Privacy Policy

1. Who we are

The Operator acts as the controller of Users’ personal data on the platform, within the meaning of Art. 5(VI) of the LGPD, and is responsible for decisions about processing data collected in connection with use of Architety.

When an Organization uses Architety to manage its own clients’ and contacts’ data, the Operator acts as a processor for that information, processing it solely on the Organization’s instructions.

2. Data we collect

2.1 Data you provide directly

2.2 Data collected automatically

2.3 Data received from third parties

When you choose to sign in with Google OAuth, we receive from Google the name, email address, and profile photo linked to your Google account, solely to create and access your Architety account.

3. How we use data

We use the personal data we collect for the following purposes:

• Service delivery: create and manage your account, process projects, budgets, and other platform features.
• Authentication and security: verify identity, detect and prevent fraud, unauthorized access, and abuse.
• Transactional communications: registration confirmations, account notifications, security alerts, and support responses.
• Product communications: relevant updates, new features, and scheduled maintenance. You may opt out at any time.
• Product improvement: analyze usage patterns in aggregate and anonymized form to improve the experience and develop features.
• Legal compliance: comply with requirements from competent authorities, including Brazil’s National Data Protection Authority (ANPD).
• Regular exercise of rights: use data in administrative, arbitral, or judicial proceedings when necessary.

4. Legal basis (LGPD)

All personal data processing by Architety is based on one of the legal grounds set out in Art. 7 of the LGPD:

Where processing is based on consent, you may withdraw it at any time, without affecting the lawfulness of processing carried out before withdrawal.

5. Sharing of data

Architety does not sell, rent, or assign personal data to third parties for commercial purposes. Sharing occurs only in the following situations:

5.1 Service providers (sub-processors)

We share data with vendors that help us deliver the service, always under contracts with data protection clauses consistent with this Policy:

5.2 Legal obligation or court order

We may disclose personal data when required by law, regulation, legal process, court order, or competent public authority request.

5.3 Protection of rights

We may share data when necessary to protect the rights, property, or safety of the Operator, Users, or third parties, including fraud prevention and investigation.

5.4 Corporate transactions

In a merger, acquisition, corporate reorganization, or sale of assets, data may be transferred to the successor entity, which will remain bound by this Policy or publish a new policy with prior notice to Users.

6. International data transfers

Some of our service providers are located outside Brazil. In those cases, we apply safeguards under Arts. 33–36 of the LGPD to ensure an adequate level of protection:

• Transfers to countries recognized by the ANPD as providing adequate protection.
• Standard contractual clauses imposing protection obligations equivalent to Brazilian law.
• Certifications and compliance programs recognized internationally (e.g. ISO 27001, SOC 2).

7. Retention and deletion

We keep personal data only as long as necessary for the purposes in this Policy or to meet legal obligations. Retention periods:

After retention periods expire, data is securely deleted or irreversibly anonymized.

8. Data security

We adopt appropriate technical and organizational measures to protect personal data against unauthorized access, accidental or unlawful destruction, loss, alteration, disclosure, or any improper processing. Measures include:

• Encryption in transit: all communication between your browser and the platform uses TLS 1.2 or higher.
• Encryption at rest: files and backups in Azure Blob Storage are encrypted at rest.
• Access control: internal access to production data is role-based (least privilege) and audited.
• Multi-tenant isolation: database queries are filtered by organizacaoId to prevent cross-Organization access.
• Secure authentication: OAuth 2.0 and magic links; the Operator does not store passwords.
• Continuous monitoring: automated alerts for suspicious activity and unauthorized access attempts.
• Vulnerability management: periodic security reviews and critical updates.

If a security incident may create relevant risk or harm to Users, the Operator will notify the ANPD and affected data subjects within the timeframe required by applicable law.

9. Cookies and tracking

Architety uses cookies and similar technologies to operate the platform and improve your experience.

9.1 Types of cookies

9.2 Architety does not use tracking cookies for advertising or share browsing data with ad networks.

9.3 You can manage cookie preferences via the banner on first visit or in account settings. Disabling essential cookies may affect platform operation.

10. Your rights as a data subject

The LGPD grants you, as a data subject, the following rights (Art. 18), which you may exercise with the Operator at any time:

How to exercise your rights: send a request to help@architety.com identifying yourself and describing the right you wish to exercise. We will respond within 15 calendar days, which may be extended for justified reasons.

11. Your Organization’s client and contact data

When an Organization uses Architety to register its own clients’, suppliers’, and contacts’ data (name, email, phone, address, etc.), the Organization is the controller of that data and the Operator acts as a processor, processing it solely to deliver the contracted service.

In that context, the Organization is responsible for:

• Obtaining appropriate legal bases for processing with the data subjects.
• Informing its clients and contacts about the use of management platforms for their data.
• Handling data subject requests for data entered on the platform.

The Operator will not use that data for its own purposes beyond what is strictly necessary to provide the service contracted by the Organization.

12. Minors

The Architety platform is not intended for people under 18, and we do not knowingly collect personal data from children or adolescents. If we learn that a minor’s data was collected without proper consent, we will delete it promptly.

13. Artificial intelligence and Copilot

Architety integrates an AI assistant (Copilot) based on third-party language models (Google Gemini). Using Copilot involves additional privacy considerations:

• Explicit opt-in: Copilot is only activated with your express consent, which you may withdraw anytime in account settings.
• Data processed: when you use Copilot, the content of your request (text you enter) may be sent to the AI provider’s API to generate a response.
• Context isolation: the Operator does not include other Organizations’ data in the context sent to the AI provider, so each request is processed in isolation.
• No training: data sent to Copilot is not used to train or improve the Operator’s or provider’s AI models, unless the provider has a specific policy, in which case you will be informed.
• Sensitive content: we recommend not entering sensitive personal data (health, racial origin, biometrics, etc.) in Copilot requests.

For more on how the AI provider processes data, see Google’s Privacy Policy at policies.google.com/privacy.

14. Changes to this policy

14.1 The Operator may update this Policy periodically to reflect changes in processing practices, new platform features, or legal obligations.

14.2 Material changes will be communicated at least 15 calendar days in advance by email and prominent notice on the platform before they take effect.

14.3 The current version of this Policy will always be available at www.architety.com/privacy, with the last update date shown in the footer.

14.4 Continued use of the platform after changes take effect constitutes acceptance of the updated Policy.

15. Data protection officer (DPO)

In accordance with Art. 41 of the LGPD, the Operator has appointed a Data Protection Officer (DPO) responsible for:

• Receiving and handling data subjects’ requests regarding their personal data.
• Interacting with the National Data Protection Authority (ANPD).
• Advising the Operator’s staff on data protection practices.
• Monitoring compliance of processing activities with the LGPD and this Policy.