The privacy of your data is central to the Kallavy product. This Policy transparently describes what we process and why — including the point we are asked about most: we do not use the content of your prompts to train AI models.
1. Who we are and our role
Kallavy Intelligence Brasil Ltda., registered under CNPJ No. 46.887.359/0001-23, headquartered in Manaus/AM, Brazil ("Kallavy", "we"), is responsible for processing the personal data described in this Policy.
Our role under the LGPD varies by data type:
- Controller of the registration, account, billing and usage data of the Platform — we define the purposes and means of that processing.
- Processor (operadora) for the content you enter into interactions (prompts, files and responses), which we process on behalf of and for the Client (controller), in accordance with your instructions and the Terms of Use. For large-scale processing, a Data Processing Agreement (DPA) may be signed.
2. Data we collect
2.1. Data you provide to us
- Registration and account: name, email, phone, CPF or CNPJ, company name, address and contact details.
- Billing: data needed for charging via PIX and for issuing the tax invoice (NFS-e).
- Support: information you share when contacting our team.
2.2. Interaction content
- Inputs and outputs: the prompts, attached files (e.g., PDF, DOCX, images) and the responses generated by the AI models.
2.3. Automatically collected data
- Usage and telemetry: models used, volume of tokens consumed, date/time of requests, access logs.
- Technical: IP address, device and browser type, session identifiers.
3. Purposes and legal bases
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and manage your account and authenticate access | Performance of a contract (Art. 7, V) |
| Process requests and route them to AI Providers | Performance of a contract (Art. 7, V) |
| Billing, credit control and invoice issuance | Legal/regulatory obligation and performance of a contract (Art. 7, II and V) |
| Support, communication and improvement of the Services | Performance of a contract and legitimate interest (Art. 7, V and IX) |
| Fraud and abuse prevention and Platform security | Legitimate interest (Art. 7, IX) |
| Compliance with legal obligations and exercise of rights | Legal obligation and regular exercise of rights (Art. 7, II and VI) |
| Sending marketing communications (where applicable) | Consent (Art. 7, I), revocable at any time |
4. Content, prompts and AI training
We do not train models with your content. Kallavy does not use your prompts, files or responses to train, develop or improve artificial intelligence models, whether our own or third parties'. Your content is processed only to deliver the requested response and operate the Services.
- Encryption: the content of your conversations is stored in encrypted form. We adopt measures to restrict access to the content to the minimum necessary for operation and for the support you request.
- Processing by Providers: to generate the response, the Input is transmitted to the chosen AI Provider. Wherever available, we seek to use modalities in which the Provider does not train on data sent via API. Each Provider's practices are governed by its own policies (see Section 5).
- Deletion: you can delete your conversations and files through the Platform, subject to the legal retention periods (Section 8).
5. Data sharing
We do not sell your personal data. We share data only as necessary, with the following categories of third parties:
- AI Providers: receive your Input to process the request and return the response (e.g., OpenAI, Anthropic, Google, Mistral, DeepSeek, among others). Each Provider processes data according to its own policies, listed in the Terms of Use.
- Payment processors (for PIX settlement) and tax-invoicing partners (for the NFS-e).
- Infrastructure, authentication and email providers that support the operation of the Platform, under confidentiality and security obligations.
- Public authorities, when required by law, court order or for the regular exercise of rights.
6. International data transfer
Some AI Providers and infrastructure suppliers are based outside Brazil (for example, in the United States and the European Union). By using models from these Providers, you acknowledge that your Inputs and related data may be transferred and processed abroad. Such transfers observe the safeguards set out in the LGPD, and Kallavy adopts contractual and technical measures to protect the transferred data. If you wish to keep processing within Brazil, contact us about the options for a tier with data in national territory.
7. Cookies and similar technologies
- Essential: necessary for authentication and session security (without them, login does not work).
- Preferences and analytics: when used, they help remember settings and understand Platform usage to improve it.
You can manage cookies in your browser settings; disabling essential ones may impair the operation of the Platform.
8. Data retention
- Registration and account data: kept while the account is active and for the period necessary for the purposes of this Policy.
- Tax and financial data: retained for the periods required by law (as a rule, up to 5 years, as applicable).
- Interaction content: kept while necessary to provide the service; it can be deleted by you at any time, subject to legal obligations.
- Access logs: retained for the applicable legal period (Brazilian Internet Civil Framework) and for security purposes.
Once the relationship ends and legal periods are met, data is securely deleted or anonymized.
9. Information security
- Transmission protected by TLS/HTTPS and conversation content stored in encrypted form.
- Access controls, environment segregation and least-privilege principle.
- Monitoring, audit logs and measures to prevent unauthorized access.
In the event of a security incident that may pose a relevant risk to data subjects, we will notify those affected and the ANPD within the timeframes and in the manner required by law.
10. Your rights (LGPD)
At any time and free of charge, you may exercise the rights set out in Art. 18 of the LGPD:
- confirmation that processing exists and access to the data;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
- portability of data to another provider, upon request;
- deletion of data processed on the basis of consent;
- information about sharing with third parties;
- withdrawal of consent and information about the consequences of refusal;
- review of decisions made solely on the basis of automated processing.
To exercise your rights, write to privacidade@kallavy.com. We may request information to confirm your identity before fulfilling the request.
11. Data Protection Officer and contact
Kallavy's Data Protection Officer (Encarregado) can be contacted at privacidade@kallavy.com, the channel through which we receive requests, questions and complaints about privacy and data protection. You also have the right to petition the Brazilian National Data Protection Authority (ANPD).
12. Children and adolescents
The Platform is intended for professional and business use and is not directed at persons under 18 years of age. We do not knowingly collect data from minors. If we identify such collection without a proper legal basis, we will take steps to delete the data.
13. Changes to this Policy
We may update this Policy from time to time. The current version will always be on this page, with the update date. Relevant changes will be communicated by electronic means. Continued use of the Platform after they take effect implies agreement with the revised Policy.