What we do with personal data, on our website and in the agents we build, and how you can exercise your rights under Brazil’s General Data Protection Law (LGPD).
Last updated: October 20, 2026
This policy explains how BossaMotion handles personal data on the https://bossamotion.ai website and in the AI agent services it provides to businesses. It follows Brazil’s General Data Protection Law (Law 13,709/2018, the “LGPD”) and the Brazilian Internet Civil Framework (Law 12,965/2014, the “Marco Civil da Internet”).
The controller of the data processed on the website and in our business relationships is [razão social], CNPJ (Brazilian company registration number) [CNPJ], headquartered at [endereço]. For any privacy matter, please contact contato@bossamotion.ai.
This English version is provided for convenience. If there is any conflict between versions, the Portuguese version prevails.
The LGPD distinguishes between whoever makes decisions about data (the controller) and whoever processes data on someone else’s behalf (the processor). In practice, it works like this:
The website has no sign-up form and does not use analytics or advertising cookies. The calculator on the home page runs only in your browser, and nothing you type into it is sent to us.
To know how many people visit the website and which pages are read most, we use Cloudflare Web Analytics. It does not use cookies, does not store your IP address and does not follow you across other websites: it counts visits and page views, where the visit came from (the previous website), country, device type and browser, and loading time. The numbers are kept only in aggregate form, without identifying anyone.
As with any website, the infrastructure records technical data for each visit, such as IP address, date and time, the page requested and browser type. These records are used to serve the pages, protect the website against attacks and comply with the Marco Civil da Internet.
If you write to us by email or WhatsApp, we receive whatever you send: name, email, phone number, company, job title and the content of the conversation.
We process the contact details of the people at the company we work with and the data needed for contracts, billing and invoicing. Data that passes through the agents (for example, customer messages, documents and records in the company’s systems) is processed as a processor, and only to the extent the agreed routine requires.
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Responding to your message and discussing a project | Steps prior to a contract, at your request (item V) |
| Providing the contracted service and communicating with the client’s team | Performance of a contract (item V) |
| Issuing invoices, billing and keeping accounting records | Compliance with a legal obligation (item II) |
| Keeping website access logs | Compliance with a legal obligation, Marco Civil da Internet (item II) |
| Measuring visits and page views, in aggregate and without cookies, to improve the website | Legitimate interest (item IX) |
| Keeping the website secure and running | Legitimate interest (item IX) |
| Sending news about our services to existing clients or people who asked for it | Legitimate interest or consent, with the option to opt out at any time (items IX and I) |
| Defending rights in judicial, administrative or arbitration proceedings | Regular exercise of rights (item VI) |
We do not sell personal data. We do not use our clients’ data, or data that passes through the agents, to train AI models or for advertising.
Only with the providers we need in order to operate, and only as much as necessary:
Some of these providers store or process data outside Brazil, for example in the United States. In those cases, the transfer follows what the LGPD allows (art. 33), with contractual clauses and data protection safeguards offered by the providers, and with the client informed whenever its data is involved.
| Data | Retention period |
|---|---|
| Business conversations that did not turn into a contract | Up to 2 years after the last contact, or sooner if you ask |
| Contract, billing and invoicing data | For the duration of the contract and the period required by tax and civil law (generally 5 years) |
| Website access logs | 6 months, as required by the Marco Civil da Internet |
| Data processed by client agents | For the period agreed with the client. When the contract ends, we return or delete it within 30 days, unless a legal obligation applies |
If a security incident occurs that could bring significant risk or harm, we notify those affected and Brazil’s National Data Protection Authority (ANPD), as the LGPD requires. When the incident involves a client’s data, we notify the client so that it can take action as the controller.
Under art. 18 of the LGPD, you may request at any time:
Write to contato@bossamotion.ai with the subject “My data (LGPD)”, telling us what you would like. We may ask for some information to confirm it’s you, so we don’t hand your data to someone else. Requests are free of charge.
We reply in simplified form immediately when possible, and with a complete answer within 15 days. If the data belongs to a company that uses one of our agents, we forward the request to that company and let you know.
If you are not satisfied with the response, you can also file a complaint with Brazil’s National Data Protection Authority at gov.br/anpd.
The data protection officer (DPO) can be reached at contato@bossamotion.ai. This is the channel for you, the ANPD or a client to contact us about privacy.
We may update this policy when the website or our services change. The date of the last update appears at the top of the page. When a change is significant, we notify clients by email.