Privacy Policy
Last updated: July 2026
Preliminary version — this document is under legal review and may be adjusted without changing the practices it describes.
1. Who we are
AutoController is a financial management platform for business groups, operated in Brazil. This policy covers the public site (autocontroller.ai) and the platform (app.autocontroller.ai).
2. Data we process
Account data (name, email, role in the organization), financial and accounting data imported by your organization — via a read-only agent installed in your environment — and technical usage records required to operate and secure the service.
3. Purposes and legal bases
We process data to perform the contract with your organization, comply with legal obligations and, with specific consent, for optional purposes such as meeting recording and product telemetry. We do not sell personal data.
4. Artificial intelligence
AI-generated analyses process your organization's data with safeguards: personal data is redacted before reaching the model, answers go through numeric validation, and every event is kept in an audit trail.
5. Subprocessors
We use infrastructure and AI providers under contract — currently AWS (hosting), Anthropic (AI models) and Deepgram (transcription). The complete, up-to-date list is available upon request to the DPO.
6. Data residency
Data is stored in the São Paulo region (sa-east-1) and backups remain in Brazil.
7. Security
Row-level isolation per organization (RLS), encryption at rest and in transit, sensitive personal data encrypted with AES-256-GCM and an append-only audit trail. Details at autocontroller.ai/seguranca.
8. Retention
We keep data for as long as needed to perform the contract and meet legal obligations; records of processing operations are retained for 5 years.
9. Your rights (LGPD)
You may request confirmation of processing, access, correction, portability, deletion and information about sharing, under article 18 of the LGPD. Requests are handled through the DPO channel.
10. Cookies and telemetry
The site loads no third-party analytics without your prior, explicit consent. No telemetry before opt-in.
11. Data Protection Officer (DPO)
The contact for the officer in charge of personal data processing is dpo@autocontroller.ai.
12. Changes
Material changes to this policy will be published on this page with a new update date.