Privacy Policy

1. Introduction

TIMELY.AI TECNOLOGIA DA INFORMACAO LTDA. ("Rovax" or the "Company"), registered under CNPJ 63.091.959/0001-08, headquartered at Pais Leme, nº 215, Conj 1713 E 1 VG, CEP 054-24150, São Paulo-SP, Brazil, is a platform that allows individuals and companies to create AI agents. These agents can sell, provide customer support, or be used personally.

To demonstrate its commitment to privacy and data protection, Rovax establishes this Privacy Policy (the "Policy").

2. Purpose

This Policy explains how Rovax processes the personal data of customers and third parties, demonstrating the Company's effort to comply with privacy and data protection regulations. It also formalizes our commitment to act with transparency and ethics in all operations.

3. Glossary

• Processing: any operation performed with personal data, such as collection, recording, classification, use, access, reproduction, transmission, storage, deletion, evaluation, modification, communication or transfer.
• Cookies: small files sent by websites and stored on your devices that keep preferences and a few other items of information.
• Data subject / User: the natural person to whom the personal data refers, such as customers, visitors and others who interact with the website.
• Personal data: any information relating to an identified or identifiable natural person.
• Anonymization: the use of reasonable technical means by which data loses the possibility of direct or indirect association with an individual.
• Controller: the person or entity that makes decisions regarding the processing of personal data.
• Processor: the person or entity that processes personal data on behalf of the controller.
• Data Protection Officer (Encarregado): the person appointed to act as the communication channel between the controller, data subjects and the Brazilian National Data Protection Authority (ANPD).
• LGPD: Brazilian Law No. 13,709 of August 14, 2018 (General Data Protection Law). Where applicable, this Policy also takes the GDPR into account.

4. Personal data provided to Rovax

All personal data provided to Rovax is processed with a high level of security and care and used only for the purposes specified in this Policy. The data provided depends on the process the data subject is going through.

Sign-up / Service contracting

Financial routines

Support / Contact

Agent email

5. Data collected by Rovax

The data above is provided directly by the data subject. Rovax may also process:

• Mobile device data from access to the platform, such as browser type and version;
• Log data;
• IP address;
• Email and instant messaging systems used to communicate between the data subject and the Company, such as website chat, email and WhatsApp;
• Cookie data (see Section 6);
• AI agent data (see Section 7);
• Agent email data (see Section 8).

In addition to the purposes above, the Company may process personal data to:

• Perform its business satisfactorily;
• Comply with legal obligations or applicable law, respond to legal proceedings or requests from competent authorities, protect the rights and safety of data subjects and the Company, or enforce our agreements and terms;
• Help analyze demand and consumption profiles, enabling more relevant institutional campaigns and continuous improvement of the customer experience.

6. Cookies

Cookies are small files sent by websites and stored on your devices. By accepting the cookie banner or using the Rovax website you allow the Company to use cookies to monitor your use of the website or online platform. We use cookies for different purposes:

a) Necessary cookies are essential for the website to work and let you navigate and access basic features.

b) Analytics cookies let us analyze visitor behavior patterns to improve the overall experience and identify areas needing maintenance. This information is anonymous and used for statistical purposes only.

c) Functionality cookies store your preferences so you do not have to reconfigure the site on each visit. If you disable them, some or all of these features may not work properly.

d) Performance cookies help Rovax understand how the website is used so we can find and fix problems quickly. If you disable them, the Company will not be informed of your visits.

e) Advertising cookies are set on our website by our advertising partners and may be used by third parties to show ads more relevant to your interests. For information about third-party cookies, see their respective privacy and cookie policies.

f) Controlling your cookie options. You are not required to accept cookies. You can block them, review permissions previously granted, or enable notifications when cookies are sent to your device. You can also change cookie settings directly in your browser, such as:

7. Generative AI

Our service may integrate generative AI technologies, such as AI agents, to provide support and personalized interactions. These tools use machine learning to simulate natural conversations and provide answers based on the information received and previously processed data.

To improve our services and provide new features, we use AI provider APIs, including, without limitation, those from OpenAI and Anthropic. We do not share Google account data of users with OpenAI.

The AI processes the information provided during the active session to respond to queries and assist with tasks such as scheduling meetings. We do not use this data for any purpose other than providing the service, subject to the retention periods described in this Policy.

When you interact with an AI agent we may collect:

• Data provided by the user: such as name, email address, phone number or other personal information you choose to share.
• Conversation content: the history of messages and interactions.
• Usage data: such as interaction time, frequency, types of queries, IP address and device used.
• General business data: product type, prices, services and other company information.

This data may be collected to provide appropriate answers and assistance, to personalize and improve the user experience, and to improve AI quality using anonymized interactions.

Users control the information they share with the agent. Where possible, data use is minimized and restricted to what is necessary. Users may review or delete their interactions in the Platform at any time.

The Company does not use the information obtained for purposes other than the customer's own account linked to Rovax. Third parties do not use or have access to your personal information for any purpose other than cloud storage and retrieval.

The use and transfer of information received from Google APIs to any other application adheres to the Google API Services User Data Policy, including the Limited Use requirements.

AI agents do not replace human support in complex or sensitive situations. In some cases the agent may hand the conversation over to a human, depending on the conversation and the agent's configuration.

8. AI agent email (@mail.rovax.io)

The account-owning user may assign each agent its own email address on the mail.rovax.io domain (the "agent inbox"). This section describes how we process personal data associated with this feature.

a) Data we process. Sender and recipient addresses, headers, subject, body and attachments of messages sent and received by the agent inbox, plus technical metadata (date and time, message identifiers, delivery outcome, bounces, complaints and suppression status). Senders and recipients may be third parties who are not Rovax customers.

b) When we send. An agent sends email only at the user's explicit request in a conversation, or in an automation the user configured. Every send goes through automated review, and higher-risk sends (for example, with attachments or a modified Reply-To) require human approval before they go out. The feature is intended for transactional, one-to-one email; bulk marketing, purchased or scraped lists, high-volume cold outreach, phishing, sender spoofing and deceptive content are prohibited by the Acceptable Use & Anti-Spam Policy.

c) Roles. For the content of messages, the user (the customer company) is the controller and Rovax acts as processor. For account data, security, abuse prevention and suppression data, Rovax acts as controller.

d) Sub-processor and international transfers. We use Amazon SES (Amazon Web Services), in the us-east-1 region (United States), to send and receive email. Email data may therefore be transferred to the United States, relying on the mechanisms provided in the LGPD and, where applicable, the GDPR. The mail.rovax.io domain uses DKIM, SPF and DMARC with a p=reject policy. Inbound messages are scanned for spam and viruses.

e) Bounces, complaints and suppression. Bounce and complaint notifications are received through Amazon SNS and trigger automatic suppression of the recipient. Suppressed recipients receive no further sends. Anyone who does not want to receive messages can reply asking for removal or write to [email protected]; the request is honored and the address is suppressed.

f) Retention. Stored email content is retained for 90 (ninety) days and then automatically deleted. Minimal suppression records are kept for as long as needed to keep honoring the request not to receive messages, and security and audit records follow applicable legal periods.

g) Isolation and security. Data is scoped per company (multi-tenant), so each company can access only the inboxes and messages of its own account.

h) Your rights. Senders and recipients of messages may exercise the rights in Section 12 (access, correction, deletion, objection, among others) by writing to [email protected]. Abuse and spam reports can be sent to the same channel.

9. Sharing personal data

Rovax may share personal data to provide and operate its services and for a legitimate, specific purpose, taking available market measures to ensure information security. We may share data with:

• Judicial, administrative or governmental authorities: upon request or court order, limited to the data necessary, or as needed to defend or exercise rights.
• Professional advisors: such as banking, accounting, audit and legal services.
• Partners, service providers and suppliers, such as payment platforms, AI providers and infrastructure and email providers (including Amazon Web Services / Amazon SES).
• Group companies, exclusively for marketing and only with the user's express consent, given by actively ticking a checkbox.

Other sharing with third parties occurs only for a legitimate, specific purpose previously informed to the data subject in our system or in this Policy.

10. Retention

Personal data is stored only for as long as strictly necessary for the purpose for which it was obtained or during the periods required by law or contract. Agent email content is retained for 90 days, as described in Section 8. Regardless of consent or deletion requests, the LGPD allows the Company to retain data to:

• Comply with legal or regulatory obligations, such as tax documents for five years;
• Transfer to a third party, respecting the data subject's rights;
• For exclusive use, with third-party access prohibited, and provided the data is anonymized.

11. Secure storage

Rovax treats the personal data provided with the security standards needed to protect it from destruction, loss, alteration or disclosure. Rovax adopts, among other precautions:

• Protection against unauthorized access to its systems and internal directories, with granular access, least privilege and segregation of duties;
• Protection against unauthorized access to the physical location where personal data is stored;
• Requiring partners, service providers and suppliers that process personal data to comply with data protection law and keep the data confidential.

12. Your rights

Under applicable regulations, you may at any time request from the Data Protection Officer:

• Confirmation that processing exists;
• Access to your personal data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in violation of the LGPD;
• Portability of your data to another service or product provider;
• Deletion or anonymization of data processed based on consent, except where the law authorizes retention on another basis;
• Information about the public and private entities with which data was shared;
• Information about the possibility of not giving consent and the consequences of refusal;
• Revocation of consent, as applicable;
• Where the GDPR applies, the right to object to processing and to lodge a complaint with a supervisory authority.

13. Contact

For questions about privacy or the processing of personal data by Rovax, write to [email protected]. For postal correspondence, use: Pais Leme, nº 215, Conj 1713 E 1 VG, CEP 054-24150, São Paulo-SP, Brazil.