- Who is the controller
- Data we collect
- Production AI agents
- Analytics & cookies
- Legal bases
- Purposes
- Sharing
- International transfer
- Retention and deletion
- Data subject rights
- Security
- Changes
- Contact & DPO
§1 Who is the controller
Controller: Data Riders Consultoria e Educação LTDA , CNPJ 29.742.713/0001-02, headquartered in Belo Horizonte/MG, Brasil. For privacy-related inquiries or to exercise data subject rights, write to privacidade@datariders.com.br or hi@datariders.com.br .
§2 Data we collect
We collect only what is necessary for the purposes described in this policy.
- Contact and newsletter forms : name, email, company, message, or subject. Completion is voluntary.
- Event registration / Academy : name, email, job title, organization, and, where applicable, professional details provided by the participant.
- Production AI agents : prompts and questions entered within an agent, in addition to any email or name you choose to provide. See §3.
- Documents uploaded to agents (GISTM.ai, AquaTwin, ISO 14001 etc.) : content is handled according to the lifecycle table in the Trust Center (retention ≤ 30 days by default).
- Resumes submitted (Careers) : name, contact details, professional background. Retained for up to 24 months.
- Website browsing: pages viewed, referral source, country, device type, and browser, without cookies and without identifying you (see §4).
§3 AI agents and Data Riders OS
The website, client area, Double Diamond, Modo Reunião, and Data Riders OS run on the Data Riders cloud platform, operated by a contracted provider. When you use an AI-enabled feature, the submitted text, audio, or document is processed by an AI model called by the platform. The providers used by each feature are listed in the sub-processors list.
Files uploaded to the vault, meetings, client area, and CRM are stored in private application storage. They can only be accessed by authorized users via temporary links.
Each formal deliverable provided to clients has a designated human lead who reviews and signs off before delivery.
§4 Cookie-free analytics
The website measures visits without analytics cookies, device identifiers, or third-party scripts. The IP address is used solely to identify the country and then discarded. URL parameters are only retained when they indicate campaign source (for example, utm_source).
The only cookie used is a session cookie, necessary to keep you logged in to the client area, Double Diamond, or the internal system. For this reason, the site does not display a cookie banner.
YouTube videos only load when you click to watch, via the youtube-nocookie.com domain.
§5 Legal bases (LGPD/GDPR)
- Performance of contract (LGPD Art. 7, V; GDPR Art. 6(1)(b)), for the provision of contracted services (audits, production agents).
- Legitimate interest (LGPD Art. 7, IX; GDPR Art. 6(1)(f)), for sending newsletters to professional contacts, security, and fraud prevention.
- Consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)), for non-essential cookies and marketing communications.
- Compliance with legal/regulatory obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)), tax invoicing, accounting retention, and compliance with authorities.
§6 Purposes of use
- Provision of contracted services and customer support.
- Operation of the website and agents (authentication, chat responses, report generation).
- Information security, fraud prevention, and incident response.
- Sending professional newsletters (with an unsubscribe link in every email).
- Aggregated metrics and anonymized analytics to improve the website and agents.
- Compliance with legal, accounting, and regulatory obligations.
§7 Third-party sharing
We do not sell personal data. We share data only with the sub-processors required to operate the service, listed in the sub-processors section of the Trust Center, and when required by law.
§8 International transfer
The platform and certain AI providers operate outside Brasil. International transfers comply with Art. 33 of the LGPD, based on contractual safeguards from sub-processors. The exact location of each provider is available upon request, along with the DPA.
§9 Retention and deletion
- Client documents in agents: ≤ 30 days (see full table ).
- Prompts and transcripts from AI agents: ≤ 90 days.
- Newsletter: until voluntary unsubscribe; backups for an additional 35 days.
- Resumes: up to 24 months.
- Application logs: 12 months (configurable by contract).
- Contractual and tax records: statutory retention periods (up to 5 years).
§10 Data subject rights (LGPD art. 18 / GDPR art. 15‑22)
You may, at any time and free of charge:
- Confirm the existence of processing of your data;
- Access, correct, anonymize, or delete unnecessary data or data processed in violation of the law;
- Request portability to another provider;
- Revoke consent and object to processing based on legitimate interest;
- Request information about data sharing and sub-processors;
- Lodge a complaint with the ANPD (Brasil) or local data protection authority in the EU.
Requests: privacidade@datariders.com.br; we respond within 15 business days.
§11 Security
Active security controls are published in the Trust Center, with status and review date. We publish only controls that we can verify.
§12 Changes
This policy may be updated periodically. Material changes will be communicated via a banner on the website and by email to data subjects with an active registration. Current version: 2026‑04‑27 (G40) .
§13 Contact & DPO
Data Protection Officer (DPO): Fernando Damasio · privacidade@datariders.com.br · hi@datariders.com.br .