Legal

Privacy policy

Last updated: October 13, 2026

This is a translation provided for convenience. If there is any conflict, the Portuguese version prevails.

This Policy explains how Hey Otlet processes personal data on the heyotlet.com website, the app.heyotlet.com application and the API, in accordance with Brazil's General Data Protection Law (Law 13,709/2018, “LGPD”) and Brazil's Internet Civil Framework (Law 12,965/2014, “Marco Civil da Internet”).

1. Who we are

Hey Otlet is provided by Wayder Tech (J W DUTRA AREBA - TECNOLOGIA), CNPJ 41.388.294/0001-58, headquartered at Avenida Presidente Kubitscheck, nº 1155, Quadra 20, Lote 01, Sala 04, Jardim Presidente, Goiânia/GO, Brazil, ZIP 74.353-250. Contact and Data Protection Officer: contato@heyotlet.com.

2. Our role in processing

As controller: we process Users' account and access data, sales and support contact data, and the technical records needed to operate and protect the Platform.
As processor: the documents, questions, answers, attachments, ratings and memories submitted by a customer company belong to it. The customer company is the controller of that data and decides what to submit; we process it only to provide the service, following its instructions. Requests from data subjects about that content should be made to the customer company, and we help it respond.

3. Data we process

3.1 Account data

Name, email, password (stored only as an irreversible hash), preferred language, company and groups the User belongs to, role and permissions, invitations received and date of last access.

3.2 Content submitted to the Platform

Documents and their metadata, attachments sent in conversations, questions, generated answers, cited sources, ratings and comments on answers, memories and company instructions. This content may include personal data, depending on what the customer company decides to submit.

3.3 Platform usage

Number of questions and conversations, AI model consumption, copied answers, ratings and usage events shown in the customer company's own Usage and Quality dashboards.

3.4 Technical and security data

IP address, browser and operating system (user agent) associated with sessions, access dates and times, and error and security logs.

3.5 Contact and support

Name, email and the content of messages you send us by email or through support channels.

We do not ask for sensitive personal data. We recommend that customer companies only upload documents containing this kind of data when they have a legal basis and a real need.

4. Purposes and legal bases

Providing the contracted service: creating and maintaining accounts, indexing documents, answering questions, showing sources, storing conversations, ratings and memories, and generating company dashboards. Legal basis: performance of a contract (LGPD art. 7, V) and, for Customer Content, the controller's instructions.
Security and abuse prevention: authenticating access, detecting misuse, limiting excessive attempts and investigating incidents. Legal basis: legitimate interest (art. 7, IX) and regular exercise of rights (art. 7, VI).
Legal obligations: keeping access records for the period required by the Marco Civil da Internet and complying with orders from authorities. Legal basis: compliance with a legal obligation (art. 7, II).
Communication: sending invitations, password resets and service notices, and answering contact and demo requests. Legal basis: performance of a contract, pre-contractual steps and legitimate interest.
Service improvement: understanding Platform usage through aggregated data to fix issues and improve features. Legal basis: legitimate interest.

5. How artificial intelligence uses the data

When a document is uploaded, its text is split into passages and each passage is converted into a numeric representation (embedding) by Amazon Bedrock. This data is kept in separate indexes for each company.
When a question is asked, the most relevant passages the User is allowed to see are sent, together with the question, to the AI provider chosen by the company to generate the answer.
We do not use customer companies' content to train AI models, ours or anyone else's. AI providers are accessed via API, under offerings that, according to those providers' terms, do not use the submitted data to train their models.
When a customer company uses API keys from its own account with an AI provider, the data sent to that provider is also governed by the agreement between the company and the provider.

We do not sell personal data or use it for advertising. We only share data with:

Amazon Web Services: Platform hosting, storage of documents and indexes, and AI models through Amazon Bedrock.
AI model providers chosen by the customer company: for example Anthropic, OpenAI, OpenRouter and Amazon Bedrock, which receive the question and the passages needed to answer it.
Email delivery provider: for invitations, password resets and service notices.
Public authorities: when required by law or court order.
Corporate transactions: in case of merger, acquisition or reorganization, with the safeguards of this Policy maintained.

These partners process data only for the contracted purposes, under confidentiality and security obligations.

7. International transfers

The Platform is hosted on Amazon Web Services in the United States, and some AI providers also process data outside Brazil. These transfers are made under LGPD art. 33, with suppliers that adopt contractual data protection clauses and recognized security standards.

8. How long we keep data

Account data: while the account is active or linked to a customer company.
Documents, conversations and memories: until the customer company deletes them or the subscription ends.
Attachments sent in conversations: automatically deleted 30 days after upload.
Login sessions: expire after up to 30 days without use.
Access records: 6 months, as required by art. 15 of the Marco Civil da Internet.
End of subscription: the customer company's content is deleted within 90 days, except what we must keep to comply with legal obligations or exercise rights. Backups are overwritten in regular cycles.

9. Security

Encrypted connections (HTTPS).
Passwords and Hey Otlet API keys stored only as hashes; AI provider keys registered by companies stored with AES-256 encryption.
Data separated by company, with dedicated indexes for each one, and access control by group and collection.
Internal access restricted to what is necessary, security logs and limits on access attempts.

No system is completely immune to incidents. If an incident may cause relevant risk or harm, we will notify the affected companies and Brazil's National Data Protection Authority (ANPD), as required by the LGPD.

10. Your rights

Under LGPD art. 18, you may request: confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent when it is the legal basis, and review of automated decisions.

For account and contact data, write to contato@heyotlet.com. For data contained in a customer company's content, contact that company, which is the controller. We may ask for information to confirm your identity and will reply within 15 days. You may also file a complaint with the ANPD.

11. Cookies and local storage

heyotlet.com website: uses no cookies and no tracking or advertising tools. Fonts and other files are served by the site itself.
app.heyotlet.com application: uses a single essential session cookie, protected from script access, that keeps you signed in for up to 30 days. The browser also stores preferences locally, such as language, theme and the selected company.

Because these features are essential for the service to work, they do not depend on consent. We do not use third-party cookies.

12. Children and adolescents

Hey Otlet is a professional service intended for people aged 18 or older. We do not knowingly collect data from children or adolescents.

13. Changes to this Policy

We may update this Policy to reflect changes in the service or the law. Relevant changes will be announced on the Platform or by email. The date of the last update is always shown at the top of this page.

14. Contact and Data Protection Officer

Data Protection Officer: Wayder Tech, at contato@heyotlet.com.