> ## Documentation Index
> Fetch the complete documentation index at: https://docs.morada.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Privacy policy

> How Morada OS handles, protects, and disposes of personal data, in compliance with Brazil's LGPD, and how to reach our data protection officer.

This policy describes how your organization's and your users' data is handled and protected in **Morada OS**, in compliance with Brazil's General Data Protection Law (**LGPD**, Law No. 13,709/2018).

*Last updated: August 16, 2026.*

***

## 1. Roles in data processing

* **Controller**: your company (the Morada OS customer), which decides what data enters the platform and for what purpose.
* **Processor**: **Morada.ai**, which processes data strictly according to the Controller's instructions, under the established technical and contractual safeguards.

***

## 2. Data processed by Morada OS

Morada OS processes only the categories of data needed to provide the service:

| Category                  | What it includes                                                                              | What it's for                                                                |
| ------------------------- | --------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------- |
| **Identity and access**   | Name, corporate email, organization, and workspace membership.                                | Corporate login, access control, and audit records.                          |
| **Conversations**         | Questions asked to the assistant and the answers generated.                                   | Delivering answers and keeping conversation history and context.             |
| **Files and attachments** | Spreadsheets, documents, presentations, PDFs, images, and audio uploaded in the chat.         | Data analysis, report generation, and creation of new files.                 |
| **Connected tool data**   | Authorized content from external services (Google Workspace, Microsoft 365, Notion, HubSpot). | On-demand queries and actions, always triggered by an explicit user request. |
| **Brain**                 | Documents, policies, tables, and manuals added to the library by the organization.            | Answers grounded in the company's knowledge, with source citations.          |

<Warning>
  Morada OS may process documents containing your company's customer and lead data. All access and uploads are recorded in audit trails tied to the user.
</Warning>

***

## 3. Privacy and data protection in artificial intelligence

<CardGroup cols={2}>
  <Card title="Your data doesn't train AI models" icon="shield-halved">
    Your organization's conversations, files, and documents are **never** used to train or improve third-party artificial intelligence models.
  </Card>

  <Card title="Providers under corporate agreements" icon="clock-rotate-left">
    AI model providers are accessed under corporate agreements that restrict data use to generating the response, prohibiting retention for other purposes.
  </Card>

  <Card title="Data separated per organization" icon="database">
    Morada OS data lives in a dedicated database, with strict separation per organization and per workspace.
  </Card>

  <Card title="Protected analysis environment" icon="cube">
    Spreadsheet and document processing runs in isolated, temporary environments, with no access to other customers' data.
  </Card>
</CardGroup>

***

## 4. Legal bases under the LGPD (art. 7)

Data processing in Morada OS relies on the following legal bases:

1. **Contract performance (art. 7, V)**: processing needed to provide the workspace, answer queries, and integrate connected tools.
2. **Legal obligation (art. 7, II)**: keeping access records as required by Brazil's Internet Civil Framework (Law No. 12,965/2014).
3. **Legitimate interest (art. 7, IX)**: security monitoring, prevention of unauthorized access, and service availability.
4. **Consent (art. 7, I)**: explicit authorizations granted by each user when connecting third-party tools.

***

## 5. Data retention and disposal

* **During the contract**: conversations, files, and the Brain library remain available to users with workspace permission.
* **When disconnecting a tool**: access credentials are deleted immediately.
* **After the contract ends**: the organization's data is kept for the period defined in the contract to allow the customer to export it, and is then permanently deleted.

***

## 6. Data subject rights and DPO contact

Data subjects can exercise the rights guaranteed by **article 18 of the LGPD** (access, correction, portability, anonymization, and consent withdrawal).

For privacy requests or to reach our Data Protection Officer:

<Info>
  **Data Protection Officer (DPO)**: Morada.ai Privacy & Security
  **Official channel**: `dpo@morada.ai`
</Info>