Privacy Policy

LAW AGENT BRASIL LTDA (CNPJ 66.095.528/0001-08 — the "Distributor", "we") markets and makes available in Brazil the LawAgent system ("SYSTEM"), owned by AI BRAINS LABS LLC (the "System Provider"). This Policy describes how data is processed in providing the SYSTEM, in accordance with the Brazilian General Data Protection Law (Lei nº 13.709/2018 — "LGPD").

1. Roles in data processing

A. Account and Browsing Data (the Distributor is the Data Controller). Information about subscribing lawyers and law firms (name, email, billing data, access logs), processed to manage the commercial relationship and prevent fraud. Legal basis: performance of a contract (Art. 7º, V) and legitimate interest for security/anti-fraud purposes (Art. 7º, IX).

B. Input and Case-File Data (the law firm is the Data Controller). All text, files, filings, or end-client data entered into the SYSTEM. The User (law firm) is the exclusive Data Controller of this data. The Distributor acts as Data Processor and the System Provider (AI Brains Labs) acts as Sub-processor, responsible for the technical execution of processing and for support, all in accordance with the Controller's instructions and the Data Processing Agreement (DPA).

2. AI Engine: no training and no retention

No Training (Zero-Training). Under no circumstances do the Distributor, the System Provider, or their sub-processors (Google) use input data to train, retrain, or improve AI models (contractually guaranteed by Google — Gemini Enterprise Agent Platform, Service Specific Terms).

No Retention (Zero Data Retention). The SYSTEM is configured so that data submitted for AI processing is not retained by the provider after the result is generated (caching disabled and prompt logging waived). Processing is ephemeral.

3. Storage in Brazil and international transfer for processing

Storage in Brazil. All Input Data (client data, case files, and prompts) is stored in a database (Supabase) physically located in São Paulo, Brazil.

AI processing abroad. Inference is performed by the Google Gemini Enterprise Agent Platform infrastructure. Since the advanced models are not available in a provider region located in Brazil, processing takes place, ephemerally and encrypted, outside national territory — constituting an international data transfer (LGPD, Art. 5º, XV).

Legalization mechanism (Art. 33). The transfer follows the Standard Contractual Clauses approved by the ANPD (Resolução CD/ANPD nº 19/2024), executed (i) between the Distributor and the System Provider (which imports the data for processing) and (ii) between the System Provider and Google. For the transfer between the Distributor and the System Provider, Option B applies — a transfer conducted exclusively between processors. Safeguards: storage in Brazil, zero retention (ZDR), encryption in transit and at rest, and no training by the sub-processor.

4. Sub-processors

4.1 Services outside the personal-data perimeter. The SYSTEM integrates third-party services intended exclusively for querying public sources, identified by function rather than by provider, and the provider of each function may be replaced without altering this Policy:

4.1.1 These services do not receive personal data — no party names, case numbers, document contents, or information identifying the User's clients are transmitted to them — and, for that reason, they do not constitute sub-processors.

4.1.2 Should any of them begin receiving personal data, the provider will be named and included in the sub-processors table, with 30 (thirty) days' prior notice before the change goes into production.

The current, versioned list of sub-processors is available at lawagent-ai.com/subprocessadores. The addition or replacement of a sub-processor will be communicated at least 30 (thirty) days in advance, with the right to object for a legitimate and substantiated reason under the terms of the DPA.

5. Legal bases, retention, and Data Subject rights (Art. 18)

Retention and deletion of inputs. Input Data remains in the isolated database in Brazil for as long as the User keeps the history active. The User may permanently delete prompts and results at any time.

Data Subject rights. With respect to Account Data (Distributor = Data Controller), the Data Subject may request confirmation, access, correction, anonymization/blocking/deletion, portability, information about data sharing, and revocation of consent (Art. 18), in addition to filing a complaint with the ANPD.

Data under processing. Requests from the law firm's end clients regarding data entered into the SYSTEM must be directed to the User (the lawyer), who is the Data Controller; the Distributor and the System Provider will provide technical assistance, in accordance with the DPA.

5.1 Data Subject requests will be answered within 15 (fifteen) days of receipt, as provided in art. 19, §1º, II, of the LGPD. Confirmation of the existence of processing and simplified access are provided immediately, under the terms of art. 19, §1º, I and §2º.

5.1.1 Requests relating to Input Data are forwarded to the User (law firm) as the Data Controller, who has sole authority to decide, with the Distributor providing the necessary technical support.

5.2 The SYSTEM may process sensitive personal data (art. 5º, II, of the LGPD) incidentally present in documents submitted by the User. The applicable legal basis, defined by the User in its capacity as Data Controller, is typically art. 11, II, "d" — the regular exercise of rights in contracts and in judicial, administrative, or arbitration proceedings.

5.3 Upon termination of the agreement, data remains available for export for 30 (thirty) days; after that period, it is deleted from production environments within 30 (thirty) days and from backup copies according to the rotation cycle, which will not exceed 90 (ninety) days, remaining isolated and inaccessible during that interval.

6. Security and incident notification

Technical and administrative measures consistent with the state of the art: isolation via Row Level Security (RLS), encryption, private signed URLs, and privilege segregation. In the event of an incident involving material risk, notification will occur within no more than 3 (three) days to the Data Controller and, where applicable, to the ANPD and to the Data Subjects (Art. 48 and the ANPD's Standard Clauses). The System Provider, as Sub-processor, notifies the Distributor of incidents within no more than 24 (twenty-four) hours of becoming aware of them.

7. Data Protection Officer (DPO) and contacts

Data Protection Officer (DPO): Lahire Faria (Law Agent Brasil) — email: adm@lawagentapp.com. Data Controller / support in Brazil: Law Agent Brasil LTDA (CNPJ 66.095.528/0001-08) — Av. Rio Branco, 99, 7º andar, Centro, Rio de Janeiro/RJ, CEP 20040-004; suporte@lawagentapp.com; +55 21 99241-4748. System Owner (Provider): AI BRAINS LABS LLC — 971 US Highway 202N, Ste N, Branchburg, NJ 08876, USA.

Email addresses on the lawagentapp.com domain belong to Law Agent Brasil LTDA and are official institutional contact channels.

8. Changes to this Policy

Material updates will be communicated through the SYSTEM's channels, indicating the effective date.

9. Requests from foreign authorities

Should the Sub-processor receive an order from a foreign governmental authority to access data processed under this Policy, it undertakes to: (i) notify the Distributor and, through it, the User, immediately, unless legally prohibited from doing so; (ii) challenge the order through appropriate means; (iii) limit disclosure to the minimum required; (iv) keep a record. If notification is prohibited, it will notify as soon as the prohibition ceases. The Sub-processor has not granted, and will not grant, direct, general, or unrestricted access to any authority.