Privacy, Cookie and Personal Data Protection Policy

Guidelines on processing, security and data subject rights.

The purpose of this Privacy Policy is to set out, transparently and in strict compliance with the LGPD (Brazilian General Data Protection Law, Law No. 13,709/2018), the guidelines for the processing of personal data carried out by AIVO.

This document describes how we collect, use, store and protect the information of our Clients, users and partners, ensuring ethics and market best practices in supporting the management of customer service through artificial intelligence and automation.

By using our software, systems, tools or websites, the data subject acknowledges the terms set forth herein. If the user does not agree with the conditions established, the user must immediately stop using the AIVO solutions and refrain from entering personal data into our capture tools.

This policy applies to the website aivosuite.com and to the Aivo One platform (app.aivosuite.com and the Vendas, Teams, Forms, Social, Cursos, Indica, Pages, Agenda and Contas modules), operated by Aivo Tecnologia. The Portuguese version is available at https://aivosuite.com/privacidade. If the two versions differ, the Portuguese version prevails.

1. Technical definitions

For the purposes of interpreting this document, the following definitions apply, in accordance with Art. 5 of the LGPD:

• Controller: Natural person or legal entity responsible for decisions regarding the processing of personal data.
• Processor: Natural person or legal entity that processes personal data on behalf of the controller.
• Data Subject: Natural person to whom the personal data being processed refers.
• Personal Data: Information relating to an identified or identifiable natural person.
• Processing: Any operation carried out with personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of the information.
• Data Protection Officer (DPO): Person appointed by the controller and processor to act as a communication channel between the controller, the data subjects and the ANPD (Brazilian National Data Protection Authority).

2. Processing agents and responsibility

AIVO plays different roles depending on the nature of the legal relationship established:

• AIVO as Controller: Primarily responsible for the data of its direct clients (licensees), leads captured through its own channels, users of its social networks and visitors to its corporate website.
• AIVO as Processor: Acts under the instructions of its Clients (Contracting Companies) in processing data entered by end users in the channels integrated with the chatbot. In these cases, primary responsibility and the decision on the processing lie exclusively with the Contracting Company (Controller).

3. Data Protection Officer (DPO)

Pursuant to Art. 41 of the LGPD, AIVO has appointed a Data Protection Officer to ensure compliance and serve as the official point of contact:

• Name: Glauco Oliveira Martins
• Email: suporte@aivosuite.com
• Phone: (61) 93618-0471
• Address: ST SHA Conjunto 6, Chácara 15-1, LT4A — CEP 71.996-115
• Business Hours: Monday to Friday, 9 a.m. to 6 p.m.

The DPO undertakes to acknowledge receipt of requests within 72 (seventy-two) hours and to provide a conclusive response within 15 (fifteen) days.

4. Client categories and data collected

For the purposes of this Policy, the term Client includes: (i) Users of the licensed platform; (ii) Contracting companies; (iii) Users of the linked digital channels; and (iv) Other cases (job applicants, partners and people requesting commercial contact).

4.1. Data collection matrix

4.2. Collection of browsing data (cookies)

AIVO uses cookies to optimize the user experience:

• Strictly Necessary Cookies: Essential for the website to function (do not depend on consent).
• Session Cookies: Used to persist login and track activity on the platform.
• Third-Party Cookies: Placed by partners (e.g., Facebook Pixel, Google Analytics, YouTube) for analytics and marketing.
• UTM Cookies: Used to track conversions in acquisition channels.

5. Purposes and legal bases for processing

AIVO's processing of data is based on the following legal grounds:

• Performance of a Contract (Art. 7, V, LGPD): To enable software licensing, provision of services, technical support, and financial and operational management.
• Legitimate Interest (Art. 7, IX, LGPD): For direct marketing activities, commercial prospecting, platform improvement and browsing behavior analysis, with the right to object guaranteed.
• Compliance with a Legal Obligation (Art. 7, II, LGPD): For issuing invoices, retaining access logs (Brazilian Civil Rights Framework for the Internet — Marco Civil da Internet) and responding to authorities.
• Regular Exercise of Rights (Art. 7, VI, LGPD): For defense in judicial, administrative or arbitration proceedings.
• Fraud Prevention (Art. 11, II, 'g', LGPD): To ensure the security of the systems and of the data subjects.

6. Cookie policy

This section details how AIVO uses cookies and similar technologies in its digital environments to ensure the functionality, security and continuous improvement of our services, in accordance with the LGPD guidelines.

6.1. Concept and purpose

Cookies are small text files sent by the website to the user's browser and stored on their device (computer, smartphone or tablet). Their main purpose is to allow the system to recognize the user, store browsing preferences, facilitate access to restricted areas and provide analytical data that help optimize performance and the user experience.

6.2. Categories of cookies used

• Strictly Necessary: Indispensable for the basic operation of the AIVO website and platform. They enable features such as page navigation, security and access to logged-in areas. Because they are essential, they cannot be disabled without compromising usability.
• Performance and Statistics: Collect anonymous information about how visitors interact with the website (e.g., most visited pages, time spent and error messages). This data is used exclusively for statistical purposes and to improve performance.
• Functionality: Allow the website to remember choices made by the user (such as language, region or layout preferences), providing a more personalized and efficient experience.
• Advertising and Marketing: Used to track the user's browsing across different websites, with the aim of creating consumer profiles to display relevant and personalized advertisements, as well as measuring the effectiveness of advertising campaigns.
• UTM Cookies: Tracking parameters (Urchin Tracking Module) added to URLs to identify the source of traffic (e.g., whether the user came from an Instagram ad or an organic Google search), allowing conversions to be correctly attributed.

6.3. Retention period

• Session Cookies: These are temporary and remain on the device only while the user is browsing the website. They are automatically deleted as soon as the browser is closed or the session ends.
• Persistent Cookies: Remain on the device for a predefined period (which may range from a few days to months) or until the user deletes them manually. They are used to "remember" the user on future visits, keeping personalized settings.

6.4. Consent management and withdrawal

AIVO respects the data subject's informational self-determination. Cookies can be managed through:

• Consent Banner: When accessing our websites, a cookie management banner allows the user to accept, reject or customize their tracking preferences (except for strictly necessary cookies).
• Browser Settings: The user may, at any time, configure their browser to block cookies from being installed or to be notified when a cookie is sent. Withdrawal of consent via browser settings will result in the deletion of cookies already stored.

6.5. Third-party cookies

Some features of our websites depend on services provided by third parties, which may install their own cookies on the user's device:

• Google Analytics: Used to monitor traffic and user behavior for technical and commercial analysis purposes.
• Facebook Pixel: Used to integrate the user's actions on the website with the Facebook/Meta advertising platform, allowing the optimization of marketing campaigns.

7. Data subject rights and mechanisms for exercising them

AIVO ensures that data subjects can fully exercise the rights provided for in Art. 18 of the LGPD, free of charge and transparently.

7.1. Summary of rights

• Confirmation and Access: To know whether processing takes place and to access the data.
• Rectification: To correct incomplete, inaccurate or outdated data.
• Restriction: Anonymization, blocking or deletion of unnecessary or excessive data.
• Portability: To receive data in a structured format (CSV, JSON, XML) for transfer to another provider.
• Deletion: Deletion of data processed on the basis of consent (except where retention is required by law).
• Information and Withdrawal: To know with whom the data has been shared and to withdraw consent at any time.
• Objection: To object to processing based on legitimate interest.
• Review of Automated Decisions: To request human review of AI-generated responses that affect their interests.

7.2. Procedure for exercising rights

To exercise their rights, the data subject must follow the steps below:

1. Access: Send a request by email to suporte@aivosuite.com or through the form forms.aivosuite.com/f/aivolgpd.
2. Identification: Provide full name, registered email and CPF/CNPJ (Brazilian individual/company taxpayer ID).
3. Specification: Clearly state which right they wish to exercise.
4. Validation: Attach a photo identification document for fraud prevention.

Attention: End Clients (users of the licensed companies) must exercise their rights DIRECTLY with the Contracting Company (Controller). AIVO, as Processor, has no autonomy to decide on the deletion or alteration of third-party data without an instruction from the Controller.

8. Sharing of data with third parties

Sharing takes place strictly for the operational purposes described below, subject to contractual confidentiality and security obligations:

AIVO emphasizes that it does not sell personal data. International data transfers (e.g., cloud servers) follow the mechanisms of Art. 33 of the LGPD, using standard contractual clauses.

9. Information security and incident management

We implement technical and administrative measures capable of protecting personal data from unauthorized access and from accidental or unlawful situations:

• Encryption: Data in transit (HTTPS/TLS) and at rest.
• Access Control: Role-based (RBAC) and multi-factor authentication (MFA).
• Infrastructure: Hosting in certified data centers (ISO 27001, SOC 2).
• Auditing: Traceable operation logs and periodic vulnerability testing.
• Incident Management: In the event of an incident that entails relevant risk, AIVO will notify the User within 24 hours, detailing the nature of the data, the risks and the mitigation measures.

10. Sensitive data and data of minors

AIVO does not intentionally collect sensitive data (Art. 5, II, LGPD) or data of minors. The "gender" field, when collected, refers strictly to biological sex for administrative identification purposes. If such data is inadvertently entered, the data subject must immediately notify the DPO so that it can be duly deleted.

11. Retention and disposal

Data is kept only for the period necessary to fulfill the purposes described. Once processing ends, the data will be deleted or anonymized, except where retention is required to comply with a legal obligation or to exercise rights in court.

12. Use of data from Google APIs

Aivo uses Google APIs in two features, both optional and always initiated by the user, through Google's OAuth consent flow. Neither of them is required to use the platform: it is possible to sign in with email and password and to schedule without connecting Google Calendar.

12.1 Sign in with Google (login)

On the login screen of Aivo's systems, the user may choose "Sign in with Google" instead of creating a password. In this case, Aivo receives from Google only basic profile data (scopes openid, email and profile):

• Name and email address of the Google account: used to create and identify the user's account at Aivo, show who is signed in and send notices about the account itself (for example, team invitations and access resets).
• Profile photo, if any: displayed as the user's avatar within the platform.
• Google account identifier: used only to recognize the same user on subsequent logins.

Aivo does not access emails, contacts, Google Drive files or any other Google account data at login. This data is kept for as long as the user's account exists at Aivo and is deleted when the account is deleted, in accordance with section 11.

12.2 Google Calendar integration

The Aivo One platform offers an optional integration feature with Google Calendar. When the user chooses to connect their Google account, they grant Aivo, through Google's own OAuth consent flow, restricted access to the following data, exclusively to enable the scheduling and synchronization of appointments:

• Calendar events (scope .../auth/calendar.events): creation, reading, updating and deletion of appointments scheduled by the user or by their leads through the Aivo calendar. Events are only written, changed or removed in response to scheduling actions performed by the user within the platform.
• Calendar list and availability (scope .../auth/calendar): reading the user's list of calendars, so that they can choose which calendar Aivo should write appointments to, and querying free/busy times in order to offer leads only the available time slots.
• Google account email address (scope .../auth/userinfo.email): to identify and show the user which Google account is connected.

Data obtained from Google APIs, at login and in the calendar, is used solely and exclusively to provide these features to the user who authorized the connection. Aivo does not sell this data, does not transfer it to third parties for purposes unrelated to the feature, and does not use it for advertising or for training generalized artificial intelligence models. The user may revoke access at any time by disconnecting the integration within the platform or through the permissions page of their Google Account (myaccount.google.com/permissions).

Limited Use. Aivo's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

13. Aivo One mobile app (iOS and Android)

The Aivo One app is an extension of the platform for use by the Clients' sales teams. Access is through the account provided by the user's company; the app does not offer its own sign-up. In addition to the data already described in this Policy, the app processes the data below, always linked to the user's organization and visible only to members of that organization:

• Device contacts (optional). Import only starts when the user initiates it, under Account, and goes through a consent screen before the operating system requests the Contacts permission. First name, last name, company, phone numbers and email addresses are read, and the user reviews the list and chooses which contacts become leads in the CRM. Contacts not chosen are not sent to our servers. The app never changes or deletes contacts on the device, and the user can delete the leads from an import on the Account screen itself.
• Photos (optional). When recording an interaction with a lead, the user can attach photos taken with the camera or chosen from the gallery. The camera or photos permission is only requested when the user chooses to attach an image, and only the selected photos are sent. They are stored in that lead's files in the CRM, subject to the organization's storage quota, and can be removed through the platform.
• Sales Copilot. When the user taps Copilot on a lead's record, the data of that lead and of its history in the CRM is sent to the artificial intelligence provider contracted by Aivo (OpenAI), exclusively to generate the suggestion shown to the user. This data is not used for advertising. Use consumes the organization's credits.
• Notifications. To send notices about leads and tasks, we store the device's notification identifier, associated with the user's account. The user can turn off notifications in the device settings at any time.

The app does not use this data for tracking across third-party apps or websites or for advertising, and does not sell it. The rights described in section 7 also apply to the data processed by the app.

14. General provisions

This Policy may be updated periodically to reflect technical improvements or legislative changes. Changes will take effect immediately upon publication on the website https://aivosuite.com/privacy. Regular reading of this document is recommended.