Privacy Policy

1. Definitions used throughout this Privacy Policy

Whenever the terms below are used in this Policy, they shall have the following meaning:

• Anonymization or Anonymized Data: means the use of reasonable technical means available at the time of the Processing by which a piece of data loses the possibility of being associated, directly or indirectly, with an individual.
• Controller: means the party responsible for the Processing of Personal Data, to whom the decisions regarding the Processing belong.
• Personal Data: means any information relating to an identified or identifiable natural person.
• Data Protection Officer (DPO): the person appointed by Nexforce to act as the communication channel between Nexforce, the Data Subjects and the Brazilian National Data Protection Authority (“ANPD”).
• Applicable Data Protection Legislation: means the Brazilian General Data Protection Law (Law No. 13.709/2018, “LGPD”) and its subsequent amendments, as well as any other applicable laws and regulations relating to the Processing of Personal Data and privacy and, where applicable, all guidance and codes of practice issued by the Brazilian National Data Protection Authority (“ANPD”) or any other relevant supervisory or data protection authority.
• Processor: means any natural person or legal entity, governed by public or private law, that carries out the Processing of Personal Data on behalf of the Controller.
• Data Subject: the natural person to whom the personal data undergoing Processing relate.
• Processing: means any operation carried out with Personal Data, such as those relating to the collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of the information, modification, communication, transfer, dissemination or extraction.
• User: means anyone who visits our Platform or uses the Solutions made available through it.

Any other terms not defined in this section but capitalized in this Privacy Policy shall be interpreted in accordance with the Applicable Data Protection Legislation.

2. Identification of the Controller, the Processor and the Data Protection Officer

Nexforce acts, as a rule, as Controller of the Personal Data processed in the context of the Platform and the Solutions made available to Users.

However, depending on the Solution contracted and the nature of the services provided, Nexforce may act either as Controller or as Processor of the Personal Data, under the Applicable Data Protection Legislation. When acting as Processor, Nexforce will carry out the Processing of Personal Data in accordance with the lawful instructions of the respective Controller.

For the purposes of the Applicable Data Protection Legislation, Nexforce has designated the following contact channel for matters relating to the Processing of Personal Data:

Data Protection Officer: Fernando Vitti Fonseca. E-mail: lgpd@nexforce.ai

The Data Protection Officer acts as the communication channel between Nexforce, the Data Subjects and the ANPD, and may be contacted for the exercise of the rights provided for in the Applicable Data Protection Legislation, for clarification of questions or for the submission of requests relating to the Processing of Personal Data.

3. Collection of Personal Data

We collect and process the following Personal Data provided by Users at the time of registration or during use of the Platform: first and last name, mailing address, e-mail address, payment information, location data and telephone number.

We may also collect technical and browsing data, information relating to use of the Platform and communications exchanged with Nexforce, as described in this Privacy Policy.

The Platform is not intended for children under 12 (twelve) years of age, and Nexforce does not knowingly collect or process Personal Data of children. Should Nexforce become aware that Personal Data of children have been inadvertently collected, Nexforce will take the appropriate measures to cease the processing and delete such data, subject to the applicable legal obligations.

Nexforce may process Personal Data of adolescents between 12 (twelve) and 17 (seventeen) years of age where necessary for the provision of the Services, always in observance of their best interests and in compliance with the LGPD (Law No. 13.709/2018) and Law No. 15.211/2025 (Brazilian Digital Statute of Children and Adolescents).

4. Purposes and applicable legal bases

Your Personal Data will be processed for the following purposes and under the respective legal bases provided for in the LGPD:

Performance of a contract and preliminary procedures relating to the contract

We process the Personal Data necessary for the creation and administration of accounts, provision of the contracted Services, handling of User requests, payment processing, issuance of invoices, technical support, customer relationship management and communications relating to use of the Platform and the Services.

Data received from partners or third parties may also be processed where necessary to enable access to the Services, facilitate registrations or perform features requested by the User.

Legitimate interest

Subject to the legitimate expectations of the Data Subjects and their fundamental rights and freedoms, Nexforce may process Personal Data to:

• monitor use of the Platform and the Services;
• ensure the security of the environments, systems and Users;
• prevent, detect and combat fraud, abuse and unlawful activities;
• record, store and analyze communications carried out by e-mail, electronic forms, WhatsApp and other customer service channels;
• moderate and monitor content entered by Users for the protection of Nexforce, third parties and the User community itself;
• perform performance analyses, internal audits, quality control and process improvement;
• develop, improve, personalize and optimize products, features and Services;
• collect technical and browsing data, including IP address, access logs, device identifiers, operating system, browser, settings and information on use of the Platform;
• use information provided by Users, including comments, suggestions, ratings and feedback, to improve products and Services;
• carry out corporate transactions, business reorganizations, mergers, acquisitions, investments or due diligence processes, in which case the data may be shared with advisors, potential investors or third parties involved in the transaction, subject to appropriate confidentiality measures.

Compliance with legal or regulatory obligations

We may process and share Personal Data to comply with legal, regulatory, tax, fiscal or accounting obligations, or obligations imposed by competent authorities, including courts, government bodies, regulatory agencies and enforcement authorities.

Regular exercise of rights

Nexforce may process Personal Data where necessary to exercise its rights in judicial, administrative or arbitral proceedings, or in procedures relating to the defense of its legitimate interests.

Consent

In certain cases, Nexforce will also carry out the Processing of Personal Data on the basis of the consent of the Data Subject, which may be withdrawn at any time. This legal basis will be used only for:

• collection and use of certain categories of cookies that are not strictly necessary;
• import and synchronization of contacts stored on the device of the User;
• other activities for which the Applicable Data Protection Legislation requires prior, free, informed and unambiguous consent.

Finally, Nexforce may use Anonymized Data, in a manner that does not allow the direct or indirect identification of the Data Subjects, to prepare statistics, aggregated analyses, projections, research, development of new products, improvement of features and market studies.

Once anonymized under the Applicable Data Protection Legislation, such data are no longer considered Personal Data for the purposes of the LGPD.

5. Sharing of Personal Data

We share your Personal Data with our partners and suppliers solely for the purposes of enabling payments and the Processing of data, providing technical support to the User, and delivering our Services and making them more relevant and efficient for their purposes.

The Service providers and suppliers We engage perform several important functions to ensure the operation of our Services. Some of these main functions include: (i) using platforms and software tools from other companies to run, operate and maintain our Services; (ii) moderating content generated by Users and identifying possible failures in our Services; (iii) running e-mail campaigns and sending messages to mobile devices, such as notifications about events and updates; (iv) analyzing the performance of our Services and marketing strategies; and (v) offering measurement services and displaying personalized advertisements based on the interests of Users.

For the purposes of data analysis and relevant statistics on the use and reach of the Platform, as well as for the creation of newsletter e-mails, We share your Personal Data with certain partners, in particular: Google Analytics, Google Drive and Google Cloud Platform (GCP).

In addition, We may be legally required to share your Personal Data with third parties to comply with legal, regulatory or tax requirements. This may involve disclosure at the request of government agencies, such as the ANPD itself.

We seek to engage only partners that adopt all the standards necessary and appropriate under the Applicable Data Protection Legislation, so that the Personal Data may not be used for other purposes and will be kept in accordance with appropriate security standards.

If Nexforce is involved in a merger, acquisition or sale of all or part of its assets, the Personal Data of the User may be shared with the acquirer. In such cases, You will be duly notified of any change and transfer of your Personal Data.

6. Retention period and storage of Personal Data

We will keep your Personal Data only for the period necessary to fulfill the purposes for which We collected them, for the period We deem necessary to protect the rights and legitimate interests of Nexforce, or until the Data Subject validly exercises their deletion rights, subject to the retention cases authorized by the Applicable Data Protection Legislation.

If the User requests the deletion of their Personal Data, We will cease the Processing for purposes incompatible with retention. However, We may continue to store such data for as long as there are legal, regulatory, tax or judicial obligations to be fulfilled, or where keeping the data is necessary for the regular exercise of rights by Nexforce.

The Personal Data collected are stored in the systems and devices used by Nexforce, as well as on Google Drive and Google Cloud Platform (GCP), which are cloud storage services.

7. International Transfer

In certain circumstances, Personal Data may be transferred to other countries. In such cases, Nexforce will adopt the measures required by the Applicable Data Protection Legislation to ensure an adequate level of protection for the Personal Data, including the execution of appropriate contractual instruments where applicable.

8. Information Security

All traffic between our servers, or between your computer and our servers, is encrypted using the Hypertext Transfer Protocol Secure (HTTPS) protocol, through the Secure Sockets Layer (SSL) and/or Transport Layer Security (TLS) protocols or equivalent technology.

We take technical, administrative and organizational measures consistent with good market practices and capable of protecting the Personal Data against unauthorized access and accidental or unlawful situations of destruction, loss, alteration, communication or dissemination.

The human factor is often the weakest link in information security, so our employees are trained in cybersecurity concepts to minimize the risk of incidents involving Personal Data, and We recommend the same type of training for all our customers and partners.

Although We adopt reasonable measures to protect the Personal Data under our responsibility, it is impossible to guarantee the total security of stored data or to prevent misuse on the part of the User, such as insecure software and hardware, which may compromise the security of the systems.

If You identify a security failure or believe there is any indication of vulnerability relating to your Personal Data, please contact our Data Protection Officer directly by e-mail at: lgpd@nexforce.ai.

8.1. Cookies

Nexforce uses cookies strictly necessary for the operation of the Platform, as well as, subject to consent where required by applicable law, analytics, performance and additional functionality cookies.

The User may manage their cookie preferences through the settings made available on the Platform or in their browser, subject to the applicable technical limitations.

8.2. Processing of content submitted to AI

Personal Data that may be contained in content, documents, prompts, files, commands or other information submitted by Users to the Solutions will be processed exclusively to enable the performance of the contracted Services, in accordance with the instructions of the Users and the limits set out in this Privacy Policy, except where a legal or regulatory obligation authorizes or requires different processing.

Nexforce does not use Personal Data submitted by Users to the Solutions to train its own artificial intelligence models, except with the express authorization of the respective Data Subject or where permitted by the Applicable Data Protection Legislation.

9. Rights of the Data Subject

As the Data Subject of the Personal Data, You have the rights listed below and may exercise them by written request to our Data Protection Officer at the e-mail: lgpd@nexforce.ai.

• Confirmation of the existence of Processing of your Personal Data;
• Access to your Personal Data;
• Correction of incomplete, inaccurate or outdated Personal Data;
• Anonymization, blocking or deletion of Personal Data that are unnecessary, excessive or processed in non-compliance with the provisions of the LGPD;
• Portability of the Personal Data to another service or product provider;
• Deletion of Personal Data processed on the basis of the consent of the Data Subject;
• Information on the public and private entities with which We have shared your Personal Data;
• Information on the possibility of not providing consent and on the consequences of refusal;
• Withdrawal of consent;
• Objection to the Processing;
• Request for review of decisions made solely on the basis of automated Processing of Personal Data, where applicable; and
• Petition to the ANPD.

Due to our security policy and to prevent fraud, social engineering or similar techniques for improperly obtaining Personal Data and other restricted information, the requested data will only be provided upon verification of the identity of the Data Subject by secure means.

After verifying your identity by secure means, We will respond to your request within the time limits provided for in the Applicable Data Protection Legislation.

You may exercise your rights as Data Subject or resolve any questions about this Privacy Policy by contacting our Data Protection Officer at the e-mail: lgpd@nexforce.ai.

10. Updates to this Privacy Policy

Nexforce is constantly evolving and improving, so this Privacy Policy may be amended as our Services evolve or as a result of changes in the Applicable Data Protection Legislation.

The most current version of this Privacy Policy will always be available on our Platform and, whenever applicable, We will inform our Users of any relevant modifications and amendments.