevent fraud and improve experience; comply with legal obligations; and obtain consent when required (marketing or analytical cookies).
5. Purposes of Use
Operate, maintain and improve the services; measure token consumption and bill; provide support and administrative communications; develop new features without using user content for re-training models (unless explicitly agreed; see Data Processing & Security); and meet legal or judicial obligations.
6. Sharing
Data is only shared with service providers under confidentiality, legal authorities, corporate successors with equivalent protection levels, or third parties indicated by the user with consent. External links have their own policies.
7. Cookies
We use strictly necessary cookies for authentication and load-balancing; optional analytical cookies for metrics (up to twelve months); and functional cookies for language (up to six months). The user can manage preferences via the banner or browser, knowing that refusing essential cookies may affect service.
8. Security
We apply TLS 1.2+ encryption in transit and AES-256 at rest, RBAC, environment separation and ongoing audits, following ISO 27001 guidelines.
9. Disposal
Once retention periods end, data is anonymized or destroyed via data shredding techniques, except for legal obligations.
10. Data Subject Rights
Confirm processing, access, correct, port, anonymize, block or delete data; contest processing based on legitimate interest; revoke consent; and request review of automated decisions. We may request identity validation and decline requests covered by legal obligations or trade-secret protection, always with justification.
11. International Transfers
When using cloud infrastructure outside Brazil, we ensure equivalent protection via standard contractual clauses or adequacy verification.
12. Children and Adolescents
The Services are intended for users 18 and older, and accounts identified as belonging to minors are removed. This restriction concerns the account holder; personal data contained in content submitted by customers, acting as controllers or processors, is governed by the DPA, and customers are responsible for ensuring an applicable legal basis.
13. Changes
Material changes will be communicated 30 days in advance, and previous versions will remain available for consultation.
14. Contact
15. Version History
- July 15, 2025 (current version)