§1 Who is the controller
Controller: Data Riders Consultoria e Educação LTDA, CNPJ 29.742.713/0001-02, headquartered in Belo Horizonte/MG, Brazil. For privacy questions or to exercise your rights, write to privacy@datariders.com.br or hi@datariders.com.br.
§2 Data we collect
We collect only what is necessary for the purposes described in this policy.
- Contact & newsletter forms: name, email, company, message or subject. Voluntary.
- Event / Academy registrations: name, email, role, organization and any professional data the participant provides.
- AI agents in production: prompts and questions you type inside an agent, plus any email or name you choose to provide. See §3.
- Analytics & cookies: technical browser data (truncated IP, user-agent, pages visited, referrer). See §4 and the Cookies Policy.
- Documents uploaded to agents (GISTM.ai, AquaTwin, ISO 14001 etc.): handled per the life-cycle table in the Trust Center (≤ 30‑day retention by default).
- Resumes (Careers): name, contact details, professional history. Kept for up to 24 months.
§3 AI agents in production
This website does not run a chat widget. There is no floating chat bar and no agent embedded inside any page. Each AI agent (GISTM.ai, AquaTwin, ISO 14001 Pre-Auditor, TSM.AI, TCM, CMSI, PAEBM.ai, SiteVisits.ai, RIDE Agent, Muiraquitãna) is opened from an explicit button on its landing page and runs on its own separate domain, in its own browser window. When you use one of those agents:
- What is collected: prompts and questions you type, timestamps, an anonymous session ID generated inside the agent, and — only if you provide it — your email and name.
- Separate origin: because the agent runs on its own domain, its storage and session data are not shared with datariders.com.br. Nothing you type inside an agent is written into this website's storage.
- Model provider: prompts are routed to an AI model hosted on Amazon Bedrock (preferred) or OpenAI/Anthropic, configured not to use your data to train foundation models.
- Server-side retention: agent transcripts are kept up to 90 days for troubleshooting and agent improvement, then deleted. Content flagged as sensitive can be deleted on request.
- What we do not do: we do not link your agent session to advertising; we do not share your prompts with third parties for marketing; we do not train foundation models with them.
- How to request deletion: write to privacy@datariders.com.br with the agent name and approximate date — we respond within 15 business days.
§4 Analytics & cookies
We use the following tools, all configured for privacy:
- Microsoft Clarity (heatmaps and session replay) — does not capture sensitive field content; automatic masking on
type=passwordand forms taggeddata-clarity-mask. - Google Analytics 4 (only if you consent) — IPs anonymized; no demographic advertising features.
- LinkedIn Insight Tag (only if you consent) — used to measure B2B campaign effectiveness; no cross-matching with sensitive personal data.
- Strictly necessary cookies (session, language, consent preference) are set without prior consent, per LGPD/GDPR.
Details in the Cookies Policy.
§5 Legal bases (LGPD/GDPR)
- Contract performance (LGPD art. 7º, V; GDPR art. 6(1)(b)) — for contracted services (audits, agents in production).
- Legitimate interest (LGPD art. 7º, IX; GDPR art. 6(1)(f)) — for newsletters to professional contacts, security, fraud prevention.
- Consent (LGPD art. 7º, I; GDPR art. 6(1)(a)) — for non-essential cookies and marketing communications.
- Legal obligation (LGPD art. 7º, II; GDPR art. 6(1)(c)) — tax records, accounting retention, response to authorities.
§6 Purposes
- Delivery of contracted services and customer support.
- Operation of the website and agents (authentication, chat response, report generation).
- Information security, fraud prevention and incident response.
- Sending professional newsletters (with unsubscribe link in every email).
- Aggregate metrics and anonymized analytics to improve the site and the agents.
- Legal, accounting and regulatory compliance.
§7 Sharing with third parties
We share personal data only with sub-processors publicly listed at /en/sub-processors/ (AWS, managed SaaS platform, model providers, email/CRM tools, analytics platforms). We do not sell personal data. Where legally compelled, we may share with authorities, always within the scope of the request.
§8 International transfer
Part of the processing happens on servers in the United States and the European Union (AWS regions us‑east‑1 and eu‑west‑1; managed SaaS platform in the US). We rely on Standard Contractual Clauses (SCCs) and equivalent LGPD mechanisms to ensure an adequate level of protection.
§9 Retention & deletion
- Customer documents in agents: ≤ 30 days (see full table).
- AI agent prompts and transcripts: ≤ 90 days.
- Newsletter: until voluntary unsubscribe; backups for additional 35 days.
- Resumes: up to 24 months.
- Application logs: 12 months (configurable by contract).
- Contractual and tax data: legal retention (up to 5 years).
§10 Data subject rights (LGPD art. 18 / GDPR art. 15‑22)
You may, at any time and free of charge:
- Confirm whether we process your data;
- Access, correct, anonymize or delete unnecessary or unlawfully processed data;
- Request portability to another provider;
- Withdraw consent and object to processing based on legitimate interest;
- Request information on sharing and sub-processors;
- Lodge a complaint with the ANPD (Brazil) or your local DPA in the EU.
Requests: privacy@datariders.com.br — we respond within 15 business days.
§11 Security
We maintain technical and organizational controls described in detail at the Trust Center: TLS 1.2+, encryption at rest, least-privilege IAM, MFA, continuous monitoring and documented incident response.
§12 Changes
This policy may be updated periodically. Material changes will be communicated via a banner on the site and by email to active subscribers. Current version: 2026‑04‑27 (G40).
§13 Contact & DPO
Data Protection Officer (DPO): Fernando Damasio · privacy@datariders.com.br · hi@datariders.com.br.