Privacy Policy

1. Who we are and our role

TAI Tecnologia Ltda (Brazilian company no. 60.227.878/0001-96), headquartered at Rua Zodíaco, 869, Santa Lúcia, Belo Horizonte/MG, Brazil, operates the TAI people and process management platform with artificial intelligence.

We are the controller of data we collect for our own business: website visitors, sales contacts and customers. We are the processor of data that customer companies enter into the platform (employees, candidates, dependants): in that case the customer company is the controller and decides how the data is used, and we process it only on its instructions and under the contract.

2. Data we process

On the website and in our commercial relationship: name, email, phone, job title, company, messages sent and browsing data.

On the platform, depending on the modules contracted by the customer: registration and contact data, personal and employment documents, job and pay data, bank details, working-time records, performance reviews, résumés and uploaded files. This may include sensitive data: health data (medical certificates, occupational exams), behavioural assessment and psychosocial survey results and, only if the customer contracts and enables facial recognition for time tracking, facial biometrics.

3. How we use data

As controller: to present our services, answer enquiries, perform contracts, meet legal obligations and measure website usage. As processor: to provide the services contracted by the customer, generate the reports and analyses it requests, provide support and keep the platform secure.

We do not sell personal data and we do not use customer data for our own purposes, such as product development, advertising or training artificial intelligence models.

4. Legal bases

Performance of a contract, compliance with legal or regulatory obligations, legitimate interest (security and fraud prevention) and, where applicable, consent. When we act as processor, the legal basis for each processing activity is set by the customer, as controller.

5. Where data is stored and who we share it with

Platform data is stored in Brazil. The providers that process platform personal data (subprocessors) are:

We also share data when required by law or court order. We do not sell personal data.

6. International transfers

Platform data is stored in Brazil. Artificial intelligence processing is carried out by the providers listed above, in the United States. International transfers needed to provide the services rely on article 33 of the LGPD through the data processing agreements signed with each provider — for Google, with the standard contractual clauses approved by Brazil’s data protection authority (ANPD).

Customers are notified 30 days in advance of any new or replaced provider, or of a change in the country where it processes data. Hosting and processing entirely in Brazil, including artificial intelligence with open models on national infrastructure, is available under a specific contract.

7. Artificial intelligence

The platform’s AI features — the TALI assistant, behavioural assessments (DISC), AI analyses and document reading — stay disabled until the customer formally enables them; it may enable only some of them and revoke at any time.

AI providers are contracted under business terms that prohibit using the data to train models; they keep request logs only for a limited period (generally up to 30 days) for security and abuse prevention. Each processing request receives only the data needed for that task.

The behavioural assessment is a support tool: employees record their acknowledgement and agreement before answering, and the result must not be the sole criterion for hiring, performance, promotion or dismissal decisions. Data subjects may ask the controlling company to explain the criteria used and to review decisions based on automated processing (art. 20 LGPD); TAI provides the company with the information needed.

8. Third-party AI assistants

When the customer enables this feature, each authorised user can connect their TAI account to a third-party AI assistant such as ChatGPT (OpenAI) or Claude (Anthropic). The assistant reads and, when allowed, records data on the user’s behalf, always limited to that user’s platform permissions. Data received by the assistant is subject to that provider’s policy, under the company’s or user’s own relationship with it.

The TAI app for ChatGPT does not send national ID numbers (CPF) or other personal documents, health data, bank details or passwords. We log actions performed by these assistants (date, app and operation) for audit purposes. The connection can be removed at any time under Profile › AI agents › Connected apps, and access stops immediately.

9. Mobile app and time tracking

In the TAI app for iPhone and Android, we process only what the features you use require. When your employer requires it, the time clock takes a photo of your face at the moment you clock in or out and compares it with the face you registered, to confirm it is you; this biometric comparison is performed by a cloud provider contracted by TAI. You may decline to register your face, in which case your clock-in is recorded without the comparison. Also when your employer requires it, the app reads your location only at the moment you clock in or out, with the app open, never in the background. Each clock record also stores the app version and device model as part of the time record. The camera is used for that photo and, in tablet mode, to read the QR code on your badge. Photos and documents you send, such as a medical certificate attached to an absence or sent to Tali, are used to process your request. Messages you write to Tali, TAI’s AI assistant, are processed to generate answers, always limited to your permissions in the company. The app shows no ads and does not track you across other companies’ apps or websites.

10. Security

Measures we apply today:

• Encrypted communication (TLS 1.2 or higher) and encryption of stored data (AES-256).
• Logical separation between customers and permissions by profile and feature, which also apply to TALI and to connected assistants.
• Documents containing personal data delivered only through authenticated requests.
• Web application firewall and request rate limiting.
• Audit trails of actions performed by TALI, connected assistants and automations, and an e-signature trail (date, IP, device and hash).
• Daily database backup with integrity verification and 30-day retention.
• Annual penetration testing by an independent firm (first test being contracted).

11. Retention and end of contract

We keep data for as long as needed for its purposes and legal obligations. When we act as processor, statutory retention periods (employment, social security, occupational health) are the customer’s obligation.

When a contract ends, we deliver to the customer, without the need for a request and within 30 days, a complete copy of its data in open formats — structured data, files, signature evidence and audit trails. We then delete the data and issue a certificate of disposal; backups expire within 30 additional days. Any further retention requires the customer’s written instruction.

12. Your rights

You may request confirmation of and access to your data, correction, anonymisation, blocking or deletion, portability, information on sharing, withdrawal of consent and review of automated decisions. If your data is on the platform through your employer or another customer company, that company is the controller: we forward your request to it within 2 business days and support its response. Otherwise, we respond within 15 days.

13. Security incidents

If an incident affects a customer’s data, we notify that customer within 48 hours of becoming aware of it, describing the incident, the data affected and the measures taken, and support its notification to the ANPD and data subjects. Where we are the controller, we notify the ANPD and data subjects directly, as required by regulation.

14. Cookies and usage analytics

We use cookies needed for operation and security, and usage analytics tools (Google Analytics and Rybbit) on the website and the platform to understand how features are used. You can manage cookies in your browser settings.

15. Changes

This policy is reviewed at least once a year and whenever the way we process data changes. The current version and effective date are shown at the top of this page.