Privacy policy

This is a translation for convenience. The Portuguese text at /privacidade/ governs.

1. Who is responsible

Agavus, responsible for the agavus.io site, the console account, the pilot's early-access list, the lawyer network list and the client notice, is the controller of the data described here. The channel for any privacy matter, including the requests in section 6, is privacidade@agavus.io.

As a small processing agent (CD/ANPD Resolution No. 2/2022), Agavus keeps this channel for data subjects and the ANPD instead of formally appointing a data protection officer. We write and reply in Portuguese.

2. Which data we collect, what for and for how long

We collect the minimum needed to talk to you about the pilot and understand your work. Nothing beyond what is in this table.

E-mail address, OAB number and state section
When
When you join the list (step 1)
What for
To tell you when there is a version to try, to invite you to a conversation and to the pilot, and to confirm that the signup belongs to a lawyer.
Legal basis
Consent (art. 7, I)
How long
Until the pilot recruitment ends or 24 months after signup, whichever comes first. Earlier, on request.
Practice area chosen on the page
When
When you join the list
What for
To give the invitation context and to prioritise the pilot.
Legal basis
Consent (art. 7, I)
How long
The same as the signup
Optional answers: active cases, current system, free text and interest in a conversation
When
Step 2, only if you answer
What for
To understand the preparation work and prioritise what to build first.
Legal basis
Consent (art. 7, I)
How long
The same as the signup
The version of this policy (and, in the console, of the terms of use) you accepted and the date and time you accepted it
When
When you join any of the lists: the pilot, the lawyer network or the client notice, and when you create the console account
What for
To prove consent, as the LGPD requires of the controller (art. 8, § 2).
Legal basis
Regular exercise of rights in judicial, administrative or arbitral proceedings (art. 7, VI)
How long
The same as the signup
Lawyer network: e-mail address, OAB number and state section, and practice areas
When
When you join the lawyer network list
What for
To tell you when a partner firm opens its network of collaborators. The list is private: it never becomes a directory, is never shown to clients or sold, and Agavus distributes no cases.
Legal basis
Consent (art. 7, I)
How long
Until the network recruitment ends or 24 months after signup, whichever comes first. Earlier, on request.
Client notice list: e-mail address, state and the areas you need help with
When
When you ask for the notice on the page for people looking for a lawyer
What for
To tell you, once, when a partner firm opens its doors in your state. We receive no account of the case and no documents, and Agavus gives no legal service.
Legal basis
Consent (art. 7, I)
How long
Until the notice is sent or 12 months after the request, whichever comes first. Earlier, on request.
IP address
When
On each form submission, vote or visit count
What for
To limit submissions per minute per address, against automated submissions: 10 forms or votes and 60 visit counts.
Legal basis
Legitimate interest in the security of the service (art. 7, IX)
How long
It is never written to a database or a log. It stays only in the server's memory during the counting window and is then discarded.
Feature vote and practice area
When
When you send the vote (§07)
What for
To prioritise the pilot.
Legal basis
No personal data: the vote is anonymous and is linked to no signup
How long
Indefinite, because it identifies no one.
Aggregate visit count, clicks on the main button and forms started
When
When you open the site's pages, with JavaScript on
What for
To know how many lawyers and how many people looking for a lawyer arrive, take an interest and sign up, so we can decide what to build.
Legal basis
No personal data: only one number per day, per page and per area is added up. Nothing is written to your device and the count is not linked to you
How long
Indefinite, because it identifies no one.
Browsing data measured by Google Analytics: pages viewed, where the visit came from, device and browser type, approximate location (city) and the identifiers in the _ga cookies
When
Only if you accept measurement in the notice shown on your first visit
What for
To know how the site is found and used, so we can improve it. Advertising signals stay off: nothing is used for ads or for a browsing profile.
Legal basis
Consent (art. 7, I), given in the notice and revocable at any time in “Cookie preferences”, in the footer
How long
Events stay in Google Analytics for 2 months and are then deleted. The cookies expire within 2 years, and declining or withdrawing measurement deletes them from your device.
Your answer to the measurement notice (accept or decline)
When
When you answer the notice
What for
To respect your choice without asking again on every page.
Legal basis
No personal data: the answer stays only in your browser's local storage and never reaches us
How long
Until you change your answer or clear your browser's data.
Your language choice (Portuguese or English)
When
Only when you pick a language through the link in the menu or the footer
What for
To open the site in that language on later visits.
Legal basis
No personal data: the choice stays only in your browser's local storage and never reaches us
How long
Until you switch language or clear your browser's data.
Name and work e-mail address of a lawyer referred by an interviewee
When
When someone who talked to us refers you
What for
A single invitation to a conversation, saying who referred you.
Legal basis
Legitimate interest in inviting a professional to a piece of research (art. 7, IX)
How long
Deleted within 14 days if you do not reply or you decline. If you accept, they follow the row below.
Summary of the conversation, identified by a code, and the key that links the code to your name
When
If you accept a conversation about your preparation work
What for
To understand how lawyers prepare cases and decide what to build. Quotations only appear without identification. No case data is written down.
Legal basis
Consent (art. 7, I), given when you confirm the conversation
How long
Until the pilot recruitment ends or 24 months after the conversation, whichever comes first. Earlier, on request.
Recording of the conversation
When
Only if you authorise it at the start of the conversation
What for
To write the summary without losing what was said.
Legal basis
Consent (art. 7, I), asked for at the start of the conversation
How long
Deleted as soon as the summary is ready, within 7 days.
Console account: name, e-mail address, password (hash only), the professional profile you declare (OAB number and state section, practice areas and work mode) and, for each session, the IP address and the browser
When
When you create the account, when you fill in the profile in the console and each time you sign in
What for
To give access to the console during the pilot, to keep the profile you declare, without checking the OAB number, and to protect the account against unauthorised access.
Legal basis
Performance of a contract at the holder's request (art. 7, V); each session's IP address and browser, legitimate interest in the security of the account (art. 7, IX)
How long
For as long as the account exists. A session expires within 7 days without use; signing out deletes it, and deactivating the account deletes them all but keeps the account record. The record is deleted on request, through the channel in section 6, except the consent record.

The case files and text a lawyer sends to the console do not follow this policy: Agavus processes them as processor, on behalf of the lawyer or the firm, which is the controller, under the pilot instrument. Section 4 lists the processors involved in that processing.

3. What we do not collect

Do not send documents, case numbers, names of parties or any client data through the site's forms or during a conversation: if something like that is said, it is not written down. We collect no sensitive data, build no browsing profile for advertising, make no automated decisions about you and sell no data to anyone.

The area ticked in the notice request can reveal a sensitive situation. That is why we ask only for the minimum, access is restricted to those who run Agavus and it is shared with no one; a partner firm only talks to you if you contact the firm after the notice.

The site uses no cookies of its own. The aggregate count in section 2 is one number per day, with no identifier, that does not link the visit to you. The only third-party measurement is Google Analytics, and it only starts if you accept in the notice shown on your first visit: before that, Google's script is not even loaded. If you accept, Google Analytics writes the _ga cookies to your device; if you decline, nothing is written except the answer itself, so we do not ask again. You can change your mind at any time in “Cookie preferences”, in the footer of every page, and declining deletes this site's _ga cookies. If you pick a language through the link in the menu or the footer, the choice is kept only in your browser's local storage. The language set in your browser is read in your browser and never sent to us. The typefaces are served from our own domain. Cloudflare, which hosts the site, may set strictly necessary security cookies to contain automated traffic; they do not identify you to us.

4. Who we share with

The data stays with Agavus. The processors below process data on our behalf, under contract, and only for the service described for each. Authorities receive data only when the law requires it.

Cloudflare, Inc.
Hosts the site, the console and the API, keeps the lists (D1 database) and sends the account e-mails. Carries the connection between the console and the processing server, which case content passes through, and keeps that server's backups (R2), encrypted with keys Cloudflare does not hold.
May store and process the data outside Brazil, under the processor's contractual data protection safeguards (art. 33 of the LGPD).
Hostinger International Ltd.
Provides the processing server, where case files, the text extracted from them and the database are kept and processed, and the mail server that receives e-mail sent to @agavus.io addresses.
The processing server, with the case files and data, is in Brazil (Campinas, São Paulo). The mail server is in the United States (Boston), under the processor's data processing terms (art. 33 of the LGPD).
ChiselStrike Inc. (Turso)
Hosts the console accounts database: accounts, sessions, organisations and each case's registry record (name and authorisation), never the case files.
Stores the data in Brazil (São Paulo). Turso is a United States company and acts under the processor's data processing terms (art. 33 of the LGPD).
OpenRouter, Inc.
Forwards excerpts of case text, and image crops of PDF pages, to a language model, only when the lawyer authorises that provider on the case. Never audio or video.
The model runs on providers contracted by OpenRouter, outside Brazil, under the processor's data processing terms (art. 33 of the LGPD).
Google LLC (Google Analytics)
Measures use of the site, only for those who accepted measurement. Advertising signals stay off.
May store and process the data outside Brazil, under the Google Analytics data processing terms (art. 33 of the LGPD).
Google LLC (Google Workspace)
Hosts the video conversations (Google Meet) and keeps the summaries, the recordings and the code key (Google Drive), with access restricted to those who run the conversations.
May store and process the data outside Brazil, under the Google Workspace data processing terms (art. 33 of the LGPD).

The console account's e-mails, such as the address confirmation, go out through Cloudflare. The lists have received no e-mail yet: their sending provider will be named in this policy before the first send.

5. How long we keep it

The signup is kept for as long as the pilot recruitment lasts. When it ends, or 24 months after signup, whichever comes first, we delete or anonymise the data of anyone who has not joined the pilot. A deletion request is met before then, and the feature vote has no time limit because it identifies no one.

For the conversations, the authorised recording is deleted within 7 days, as soon as the summary is ready. The summary and the key that links the code to your name follow the signup's period, counted from the conversation. The contact details of someone referred who did not reply are deleted within 14 days.

The lawyer network list is kept until the network recruitment ends or 24 months after signup, whichever comes first. The client notice request is deleted when the notice is sent or 12 months after the request, whichever comes first. The aggregate visit count has no time limit because it identifies no one. Google Analytics events, for those who accepted measurement, are kept for 2 months.

6. Your rights

The LGPD (art. 18) gives you the rights below. To exercise any of them, write to privacidade@agavus.io from the e-mail address you signed up with, or the one we talked to you on, which is how we confirm that the request is yours.

01
Confirmation and accessKnowing whether we process your data and receiving a copy of what we hold.
02
CorrectionCorrecting incomplete, inaccurate or out-of-date data.
03
Anonymisation, blocking or deletionOf data that is unnecessary, excessive or processed outside what this policy says.
04
PortabilityReceiving your data in a structured, machine-readable format (JSON).
05
DeletionDeleting the data processed on the basis of your consent, except the record that the request was met.
06
Information about sharingKnowing whom we share with. Today, the processors listed in section 4.
07
Information about not consentingKnowing what happens if you do not consent: you simply do not join the list.
08
Withdrawal of consentAt any time, free of charge. It ends the contacts and leads to deleting the signup.
09
Objection and petition to the ANPDObjecting to processing and, if you disagree with our answer, petitioning the National Data Protection Authority (ANPD).

Deadlines: a simplified confirmation within 15 days and a full answer within 30 days, the deadlines CD/ANPD Resolution No. 2/2022 sets for small processing agents (arts. 14 and 15). Withdrawing consent does not undo contacts already made, but it ends the next ones.

7. How we protect it

All traffic uses HTTPS, and the site tells your browser to use only HTTPS on later visits (HSTS). The code that authorises step 2 of the form is kept only as a SHA-256 hash, so a database leak does not allow it to be reused. Each IP address can send up to 10 forms per minute. Access to the database is restricted to those who run Agavus. In the event of a security incident with relevant risk, we will notify the ANPD and the people affected under CD/ANPD Resolution No. 15/2024.

8. Children and adolescents

The early-access list and the network are meant for lawyers registered with the OAB, and the client notice for people over 18 who are looking for a lawyer. We do not knowingly collect data from anyone under 18; if such a signup comes to our attention, it is deleted.

9. Changes and versions

Relevant changes are published on this page with a new version and date. If a change of purpose reaches people already on the list, we tell them by e-mail first, and you can withdraw consent if you disagree (art. 9, § 2).

2026-10-19The console accounts database, at Turso, moves from the United States (Oregon) to Brazil (São Paulo). Turso remains a United States company.
2026-10-09Hostinger's processing server, with the case files and data, moves from the United States (Boston) to Brazil (Campinas, São Paulo). The mail server stays in the United States.
2026-10-06The policy now covers the console account (the account and session data and its contractual basis), says that case files and text sent to the console are processed by Agavus as processor for the lawyer or firm, under the pilot instrument, and names Hostinger (processing and mail server), Turso (accounts database) and OpenRouter (language models) as processors, besides Cloudflare's wider role.
2026-10-01The site now remembers the language you pick through the language link, in your browser only, and reads your browser's language setting in the browser to open the site in Portuguese or English.
2026-09-30The site starts using Google Analytics, only after you accept in the measurement notice and with advertising signals off; Google joins as the measurement processor, and “Cookie preferences”, in the footer, lets you change your choice.
2026-09-29The policy now covers the conversations with lawyers (the coded summary, the authorised recording, the invitation to someone referred and Google as processor), the lawyer network list, the client notice for people looking for a lawyer and the aggregate visit count by audience.
2026-09-28Consent now names the practice area and the OAB check; the legal basis for the consent record becomes art. 7, VI; the IP address no longer appears in any server log.
2026-09-27First publication.

10. Legislation

Law No. 13.709/2018 — Brazil's General Data Protection Law (Lei Geral de Proteção de Dados Pessoais, LGPD).
ANPD — the National Data Protection Authority, including CD/ANPD Resolutions No. 2/2022 (small processing agents), No. 15/2024 (incidents), No. 18/2024 (data protection officer) and No. 19/2024 (international transfer).
Law No. 12.965/2014 — Brazil's Civil Rights Framework for the Internet.

1. Who is responsible

2. Which data we collect, what for and for how long

E-mail address, OAB number and state section

Practice area chosen on the page

Optional answers: active cases, current system, free text and interest in a conversation

The version of this policy (and, in the console, of the terms of use) you accepted and the date and time you accepted it

Lawyer network: e-mail address, OAB number and state section, and practice areas

Client notice list: e-mail address, state and the areas you need help with

IP address

Feature vote and practice area

Aggregate visit count, clicks on the main button and forms started

Browsing data measured by Google Analytics: pages viewed, where the visit came from, device and browser type, approximate location (city) and the identifiers in the _ga cookies

Your answer to the measurement notice (accept or decline)

Your language choice (Portuguese or English)

Name and work e-mail address of a lawyer referred by an interviewee

Summary of the conversation, identified by a code, and the key that links the code to your name

Recording of the conversation

Console account: name, e-mail address, password (hash only), the professional profile you declare (OAB number and state section, practice areas and work mode) and, for each session, the IP address and the browser

3. What we do not collect

4. Who we share with

Cloudflare, Inc.

Hostinger International Ltd.

ChiselStrike Inc. (Turso)

OpenRouter, Inc.

Google LLC (Google Analytics)