Privacy Policy
Last updated: July 2026 (Version 1.0)
1. Introduction
Aiooh respects your privacy and protects your personal data. This Privacy Policy sets out, in a simple, transparent, and objective manner, how we collect, use, store, and protect the personal data of our clients, partners, service providers, field operators, and visitors to our digital environments.
This Policy applies to the Aiooh Platform, a B2B SaaS solution for managing, selling, and automating out-of-home (OOH) media, and covers, among other topics:
- How and which personal data we process
- Purposes of Processing and Legal Bases
- Who we share personal data with
- International Data Transfers
- How we keep your data secure
- How long data will be retained
- Rights of the data subject and how to exercise them
- Cookies and similar technologies
- Changes to this Policy
- Contact
Data Subject Support Channel
If you have questions, requests, or communications related to data protection, please contact our data subject support channel: privacidade@aiooh.com.br.
Requests will be answered within up to 30 (thirty) calendar days, pursuant to Article 14 of ANPD Governing Board Resolution No. 2/2022, extendable for an equal period upon justification.
2. Data Controller Identification
AIOOH TECNOLOGIA LTDA, a Simple Innovation Company (Empresa Simples de Inovação), enrolled under CNPJ No. 63.095.881/0001-91, headquartered at Avenida Santos Dumont, No. 1.665, Bairro Santa Bárbara, CEP 88.804-342, Criciúma/SC, Brazil, is the Data Controller for the personal data processed within the Aiooh Platform, pursuant to Article 5, item VI, of the LGPD (Brazil's General Data Protection Law — Law No. 13,709/2018).
The assessment of whether Aiooh qualifies for an exemption from the formal appointment of a Data Protection Officer (DPO) before the ANPD (Brazil's National Data Protection Authority) is currently underway, pursuant to ANPD Governing Board Resolution No. 2/2022. The data subject support channel indicated above is the exclusive point of contact for all communications related to personal data protection.
3. How and Which Personal Data We Process
Aiooh collects and processes the following categories of personal data, depending on the nature of the relationship established with the data subject:
3.1 Data of Representatives of Client Companies and Partners
- Identification and contact details: full name, CPF (Brazilian individual taxpayer ID), job title, email, phone, and WhatsApp
- Company registration data: CNPJ, corporate name, and address
- Platform access data: username, email, and access profile (administrator, client, or operator)
- Content of messages exchanged through support channels (WhatsApp and email), generated over the course of the support relationship
3.2 Data of Prospects and Sales Contacts
- Name, email, WhatsApp, job title, and company name, collected via the website form or over the course of the sales cycle
3.3 Data of Salespeople, Agencies, and Distributors (Commissioned)
- Full name, CPF, banking details, and sales performance data of salespeople, agency agents, and distributors operating under commission arrangements configured on the platform
3.4 Data of Owners or Lessors of Media Locations
- Full name, CPF or CNPJ, address, and banking details of the owners or representatives of properties where OOH panels are installed
3.5 Data of Service Providers (Legal Entities)
- Name, CPF, CNPJ, banking details, address, and email of service providers contracted by Aiooh as legal entities
3.6 Data of Field Operators
- Individual login (name and email) and photographic records of panel installations and maintenance (without facial recognition)
3.7 Data From Recorded Onboarding Sessions
- Name, image, and voice of participants, collected during training sessions conducted via recorded videoconference
3.8 Automatically Collected Data
- IP address, device type and model, operating system, browser, pages accessed, date and time of access, and cookie data, collected automatically while browsing Aiooh's digital environments
4. Purposes of Processing and Legal Bases
We process your personal data only to the extent strictly necessary for the purposes described below, always supported by a legal basis provided for in Article 7 of the LGPD.
4.1 Contract Performance (Article 7, item V)
We process the data necessary to perform the contracted services, including registration and access control for the Platform, service delivery, customer support, contract and financial management, and compliance with the operational obligations arising from our relationship with clients, lessors, and service providers.
4.2 Compliance With Legal Obligations (Article 7, item II)
We process the data necessary to comply with legal and tax obligations, including issuing tax documents and meeting regulatory requirements applicable to Aiooh's activities.
4.3 Legitimate Interest (Article 7, item IX)
We process the data necessary to develop Aiooh's commercial activities, including prospecting clients, sending commercial communications, and analyzing the performance of our digital environments, provided this does not override the data subject's fundamental rights and freedoms.
Personal data may not be used for purposes other than those set out herein, except under a new legal basis or the data subject's specific consent.
5. Who We Share Personal Data With
Aiooh may share personal data with third parties exclusively for the purposes described in this Policy, in the following situations:
- With technology service providers acting as processors on Aiooh's behalf, for hosting, data processing, sending communications, digital contract signing, and issuing invoices. All such providers are contractually bound to process data only for authorized purposes and to adopt appropriate security standards
- With partner financial institutions, for financial management, billing, and payment purposes
- With client companies, through display reports containing photographic records of installations and maintenance performed
- With public authorities, when required by law, regulation, court order, or a request from a competent authority
5.1 No Commercial Use
Aiooh does not sell, license, or transfer personal data to third parties for commercial or advertising purposes.
6. International Data Transfers
Some of the technology service providers used by Aiooh may have servers located outside Brazil, which entails the international transfer of personal data.
Every international transfer performed by Aiooh will observe the provisions of Chapter V of the LGPD (Article 33 et seq.), and will only take place when the recipient country or organization offers an adequate level of data protection or under specific contractual safeguards. Data subjects will be informed of relevant international transfers through an update to this Policy.
7. How We Keep Your Data Secure
Aiooh maintains appropriate technical and organizational measures to protect personal data against unauthorized access, destruction, loss, alteration, improper disclosure, or any other form of inadequate or unlawful processing.
While Aiooh makes its best efforts to preserve data security, no transmission of information is entirely immune to the risks inherent to the digital environment. In the event of a security incident that could pose a relevant risk or damage to data subjects, Aiooh will report the incident to the ANPD and, when necessary, to the affected data subjects, pursuant to Article 48 of the LGPD.
8. How Long Data Will Be Retained
Personal data is retained for the period necessary to fulfill the purposes for which it was collected, subject to the following criteria:
- Data related to contract performance: for the duration of the contract and, after termination, for the applicable statute-of-limitations period (a minimum of 5 years, pursuant to Article 206 of the Brazilian Civil Code and tax legislation)
- Tax-related data: a minimum of 5 years, as a legal obligation
- Data of prospects who did not convert: for as long as there is a legitimate commercial interest, to be deleted upon the data subject's request or when that interest ends
- Recordings of onboarding sessions: per the contractual term agreed with the client
- Access logs: a minimum of 6 months, pursuant to Article 15 of the Brazilian Internet Civil Rights Framework (Law No. 12,965/2014)
8.1 Deletion After the Retention Period
Once the retention period ends and there is no legal basis for continued retention, the data will be securely deleted or anonymized.
9. Rights of the Data Subject
Pursuant to Article 18 of the LGPD, you may exercise the following rights at any time:
- Confirmation of the existence of processing of your personal data
- Access to the personal data processed by Aiooh
- Correction of incomplete, inaccurate, or outdated data
- Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data
- Portability of data to another service provider, upon express request
- Deletion of data processed based on consent, except in the cases set out in Article 16 of the LGPD
- Information about the entities with which Aiooh shares your data
- Withdrawal of consent, when processing is based on that legal basis
- Objection to processing carried out in non-compliance with the LGPD
- Review of decisions made solely on the basis of automated processing of data
9.1 How to Exercise Your Rights
To exercise any of the rights above, contact us at privacidade@aiooh.com.br, providing your full name and describing your request. This service is free of charge and will be provided within up to 30 (thirty) calendar days, as set out for small-scale data processing agents under ANPD Governing Board Resolution No. 2/2022.
9.2 Right to Petition the ANPD
If you believe your rights have been violated, you may file a petition with the ANPD (Brazil's National Data Protection Authority), pursuant to Article 18, paragraph 1, of the LGPD.
10. Data of Minors
The Aiooh Platform is intended exclusively for companies and their legal representatives, who must be at least 18 (eighteen) years old. Aiooh does not intentionally collect data from minors. Should the inadvertent processing of a minor's data be identified, that data will be deleted immediately.
12. Changes to This Policy
This Policy may be updated at any time due to changes in legislation, in the services provided, or in internal processes. Material changes will be communicated by email or via a notice on the platform, indicating the date of the new version. The current version will always be available on Aiooh's website and platform.
Continued use of the services after changes are published constitutes acknowledgment of the new terms.
13. Contact
For questions, requests, or communications related to the protection of personal data, please use the channels below:
AIOOH TECNOLOGIA LTDA
CNPJ: 63.095.881/0001-91
Address: Avenida Santos Dumont, No. 1.665, Bairro Santa Bárbara, CEP 88.804-342, Criciúma/SC, Brazil
Data subject support channel: privacidade@aiooh.com.br
Response time: Up to 30 (thirty) calendar days, pursuant to Article 14 of ANPD Governing Board Resolution No. 2/2022, extendable for an equal period upon justification.
Privacy Policy — AIOOH © 2026