Privacy Policy — AI Process Automation (Evercene)
Last updated: November 4, 2026
This document is also available in Portuguese. For customers in Brazil, the Portuguese version prevails in case of conflict.
This Policy explains how we process personal data on the website https://evercene.com.br/en/automation and in the AI Process Automation Service, in accordance with Brazil's General Data Protection Law (Law No. 13,709/2018 — "LGPD") and, where applicable, the EU/UK General Data Protection Regulation ("GDPR").
1. Controller
Evercene Tecnologia LTDA, CNPJ 69.646.489/0001-70, Av. Paulista, 91, Bela Vista, São Paulo/SP, CEP 01.311-000, Brazil. Email: privacidade@evercene.com.br.
Data Protection Officer (Encarregado) and contact channel: Evercene Tecnologia LTDA is a small-scale processing agent (agente de tratamento de pequeno porte) and, under art. 11 of ANPD Resolution CD/ANPD No. 2/2022, is exempt from appointing a Data Protection Officer (encarregado). In compliance with art. 11, §1 of that Resolution, the communication channel for data subjects and for Brazil's National Data Protection Authority (ANPD) is privacidade@evercene.com.br.
Where a Customer submits third-party personal data to the Service (e.g., data about its own customers), the Customer is the controller of that data and we act as processor, following the Customer's instructions. Data subjects in that situation should first direct requests to the Customer.
2. Data we collect
- Registration and account: name, email, company, password (stored hashed), phone (optional).
- Payment data: processed by Paddle (see section 5). We receive from Paddle only information such as subscription status, plan, country, amount and card brand/last digits; we do not receive or store full card numbers.
- Customer Content: instructions, files, text, data and integrations you connect so agents can perform tasks, plus the outputs generated.
- Usage and technical data: IP address, browser, device, pages visited, execution logs, timestamps, error events.
- Communications: messages you send to our support.
- Cookies and similar technologies: see section 10.
3. Purposes and legal bases
| Purpose | Legal basis (LGPD art. 7 / GDPR art. 6) |
|---|---|
| Creating and maintaining your account; providing the Service and running agents | Performance of contract (art. 7(V) / art. 6(1)(b)) |
| Processing subscriptions and payments (via Paddle) | Performance of contract; legal obligation |
| Customer support | Performance of contract; legitimate interests |
| Security, fraud and abuse prevention, access logs (Brazilian Internet Civil Framework, art. 15) | Legal obligation; legitimate interests |
| Improving the Service using aggregated/usage data | Legitimate interests |
| Tax, regulatory compliance and orders from authorities | Legal obligation; establishment, exercise or defense of legal claims |
4. AI processing and third-party providers
To run agents, Customer Content may be sent to large-language-model (LLM) and AI providers: Anthropic, OpenAI and SpaceXAI. These providers act as sub-processors, processing data only to generate the requested responses. No Customer data is used by any AI provider to train or retrain AI models, and we do not use Customer Content for that purpose either.
The Service does not make automated decisions producing legal effects on you without the possibility of review; agents perform tasks configured by the Customer. You may request review of automated decisions (LGPD art. 20; GDPR art. 22).
The Service is hosted on the Company's own (contracted) VPS server, and data is stored in a database hosted on the Company's own infrastructure. We do not use analytics tools or third-party email-sending providers. An up-to-date list of sub-processors is available on request at privacidade@evercene.com.br.
5. Paddle (payments)
Payments are processed by Paddle.com, our online reseller and Merchant of Record. When you purchase, you provide payment and billing data directly to Paddle, which processes it as an independent controller for payment, tax, fraud-prevention and legal-compliance purposes under Paddle's Privacy Policy (paddle.com/legal/privacy). Paddle shares with us the data needed to manage your subscription.
6. Sharing
We share data only: (a) with the sub-processors listed above, under contract; (b) with Paddle for payments; (c) with integrations you choose to connect; (d) with authorities where required by law or court order; (e) in a corporate transaction (merger, acquisition), with prior notice. We do not sell personal data.
7. International transfers
Some providers (AI, Paddle and, depending on server location, hosting) may process data outside Brazil, for example in the United States, United Kingdom and European Union. In such cases we rely on the safeguards provided in the LGPD (arts. 33–36) and ANPD Resolution CD/ANPD No. 19/2024, such as standard contractual clauses, and, for data of EEA/UK residents, the European Commission's Standard Contractual Clauses or an equivalent mechanism.
8. Retention
- Account data and Customer Content: while the account is active and for up to 30 days after closure (for export), then deleted or anonymized.
- Application access logs: at least 6 months (Brazilian Internet Civil Framework, art. 15).
- Tax/financial records: for the applicable statutory period (generally 5 years).
- Backups: deleted on a rolling cycle of up to 30 days.
9. Your rights
Under the LGPD (art. 18) and, where applicable, the GDPR (arts. 15–22), you may: confirm whether we process your data; access it; correct incomplete or inaccurate data; request anonymization, blocking or deletion of unnecessary or unlawfully processed data; data portability; information about sharing; withdraw consent; object to processing based on legitimate interests; request review of automated decisions; and lodge a complaint with Brazil's ANPD (gov.br/anpd) or your local data-protection authority.
To exercise your rights, email privacidade@evercene.com.br. We will respond within 15 days (or the applicable legal deadline) and may ask you to verify your identity.
10. Cookies
We use only strictly necessary cookies: session and authentication cookies (to keep you securely signed in) and Paddle checkout cookies, used to process payment and prevent fraud. We do not use analytics, advertising or tracking cookies. Because they are strictly necessary, these cookies do not require consent; you can block them in your browser, but sign-in and checkout may stop working.
11. Security
We apply reasonable technical and organizational measures, such as encryption in transit (HTTPS/TLS), access controls, credential encryption and monitoring. No system is 100% secure; in the event of a relevant security incident we will notify the ANPD and affected data subjects as required by law.
12. Children
The Service is not intended for anyone under 18, and we do not knowingly collect data from children or adolescents.
13. Changes
We may update this Policy. Material changes will be communicated by email or website notice, with the update date shown at the top.
14. Contact
Evercene Tecnologia LTDA — CNPJ 69.646.489/0001-70 — Data protection: privacidade@evercene.com.br — Av. Paulista, 91, Bela Vista, São Paulo/SP, CEP 01.311-000, Brazil