Skip to main content
This policy describes how your organization’s and your users’ data is handled and protected in Morada OS, in compliance with Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018). Last updated: August 16, 2026.

​
1. Roles in data processing

  • Controller: your company (the Morada OS customer), which decides what data enters the platform and for what purpose.
  • Processor: Morada.ai, which processes data strictly according to the Controller’s instructions, under the established technical and contractual safeguards.

​
2. Data processed by Morada OS

Morada OS processes only the categories of data needed to provide the service:
Morada OS may process documents containing your company’s customer and lead data. All access and uploads are recorded in audit trails tied to the user.

​
3. Privacy and data protection in artificial intelligence

Your data doesn't train AI models

Your organization’s conversations, files, and documents are never used to train or improve third-party artificial intelligence models.

Providers under corporate agreements

AI model providers are accessed under corporate agreements that restrict data use to generating the response, prohibiting retention for other purposes.

Data separated per organization

Morada OS data lives in a dedicated database, with strict separation per organization and per workspace.

Protected analysis environment

Spreadsheet and document processing runs in isolated, temporary environments, with no access to other customers’ data.
Data processing in Morada OS relies on the following legal bases:
  1. Contract performance (art. 7, V): processing needed to provide the workspace, answer queries, and integrate connected tools.
  2. Legal obligation (art. 7, II): keeping access records as required by Brazil’s Internet Civil Framework (Law No. 12,965/2014).
  3. Legitimate interest (art. 7, IX): security monitoring, prevention of unauthorized access, and service availability.
  4. Consent (art. 7, I): explicit authorizations granted by each user when connecting third-party tools.

​
5. Data retention and disposal

  • During the contract: conversations, files, and the Brain library remain available to users with workspace permission.
  • When disconnecting a tool: access credentials are deleted immediately.
  • After the contract ends: the organization’s data is kept for the period defined in the contract to allow the customer to export it, and is then permanently deleted.

​
6. Data subject rights and DPO contact

Data subjects can exercise the rights guaranteed by article 18 of the LGPD (access, correction, portability, anonymization, and consent withdrawal). For privacy requests or to reach our Data Protection Officer:
Data Protection Officer (DPO): Morada.ai Privacy & Security Official channel: dpo@morada.ai