Privacy Policy

Dialoga AI is a Brazilian platform for continuous listening and intelligence on workplace feedback, built to make active, structured dialogue between companies and their employees easier. Our mission is to turn individual perceptions into collective strategies, always with responsibility and respect for each person's data. This Privacy Policy describes how we collect, use, store and protect the personal data processed on our platform, in accordance with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).

We only collect the data strictly necessary to provide the service: • Identification data: full name, work email and a unique identifier provided by the contracting company. • Interaction data: answers to the interviews conducted by our AI, Laura, including text messages and audio sent voluntarily during conversations. • Professional profile data: job title, department and length of service, provided by the contracting company to give context to the analyses. • Technical data: access logs, IP address, device type and browser, used solely for security, diagnostics and service improvement. • Blog newsletter: only the email of people who sign up of their own accord, with the date, page and IP address of the signup and the date of confirmation, which serve as proof of consent. We do not request sensitive data (race, religion, health, sexual orientation) or data from minors under 18. Because interviews are open-ended, answers may occasionally reveal sensitive information; for that reason, processing only takes place with your explicit consent (see Legal basis).

Your data is processed on the following legal bases provided for in the LGPD: • Performance of a contract: to provide the service contracted by your company. • Legitimate interest: for continuous improvement of the platform and fraud prevention. • Compliance with a legal obligation: to meet regulatory and tax requirements. • Consent (Art. 7): for specific purposes, such as analytics cookies and optional communications. • Consent for sensitive data (Art. 11): before each interview, you accept a specific consent form, because open answers may reveal sensitive data. This acceptance is recorded and can be withdrawn at any time.

The data collected is used to: • Conduct personalized one-on-one interviews and produce aggregated reports for the company's leadership. • Calculate metrics such as eNPS, engagement and workplace climate indices. • Personalize the listening experience based on the employee's profile and history. • Improve how conversations are conducted and the quality of analyses, by adjusting the platform's own scripts, instructions and rules. • Send new blog articles to people who signed up for the newsletter and confirmed through the link sent to their email. That email is not used for any other purpose or matched against other records. • Ensure the security and integrity of the platform. • Comply with applicable legal and regulatory obligations. We do not train artificial intelligence models on your conversations. The AI provider we use (Google Gemini, on the paid API tier) may not use that content to improve its own products either, under the terms of its contract. We never use personal data for advertising or external behavioral profiling, and we never sell it to third parties under any circumstances.

Anonymity is central to Dialoga AI and is built into the platform's technical architecture. Reports delivered to leadership contain only aggregated data: no individual answer is associated with an employee's name. Identity is separated from answer content before analytical processing, by system design. Individual reports are only accessible to the employees themselves, in the "My Results" section. In management reports, a group only appears when it reaches the minimum number of respondents set by the company. That minimum is at least 3 people: the company can raise it, never lower it below that, and the lock lives in the database itself. Anonymity through aggregation greatly reduces the risk of identification, but does not eliminate it in every scenario. An account with very specific details may allow someone close to recognize the author. That is why the conversation screen advises employees to avoid names and details that identify anyone.

Data is only shared in the following contexts: • With the contracting company: exclusively in aggregated, anonymized form, through the platform's reports and dashboards. • With infrastructure providers (subprocessors), only to the extent needed to provide the service: Hostinger (servers and database, in the United States, and transactional email), Google (conversation analysis by Gemini), Cloudflare (storage of audio and files, and DNS) and Sentry (technical error logging). The up-to-date list is on the Security page. • With competent authorities: when required by judicial, regulatory or legal order, to the extent strictly necessary. International transfer: the platform's servers and some subprocessors are outside Brazil, mainly in the United States. These transfers follow the cases and safeguards of Articles 33 to 36 of the LGPD, with contractual data protection clauses with each provider. The employee's name and email are not sent to the AI provider along with the content being analyzed.

Data is retained for as long as needed to perform the contract with the contracting company and for up to 5 years after it ends, to comply with legal obligations and resolve any disputes. Individual conversation data remains accessible to the employee while their relationship with the company is active on the platform. Once access ends, the data is anonymized or permanently and irreversibly deleted, according to the contracting company's preference. Blog newsletter: the email is kept while the subscription is active. A subscription that is never confirmed is deleted after 30 days. People who leave the list, through the link in every email, remain recorded as unsubscribed only to make sure they receive nothing else; full deletion of the record can be requested at privacidade@dialoga.digital.

Under Brazil's General Data Protection Law (Law No. 13,709/2018), you have the following rights regarding your personal data: • Confirmation and access: to know whether your data is processed and to access it in full. • Correction: to request correction of incomplete, inaccurate or outdated data. • Anonymization, blocking or deletion: of data that is unnecessary, excessive or processed in breach of the law. • Portability: to receive your data in a structured format for use in another service. • Withdrawal of consent: at any time, without affecting processing already carried out. • Objection: to processing based on legitimate interest, in justified cases. • Information about sharing: to know which entities your data is shared with. To exercise any right, write to privacidade@dialoga.digital. We reply within 15 business days.

We adopt technical and organizational measures to protect your data, including: • TLS encryption (HTTPS) for all data in transit. • Passwords stored only as hashes, never as text. • Role-based access control, the principle of least privilege and data isolation by company. • Monitoring of production errors. • Daily database backup, encrypted before it leaves the server, kept for 30 days, with a recorded monthly restore test. • Incident response plan, with notice to Brazil's data protection authority (ANPD) and to affected data subjects when the LGPD requires it. Each of these measures has the date of its last check published in our Trust Center. We have not yet commissioned an external penetration test: when it happens, a summary of the result will be published there. For more details, see our Data Security page.

Essential cookies (always active): • Session cookies: to keep the employee signed in while using the platform. • Preference cookies: to remember interface settings. Analytics cookies (only with consent): • On the company website, we use Google Analytics ("_ga" cookies) to measure audience in aggregate, with anonymized IP. These cookies are only activated if you accept them in the cookie banner, and can be refused or withdrawn at any time. We do not use advertising cookies or third-party pixels (Meta, Google Ads, etc.). There is no behavioral analytics in the platform's signed-in areas.

Under Article 41 of the LGPD, we have appointed a Data Protection Officer (DPO) to act as the channel of communication between Dialoga AI, data subjects and Brazil's National Data Protection Authority (ANPD). Officer: Vinicius Madureira Contact: privacidade@dialoga.digital Article 41 requires the officer's identity AND contact details to be disclosed clearly, which is why the name appears here, not just the address.

We may update this Policy from time to time to reflect changes in our practices or in applicable law. In the event of material changes, we will notify users at least 30 days in advance by email or by a notice on the platform. The current version will always be available on this page with the date of the last update.