Skip to main content
This policy describes how your organization’s and your users’ data is handled and protected in Morada OS, in compliance with Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018). Last updated: September 25, 2026.

​
1. Roles in data processing

  • Controller: your company (the Morada OS customer), which decides what data enters the platform and for what purpose.
  • Processor: Morada.ai, which processes data strictly according to the Controller’s instructions, under the established technical and contractual safeguards.

​
2. Data processed by Morada OS

Morada OS processes only the categories of data needed to provide the service:
Morada OS may process documents containing your company’s customer and lead data. All access and uploads are recorded in audit trails tied to the user.

​
3. Privacy and data protection in artificial intelligence

Your data doesn't train AI models

Your organization’s conversations, files, and documents are never used to train or improve third-party artificial intelligence models.

External providers and what each one receives

AI model providers are accessed under corporate agreements that restrict data use to generating the response, prohibiting retention for other purposes. Web search is performed by a specialized search provider, which receives only the search terms or the address to consult, never your files, your Brain documents, or the content of your connected tools.

Data separated per organization

Morada OS data lives in a dedicated database, with strict separation per organization and per workspace.

Protected analysis environment

Spreadsheet and document processing runs in isolated, temporary environments, with no access to other customers’ data.
Data processing in Morada OS relies on the following legal bases:
  1. Contract performance (art. 7, V): processing needed to provide the workspace, answer queries, and integrate connected tools.
  2. Legal obligation (art. 7, II): keeping access records as required by Brazil’s Internet Civil Framework (Law No. 12,965/2014).
  3. Legitimate interest (art. 7, IX): security monitoring, prevention of unauthorized access, and service availability.
  4. Consent (art. 7, I): explicit authorizations granted by each user when connecting third-party tools.

​
5. Data retention and disposal

  • During the contract: conversations, files, and the Brain library remain available to users with workspace permission.
  • When disconnecting a tool: access credentials are deleted immediately.
  • After the contract ends: the organization’s data is kept for the period defined in the contract to allow the customer to export it, and is then permanently deleted.

​
How to request deletion of your data

1

Disconnect the tool in Morada OS

Under Conectores (Connectors), open the tool’s card and click Desvincular (Unlink). The authorization we stored is deleted right away, and the assistant stops reaching that service.
2

End it on the provider's side too

Unlinking in Morada OS does not by itself revoke the consent recorded with the provider — only you can do that, from your account there. On Facebook the path is Settings → Apps and websites; for the other services, the table in How to revoke access has the address for each one.
3

Request deletion of everything else

Unlinking a connector does not delete the conversations, files, and documents created in Morada OS. To request deletion of that data — including if you no longer have access to your account — write to dpo@morada.ai with your account email and what you want deleted. We confirm receipt and let you know once the deletion is done.

​
6. Data subject rights and DPO contact

Data subjects can exercise the rights guaranteed by article 18 of the LGPD (access, correction, deletion, portability, anonymization, and consent withdrawal). For privacy requests or to reach our Data Protection Officer:
Data Protection Officer (DPO): Morada.ai Privacy & Security Official channel: dpo@morada.ai