LGPD: Brazilian General Data Protection Law

1. Personal data processed by the platform

Tangerin AI processes the smallest possible amount of personal data: only what is strictly necessary to provide the service (data minimization principle). The personal data processed are:

1.1 Data collected by the endpoint agent, the browser extension and the integrations

1.2 Data of the platform administrators

1.3 What is NOT collected

• Sensitive data (health, biometrics, racial origin, religious beliefs, etc.).
• Content of conversations with AI tools.
• Content of files, documents or emails.
• Keystrokes or screenshots.
• Personal data of the contracting organization's end customers.

2. Purposes of processing

The personal data processed by Tangerin AI have the following purposes, all linked to the contracted service:

• Identify which AI tools are used by which workstations and users.
• Generate risk reports, governance scores and regulatory compliance evidence.
• Issue alerts configured by the organization (e.g., detection of a prohibited tool).
• Analyze individual usage patterns (time of day, working hours and access volume) for information security purposes and detection of anomalous use of AI tools.
• Authenticate administrators and maintain the security of the platform.
• Comply with legal obligations and respond to competent authorities.

The data are not used for advertising purposes, consumer behavioral analysis or automated decision-making with legal effect on the monitored employees.

3. Obligations of the contracting organization (Controller)

The organization that contracts Tangerin AI is the controller of its employees' data. For use in compliance with the LGPD, we recommend that the organization:

• Inform employees about the installation of the agent, its purpose, the types of data collected and the rights they have, preferably through a Corporate AI Use Policy (the Tangerin AI platform offers an editor and a digital signature module for this policy).
• Identify the appropriate legal basis for processing in the context of the employment relationship: usually, the employer's legitimate interest in protecting its information assets (art. 7, IX) or the performance of the employment contract (art. 7, V).
• Update its DPIA (RIPD, Data Protection Impact Assessment Report) to include the processing carried out through Tangerin AI.
• Handle the rights requests of data subjects (employees) who request information about the data collected. Tangerin AI provides operational support for the export and deletion of data upon the organization's request.
• Sign a Data Processing Agreement (DPA) with Tangerin AI, available upon request to privacidade@tangerinai.com.

4. Data subject rights

The employees whose data are processed through Tangerin AI (data subjects) have the following rights guaranteed by the LGPD (arts. 17 to 22):

Data subject requests must be sent to the employing organization (controller), which may call on Tangerin AI (processor) to obtain the information or carry out the necessary operations. Tangerin AI's response time to the organization is 15 calendar days (LGPD, Art. 19, II).

5. Storage and international data transfer

The main database (Supabase, Inc.) is hosted in the São Paulo region (sa-east-1): customer data is stored in Brazil.

Part of the processing is carried out by subprocessors located in the United States (Vercel, Inc., for running the application; Resend, Inc., for sending transactional emails; Stripe, Inc., for payments made outside Brazil; and Google LLC, for audience measurement of the institutional website through Google Analytics). Payments made in Brazil are processed by Asaas Gestão Financeira S.A., in Brazil. This transfer takes place on the basis of:

• Standard contractual clauses compatible with art. 33 of the LGPD.
• Equivalent security certifications contractually required of the subprocessors.

The ANPD has published regulations on international transfers (Resolution CD/ANPD No. 19/2024), which guide the practice adopted by Tangerin AI.

6. Data security

Tangerin AI adopts the following technical and organizational security measures:

• Encryption at rest and in transit (TLS 1.2+) across the entire infrastructure.
• Multi-tenant isolation through Row Level Security in the database.
• Agent authentication by an API key unique to each organization, rotatable at any time.
• Audit log of all administrative actions on the platform.
• Internal access to customer data restricted to authorized staff.
• Periodic security review policy for the infrastructure.

The complete description of the technical and organizational measures is available on the Information Security page, including our responsible vulnerability disclosure process.

7. Security incidents

In the event of a security incident that may result in relevant risk or harm to data subjects, Tangerin AI undertakes to:

• Notify the contracting organization (controller) within 72 hours of becoming aware of the incident.
• Provide information on the nature of the affected data, the data subjects involved and the measures taken.
• Support the organization in preparing the notification to the ANPD, when required.
• Take immediate containment and remediation measures.

Incidents must be reported to Tangerin AI by email at seguranca@tangerinai.com.

8. Subprocessors

Deleting the organization's data at Tangerin AI (on request or automatically) does not delete its registration with Asaas or Stripe, which keep it under their own legal obligations; data subjects and the organization may exercise their rights directly with them.

9. Data Protection Officer (DPO)

Pursuant to art. 41 of the LGPD, Tangerin AI designates the following channel for communications related to data protection:

10. Compliance resources for the contracting organization

The Tangerin AI platform offers native tools that help the contracting organization comply with the LGPD internally: