Lagoa

Privacy Policy

How we handle personal data on the Lagoa platform.

Effective 17 September 2026 · Last updated 17 September 2026

1. Who is responsible for your data

The Lagoa platform is operated by AGA Consultoria em Tecnologia Ltda. (trading as Lagoa Ai), company registration (CNPJ) 51.651.550/0001-01, Rua Nhu-Guaçu, 65, Nova Piraju, São Paulo – SP, 04625-000, Brazil.

For any privacy matter — including the rights described in section 10 — write to contato@lagoa.ai. We reply within 15 days.

2. Two different roles

As controller, when you create a Lagoa account and decide to use the platform. We determine what is processed and why, and this policy covers it.
As processor, when a business customer uses Lagoa to manage data about other people: their employees, job applicants, clients and suppliers. There the business decides, not Lagoa: we process only under its instructions. If you are an employee or applicant of a company that uses Lagoa, address access or deletion requests to that company first; if they reach us, we forward them and let you know.

3. What we process

Category	Examples	Why	Legal basis (Brazilian LGPD)
Account	Name, email, phone, password (stored only as a hash), the company you belong to	Create and maintain your account, authenticate you, provide support	Performance of a contract (art. 7, V)
Verified identity (KYC)	Taxpayer number (CPF), date of birth, full name	Confirm that whoever answers for an account or an AI agent is a real, identifiable person — required to issue a digital identity and for financial operations	Legal and regulatory obligation (art. 7, II) and contract (art. 7, V)
Digital identity	Decentralized identifier (DID), signed verifiable credential, salted hash of the taxpayer number	Prove the origin of actions taken by you or by agents you created	Performance of a contract (art. 7, V)
Platform usage	Messages exchanged with AI agents, files you upload, access logs, IP address, device and browser type	Deliver the service, investigate incidents, prevent fraud and abuse	Contract (art. 7, V) and legitimate interest (art. 7, IX)
Voice (when you use it)	Audio you record and its transcript	Transcribe your speech and reply by voice	Consent, given when you turn the microphone on (art. 7, I)
Payment	Amount, date, charge status, transaction identifier	Charge for plans and settle payouts	Performance of a contract (art. 7, V)
Data supplied by a business customer	Data about employees, applicants, clients and suppliers entered by a company that uses Lagoa	Provide the modules that company subscribed to (HR, sales, orders, billing)	Determined by the business customer, which is the controller of that data

We do not process credit card numbers. Card details are entered directly on our payment provider's hosted page and never reach our servers.

4. The emails we send

Lagoa sends transactional email only — always triggered by an action you or your company's administrator took inside the product. We send no marketing, no newsletters and no bulk campaigns, and we keep no mailing lists.

There are exactly three message types:

Password reset codes, sent only when you click "forgot my password".
Collaborator invitations, sent only when a company administrator adds someone to their own company.
Payment confirmations, sent to buyer and seller after a completed transaction.

Because every message follows an in-product action and is necessary to the service, there is no unsubscribe list: someone who no longer wants them asks their company administrator to remove them, or closes the account — either way the sending stops.

We take delivery feedback seriously: hard bounces and spam complaints are recorded automatically and the address is excluded from further sends. We never send to addresses supplied to us by third parties.

5. Who we share with

We do not sell personal data and do not share it for advertising. We share only with the providers below, limited to what the service needs:

Provider	Purpose	Location
Google Cloud Platform	Application hosting and database	United States (us-east4)
Google Cloud Vertex AI	Language models behind the chat and the agents	United States
Amazon Web Services	Email delivery (SES), cryptographic signing of credentials (KMS), speech to text and text to speech (Transcribe and Polly), internal queues	United States (us-east-1)
Vercel	Hosting for the website and the web console	United States, served from an edge location in Brazil
Asaas	Payment processing and payouts	Brazil
Cloudflare	DNS for our domains	Global network
Sentry	Application error reporting so we can fix failures	United States

We may also share data where the law requires it, to comply with an order from a competent authority, or to defend our rights in legal proceedings.

International transfers

Part of the infrastructure sits outside Brazil, as shown above. Those transfers rely on performance of the contract with you and on data protection clauses agreed with each provider, under art. 33 of the LGPD.

6. Artificial intelligence

We do not use customer content to train models, ours or third-party, and we contract providers on terms that forbid it.
We keep conversation history so you can resume it and for security auditing, for the period in section 7.
AI agents can be wrong. Decisions with legal or financial weight should be reviewed by a person; the platform records who authorised each agent action precisely so this can be verified.

7. How long we keep data

Account data: while the account exists; deleted or anonymised within 90 days after closure.
Conversations and files: while the account exists, or until you delete them.
Voice audio: discarded right after transcription; the transcript follows the conversation rule.
Access logs: 6 months, as required by art. 15 of the Brazilian Internet Civil Framework.
Tax and financial records: 5 years, by legal obligation.
Data processed for a business customer: for as long as it instructs; on termination we return or delete as it directs.

8. Security

Traffic encrypted in transit (TLS) and data encrypted at rest.
Passwords stored only as slow-hash digests — we cannot read them.
Taxpayer numbers stored encrypted and indexed by a salted hash, so lookups do not expose them.
Identity credentials signed by a key held in a managed hardware security module (AWS KMS); the private key never leaves it.
Internal access limited to those who need it, with audit logging.

No system is immune to incidents. If one occurs that may pose a relevant risk to you, we will notify you and the Brazilian data protection authority within the legal deadlines.

9. Cookies and browser storage

We use no tracking cookies, no advertising and no third-party analytics. We store in your own browser (localStorage) only what the session needs: the access token, the active company, the chosen theme and interface preferences. Page usage is measured with our own first-party log, without identifying you individually.

10. Your rights

Under the LGPD (art. 18) you may:

confirm whether we process your data and access it;
correct incomplete, inaccurate or outdated data;
request anonymisation, blocking or deletion of unnecessary or unlawfully processed data;
request portability to another provider;
withdraw consent, where processing relies on it;
object to processing based on legitimate interest;
be told who we share your data with;
request review of an automated decision affecting your interests.

To exercise any of these, write to contato@lagoa.ai from your registered address. We may ask for additional information to confirm your identity first — that protects you. You may also complain to the Brazilian data protection authority (ANPD).

11. Children

Lagoa is a work tool and is not directed at anyone under 18. We do not knowingly collect data from children; if we learn that we have, we delete the account.

12. Changes

If we change this policy, we publish the new version on this page with a new date. Material changes are announced by email or in the product before they take effect.

13. Contact

AGA Consultoria em Tecnologia Ltda. · CNPJ 51.651.550/0001-01
Rua Nhu-Guaçu, 65, Nova Piraju, São Paulo – SP, 04625-000, Brazil
contato@lagoa.ai