Privacy Policy

1. Who we are

Tangerin AI is a SaaS platform for governance, risk and compliance of the corporate use of artificial intelligence. We act as a processor ("operadora") of personal data under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018), processing data on behalf and under the instructions of the contracting organization (controller).

Contact: privacidade@tangerinai.com

2. Data we collect

2.1 Data collected by the Tangerin AI Agent (endpoint)

The agent is lightweight software installed on the organization's workstations. It collects exclusively technical metadata about the IT environment:

• Hostname: network name of the workstation.
• Operating system: name and version (e.g., Windows 11).
• Session user name: login of the user logged in at the time of collection, including the corporate domain when available (e.g., TANGERINAI\usuario), and, when available in the operating system or in the corporate directory (Active Directory/Entra ID), the full name of the account. Obtained through operating system APIs, not through activity monitoring.
• Detected AI tools: tool name (e.g., "ChatGPT", "GitHub Copilot"), category, access domain and detection method (active process, DNS resolution or browser history).
• Agent version and technical operating metadata.
• Software inventory: name, version and identifier of AI-related applications, browser extensions and startup items installed on the machine.

2.2 What the agent does NOT collect

• Content of conversations or prompts sent to AI tools.
• Content of files, documents or emails.
• Keystrokes or screenshots.
• Full URLs browsed (only domains of cataloged AI tools).
• Personal data of the contracting organization's end customers.

2.3 Web platform data

• Registration: name, email and password (stored hashed) of the organization's administrators.
• Audit log: actions performed on the platform (e.g., tool classification, settings change), with the time, the email and the IP address of the person who performed them.
• Organization data: name, legal name, CNPJ (Brazilian corporate taxpayer number), billing address, website, sector, size, time zone and contracted plan. The tax identifier of a company outside Brazil, when provided at purchase, is sent only to Stripe.
• Payment: a purchase in Brazil requires a mobile phone number with area code, which is sent only to Asaas (payment processor) and is not stored by Tangerin AI. Card data is entered on the payment pages of Asaas or Stripe and does not pass through our servers. To change the billing email or mobile phone after the purchase, write to contato@tangerinai.com.
• AI Use Policy attestation: email of the invited employee and, when they sign, the name provided (optional), the date, the time and the IP address of the signature.

2.4 Tangerin AI browser extension (optional)

When the organization installs the browser extension, it reports, when one of the AI tools it recognizes is accessed: the name and domain of the tool, the plan of the account used (free or paid) and, when visible on the tool's page, the email of the account signed in to it. The extension does not collect the content of conversations, prompts or pages.

2.5 Integrations and corporate directory

• Network integrations (SIEM, firewall/NGFW, SSE): when configured by the organization, we receive from the logs of these systems: tool and domain accessed, user identity (email or network user), source IP address and hostname, action (allowed/blocked) and time.
• Directory synchronization (Microsoft Entra ID, Google Workspace or import): name and email of the organization's employees, used to associate AI use with the people in the organization.

3. How we use the data

We use the collected data exclusively to:

• Provide the features of the Tangerin AI platform contracted by the organization.
• Generate Shadow AI reports, governance scores and compliance evidence.
• Analyze individual usage patterns (time of day, working hours and volume) for information security purposes and detection of anomalous use.
• Send alerts and notifications configured by the organization.
• Maintain and improve the quality and security of the service.
• Comply with legal and regulatory obligations.

We do not sell, share or monetize organizations' data with third parties for advertising or market analysis purposes.

4. Use of data for improvement and AI

We may use technical and telemetry metadata (such as domains of detected AI tools, categories and aggregated usage patterns) to improve detection accuracy, the tool catalog and other platform features, including features that use AI/machine learning internally (e.g., automatic classification of new tools).

For this purpose, we give preference to aggregated, anonymized or combined data from multiple organizations, so that they do not identify a specific organization or employee. We do not use a contracting organization's data to train models for the benefit of third parties outside the context of improving the Tangerin AI platform itself, nor for purposes not related to the provision of the service.

5. Legal basis for processing

The processing of data by Tangerin AI is based on the following legal bases of the LGPD:

• Performance of a contract (art. 7, V): for data necessary to provide the contracted service.
• Legitimate interest (art. 7, IX): for technical security metadata and internal auditing.
• Compliance with a legal obligation (art. 7, II): when required by a competent authority.

The contracting organization, as controller, is responsible for ensuring the appropriate legal basis with respect to its own employees, as explained on the LGPD page.

6. Storage and security

• Database: Supabase (PostgreSQL), hosted in the São Paulo region (sa-east-1), with encryption at rest and in transit (TLS 1.2+), multi-tenant isolation via Row Level Security.
• Hosting infrastructure: CDN and runtime, with access logs retained for 30 days.
• Agent → platform communication: HTTPS with authentication by an API key unique to each organization.
• Passwords: never stored in plain text; encrypted and managed with bcrypt.
• Payments: take place on pages hosted by Asaas and Stripe; card data does not pass through our servers.

We adopt appropriate technical and organizational measures to protect the data against unauthorized access, loss, destruction or improper disclosure. In the event of a relevant security incident, we will notify the contracting organization and, when required by the LGPD, the ANPD (Brazilian Data Protection Authority), within 72 hours. Additional details about our security measures are described on the Information Security page.

7. Data retention

• AI usage events: kept for the history period of the contracted plan (3 months on Starter and 12 months on Business, Enterprise and Scale) and automatically purged after that. Workstation records: while the account is active.
• Platform audit logs: kept for 5 years and deleted after that (or earlier, together with the organization's data, when it is deleted).
• Trial not converted into a subscription: the organization is suspended at the end of the trial and, after 90 days, its data is automatically deleted, with email notices at 30, 60 and 80 days.
• Non-payment by an existing customer: with access suspended for non-payment (including when a payment dispute ends with the amount returned to the cardholder), the organization receives a termination notice at 90 days; the contract is terminated at 120 days and the data is automatically deleted at 150 days of suspension, each step at least 30 days after the previous one (Terms of Use, Clause 6).
• End of the contract (for example, a subscription canceled by the customer): the data is kept for 12 months after the end of the contract and then automatically deleted, with email notices 30 and 7 days before. If the organization subscribes again before then, nothing is deleted.
• Deletion of the organization's data (automatic or on request): we delete the operational data (events, workstations, users, policies, evidence and audit logs), but we keep the company's commercial record (name, legal name, CNPJ, city, plan and dates). The name and email of the person who registered the organization and of the person who requested the deletion are deleted after 5 years.
• Billing history (subscriptions and payments): kept for 5 years counted from the end of the year of each payment, for tax and proof purposes, including after the deletion of the other data, and then deleted (a payment from October 2026, for example, is deleted from January 1, 2032).
• Asaas and Stripe: deleting the data at Tangerin AI does not delete the organization's registration with these payment processors, which keep it under their own legal obligations; rights over that data may be exercised directly with them.
• The organization may request early deletion at any time, by email to privacidade@tangerinai.com.

To ensure continuity and disaster recovery, we maintain automatic database backups, which may retain copies of the data for a short additional period after the deletion of the original data, until the backups are naturally replaced by the infrastructure provider's rotation cycle.

8. Sharing with third parties

Data is shared only with subprocessors essential to the operation of the service:

International data transfers take place on the basis of adequacy mechanisms or standard contractual clauses, in compliance with art. 33 of the LGPD and the General Data Protection Regulation (GDPR) where applicable. Copies of the transfer mechanisms used may be requested from privacidade@tangerinai.com.

If we add a new subprocessor essential to the operation of the service, we will notify the administrators of the contracting organizations at least 15 days in advance by email.

9. Your rights

The contracting organization and its administrators have the following rights regarding the personal data processed by Tangerin AI:

• Confirmation and access: to know whether we process your data and obtain a copy.
• Correction: to correct incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion: of unnecessary data or data processed in non-compliance.
• Portability: to export your data in a structured format.
• Information about sharing: to know with whom we share your data.
• Objection: to object to processing based on legitimate interest.
• Withdrawal of consent: when processing is based on consent.

To exercise these rights, contact us by email at privacidade@tangerinai.com. We will respond within 15 calendar days (LGPD, Art. 19, II), counted from the request.

10. Cookies and tracking

We use our own cookies for (i) authentication and session security and (ii) display preferences, such as theme (light/dark) and language. In the console (app.tangerinai.com.br and app.tangerinai.com) we measure audience and performance with Vercel Web Analytics and Speed Insights, without a cookie or a persistent identifier. On the institutional website (tangerinai.com.br and tangerinai.com) we also use Google Analytics (Google LLC, USA), which sets measurement cookies (_ga, _ga_*), and we display review badges loaded from the SourceForge and SaaSHub websites, which receive the visitor's IP address. We do not use advertising pixels.

11. Privacy of children and adolescents

Tangerin AI is a business-to-business service, intended for organizations and their adult administrators. We do not direct our services to children or adolescents and we do not knowingly collect personal data from individuals under 18. If we become aware that a minor's data has been improperly provided, we will delete it. Parents, guardians or the data subject may contact us by email at privacidade@tangerinai.com.

12. Links to third-party websites

Our platform and institutional website may contain links to third-party websites or services that we do not operate or control. We are not responsible for the privacy practices or the content of these third parties. We recommend reading the privacy policy of any third-party website before providing personal data to it.

13. Changes to this policy

We may update this Policy periodically. When we make material changes, we will notify the administrators of the contracting organizations by email at least 15 days in advance. Continued use of the platform after the effective date constitutes acceptance of the changes.

14. Contact

Questions, requests or complaints related to privacy should be sent to our Data Protection Officer (DPO):

You may also file complaints with the Brazilian National Data Protection Authority (ANPD): www.gov.br/anpd.