Hakutaku Privacy Policy

The Portuguese version prevails.

1. Who we are and how to reach us

Hakutaku Soluções em Gestão de Dados Ltda., CNPJ 57.982.157/0001-87, registered at Rua Engenheiro Bianor, 137, Apto 301, Butantã, São Paulo/SP, CEP 05502-010 ("Hakutaku", "we").

• Data Protection Officer (Encarregado): haku@hakutaku.ai
• Legal matters: haku@hakutaku.ai
• General contact and support: haku@hakutaku.ai / haku@hakutaku.ai

This Policy follows Brazil's General Data Protection Law (Law 13,709/2018, "LGPD"), the Brazilian Civil Rights Framework for the Internet (Law 12,965/2014) and the Consumer Protection Code (Law 8,078/1990).

2. Our role: controller or processor

• Individual use (you sign up for yourself): Hakutaku is the controller of your data.
• Use through an organization (your company subscribes and invites you): the organization is the controller of the work content it places on the platform, and Hakutaku acts as processor, following the organization's instructions and the data processing agreement (DPA) signed with it. Requests about that content may be forwarded to the organization; we help it respond.
• In every case, Hakutaku is the controller of your account, billing, security and platform-usage data.

3. What data we process, why, and on what legal basis

Sensitive data. We do not ask for sensitive data. But e-mail, meetings and documents you connect may incidentally contain health, religious or political data, or data about others. We process it only to provide the service you asked for, with the same protections, and you control what you connect.

Third parties' data. Your content may mention other people (colleagues, clients, meeting participants). You confirm you have a legal basis to bring that content into Hakutaku, as set out in the Terms of Use.

4. What we do not do

• We do not sell, rent or trade personal data.
• We do not use your content for third-party advertising.
• We do not take outward actions on your behalf (send mail, post, delete) without your request or approval, except automations you set up yourself.
• We do not give other organizations access to your content.

5. Artificial intelligence and model training

We do not use member content to train AI models, and we require our providers not to either.

Automated decisions: the assistant organizes and summarizes your knowledge and suggests actions, but does not make decisions with legal effects on you. You may request review of any conclusion about you (LGPD art. 20) and correct or delete items in your inferred profile.

6. Who we share with (processors and sub-processors)

We share data only with those who help us provide the service, under contract, and only what is needed:

We may also share data: (a) with the organization that subscribed to Hakutaku, according to the permissions it configures; (b) under court order or legal obligation; (c) in a corporate transaction (merger, acquisition), keeping the safeguards of this Policy.

The current sub-processor list is at /privacidade. We give advance notice of material changes.

7. International transfer

Most providers are in the United States, which has no ANPD adequacy decision. We make these transfers under LGPD art. 33 using the ANPD standard contractual clauses (Resolution CD/ANPD 19/2024) and, for providers in the European Union, under the mutual adequacy decision (Resolution CD/ANPD 32/2026). You may request a copy of the clauses at haku@hakutaku.ai; we answer within 15 days.

8. How long we keep data

9. Your rights

You may, at any time and free of charge (LGPD art. 18):

1. confirm whether we process your data and access it;
2. correct incomplete, inaccurate or outdated data;
3. request anonymization, blocking or deletion of unnecessary or excessive data;
4. receive your data in a structured format (portability);
5. request deletion of data processed with your consent and close your account;
6. know with whom we share your data;
7. know that you may refuse consent and what happens if you do;
8. withdraw consent;
9. object to processing based on legitimate interest;
10. request review of automated decisions (art. 20);
11. complain to the National Data Protection Agency (ANPD).

How: in your account settings (when available) or by e-mail to haku@hakutaku.ai. We verify your identity and answer within 15 days. If you use Hakutaku through an organization, some requests about work content will be handled with the organization, which is the controller.

10. Security

We use technical and administrative measures proportionate to the risk: logical isolation between organizations, role- and permission-based access control, per-fact access control in the knowledge graph, encryption in transit (HTTPS), encryption of connected-app credentials (AES-256-GCM), restricted and logged internal access, and logging of administrative changes. No system is fully secure; if an incident may cause relevant risk or harm, we will notify you and the ANPD within the deadlines of Resolution CD/ANPD 15/2024.

11. Hakutaku staff access

Only authorized Hakutaku staff access data, and only when needed for support you requested, security, abuse prevention, fixing faults or legal compliance. Access to private conversations requires a specific release and is logged.

12. Cookies and similar technologies

We use cookies and similar technologies that the platform needs in order to work:

• Essential: sign-in, language and security.
• Usage and error analytics (PostHog and Vercel Analytics): pages visited, clicks and usage events, errors and performance, browser and device data and your account identifier. We use this only to keep the service running, protect it and find and fix faults. It is always on because without it we cannot debug the platform; the legal basis is legitimate interest. We do not sell it or use it for advertising.

If you want to object to any of this processing, contact our Data Protection Officer at haku@hakutaku.ai.

13. Children and adolescents

Hakutaku is intended for people aged 18 and over and is not directed at children or adolescents. If we learn that we collected a minor's data without a proper basis, we will delete it.

14. Changes to this Policy

We may update this Policy. Material changes will be announced prominently, by e-mail or in the platform, before they take effect. Where a change depends on consent, we will ask again. Previous versions are available on request.

15. Governing law

This Policy is governed by Brazilian law.