Privacy Policy

1. Who we are and what this policy covers

Legnova (“we”, “platform” or “Service”) is SaaS software for legal requirements and IMS management (environment, OHS and quality), with modules for licenses, obligations, nonconformities, action plans, ISO and, depending on the plan, ESG and an AI assistant.

This Privacy Policy describes how we process personal data on legnova.com.br, in the app and through support and sales channels, in line with Brazil’s LGPD (Law No. 13.709/2018).

Controller: Legnova. Privacy and data-subject requests: [email protected].

2. Data we collect

We collect only what is needed to provide, protect and improve the Service. Typically:

• Account and identity: name, email, phone, password (stored hashed/encrypted), profile photo when uploaded, and role in the organization (admin, member, etc.).
• Organization and units: legal name, tax ID (CNPJ), CNAE, address, branch data and configuration preferences.
• Operational content: legal requirements, standards, checklists, evidence, documents, licenses, conditioning requirements, NCs, action plans, ESG/GHG inventories, supplier data and other records the organization enters.
• Usage and security: access logs, IP address, device/browser type, date/time, relevant platform actions and audit records.
• Communications: support tickets, sales contacts, transactional emails (confirmation, password recovery, alerts) and cookie preferences.
• Payments: data needed to bill the subscription. We do not store the full card number; we may keep subscription metadata (plan, status, last digits, expiry).

3. Purposes and legal bases (LGPD)

We process personal data to:

• Perform the contract and provide the Service (account access, legal matrix, contracted modules, billing) — basis: contract performance.
• Meet legal and regulatory obligations (tax, accounting, authority orders) — basis: legal obligation.
• Ensure security, prevent fraud and abuse, and keep the platform intact — bases: legitimate interest and, where applicable, contract performance.
• Provide support, onboarding and operational account communications — bases: contract performance / legitimate interest.
• Improve the product with aggregated usage metrics when performance cookies are consented — basis: consent.
• Send legitimate commercial communications, with opt-out where required — bases: legitimate interest or consent.
• Operate the AI assistant (when enabled on the plan), processing context needed for the answer — bases: contract performance and, where applicable, legitimate interest.

4. Artificial intelligence

Plans with an AI assistant may process only the context needed for the request — questions, excerpts of standards or operational data you or the organization provide in that flow.

We do not use customer content to train Legnova’s public models. AI use is subject to plan limits and human validation of suggestions: the platform does not replace legal advice or technical decisions by a duly licensed professional.

5. Use and protection of data

We do not sell personal data. Data is processed by Legnova to provide, protect and improve the Service and to meet legal obligations.

When there is a legal obligation or a valid public authority order, we may disclose strictly necessary information.

6. Cookies and metrics

Cookies and similar technologies are used as follows:

• Essential: authentication, session, security and basic preferences — required for the Service and always on.
• Performance / analytics: measure usage and stability in aggregate. Enabled only after consent in the cookie notice.

You can change your choice anytime via the “Cookies” link in the footer. Disabling essential cookies in the browser may prevent use of the Service.

7. Organization account and employee data

When the customer company registers users, owners, suppliers or employees, it acts as controller of that data in the employment and operational context. Legnova processes it as a processor under the customer’s instructions to provide the Service.

The customer organization must inform data subjects, obtain adequate legal bases and manage internal access (invites, roles and user removal).

8. Retention

We keep data while the account or organization is active and for as long as needed for legal obligations, dispute resolution or defense of rights.

After account closure, operational content and related personal data may be deleted or anonymized within a reasonable time, subject to backups and mandatory legal retention.

9. Security

We apply technical and organizational measures appropriate to the risk, including encryption in transit (HTTPS), role-based access controls, logical isolation between organizations, password hashes, audit logs and backups.

No system is 100% invulnerable. In a relevant incident with risk to data subjects, we will take the measures required by the LGPD, including notice when required.

10. Data location

We prefer infrastructure in Brazil. When processing occurs in another country, we adopt LGPD safeguards (contractual and/or technical) compatible with the required protection level.

11. Data subject rights

Under the LGPD, you may request:

• Confirmation of processing and access to data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary data or data processed unlawfully.
• Portability, where applicable.
• Withdrawal of consent and objection to processing based on legitimate interest, where applicable.

Send your request to [email protected]. We may ask for identity confirmation before fulfilling it.

12. Children and adolescents

The Service is intended for professional/business use. We do not knowingly collect children’s personal data. If improper registration is identified, contact us for removal.

13. Changes

This policy may be updated to reflect legal, technical or Service changes. The current version will always be on this page with the revision date. Material changes may be communicated by email or platform channels.

14. Contact and ANPD

Privacy questions, requests or exercise of rights: [email protected].

You may also lodge a complaint with Brazil’s National Data Protection Authority (ANPD) via official channels at gov.br/anpd.