Privacy and Data Protection Policy — Ideia Arsenal and Órbita Ideia

Version 2026-09-28-1 · In force since 28/09/2026

This Policy explains, honestly and concretely, what personal data we process when you use the Ideia Arsenal and the members' area Órbita Ideia, why we process it, who we share it with, how long we keep it and how you can exercise your rights. It reflects what our system actually does. It applies alongside the Terms of Use.

In a few words

• Who processes it: Ideia Business (Ideia Business Soluções Tecnológicas LTDA, CNPJ 30.082.914/0001-00) is the controller. Data protection officer: Victor Lopes Paiva, dpo@ideiabusiness.com.br.
• What we store about you: name, email and phone number (from your purchase), your plan status, a record of your Órbita logins, your learning path progress and, if you enable it, a public profile. We do not store card details.
• Installer: the IP, root password (or SSH key), bot token and AI Provider authorization code you provide are used only for the installation you requested and are not stored in a database, on permanent storage or in logs.
• Your customers and your Iara: the data passing through your installed Iara stays in your environment. We do not receive it. There, you are the controller.
• Órbita onboarding interview: if you take the interview with Iara, we store your responses as text and the resulting dossier about your business, to personalize your Iara. We don't record audio. When your access ends, you have 90 days for reading and export; we notify you by email at least 15 days before deletion. You can request a copy or deletion at any time (section 5-A).
• With whom we share: only with the parties needed to operate the service (Kiwify, Vercel, Neon, Resend, Telegram, the installer's VPS provider and, only if live voice for the interview is enabled, the contracted voice provider). Some have servers outside Brazil; we explain the legal basis.
• Cookies: only those strictly necessary (session). We don't use tracking cookies or analytics.
• Your rights: access, correction, deletion, portability, information about sharing, withdrawal of consent and other rights under art. 18 of the LGPD. Send requests to the data protection officer's email address; we respond within 15 days.
• Minors: the product is for people aged 18 or over.

Contents

1. Who we are and who our data protection officer is
2. Who this Policy applies to and what it does not cover
3. What data we process and where it comes from
4. Why we use it and on what legal basis
5. The Iara installer: your VPS and AI Provider credentials

5-A. The Órbita onboarding interview: your responses and dossier

6. Who we share it with (processors and third parties)
7. International data transfer
8. How long we store it
9. How we protect the data
10. Your rights and how to exercise them
11. Cookies and storage in the browser
12. People under 18
13. Automated decisions
14. Security incidents
15. Amendments to this Policy
16. Contact

1. Who we are and who our data protection officer is

Controller: Ideia Business Soluções Tecnológicas LTDA ("Ideia Business"), CNPJ 30.082.914/0001-00, with its registered office at Rua Siqueira Campos, 940, 1º andar, Centro Histórico, Porto Alegre/RS, CEP 90010-000. Product: Ideia Arsenal and Órbita Ideia, at arsenal.ideiabusiness.com.br. Creator: Gustavo Lopes Paiva.

Data protection officer (art. 41 of the LGPD): Victor Lopes Paiva — dpo@ideiabusiness.com.br. This is the contact for questions, data subject requests and communication with ANPD.

2. Who this Policy applies to and what it does not cover

2.1. Applies to: people who buy a plan or community membership; Órbita Members; anyone requesting an access link, using the installer, completing the Órbita onboarding interview, taking part in Tempestade Solar or contacting us through our support channels.

2.2. Does not cover the data that you process using your Iara and agents in your own environment (VPS, accounts, CRM, WhatsApp, AI Provider). In that case, you are the controller and we are neither controllers nor processors: we do not receive, access or store that data. You are responsible for compliance with the LGPD in that environment, as explained in the Terms of Use (chapter 14). The onboarding interview with Iara is different: it takes place inside Órbita, outside your environment, and we process its data (section 5-A).

2.3. Also excluded processing by third-party platforms you use independently or contract with directly: Kiwify (which controls payment data at checkout), Telegram, OpenAI, Anthropic, your hosting provider and your browser (including its speech recognition service and online voices). Each has its own policy.

2.4. Until 27/09/2026, Arsenal also sold "Poder" (a standalone feature available as a separate purchase), with no recorded buyers. Its discontinuation was decided on 27/09/2026; disabling the Kiwify checkouts and removing the offer map (arsenal_offer_map) are actions for the owner to carry out and require confirmation — the latest API check (28/09/2026, 15h) still found the 3 Poder checkouts active. This is why this Policy no longer treats Poder as a current category of data or access rights, but sales only end in practice when the checkouts are disabled.

3. What data we process and where it comes from

What we don't collect: card or bank account details (held by Kiwify); Member passwords (there are none); sensitive data (art. 5º, II, of the LGPD), which the interview does not request either; geolocation; browsing data for advertising; your voice audio; or the content of conversations your installed Iara has with you or your customers. The only Iara conversation we store is the Órbita onboarding interview, in text only (section 5-A).

4. Why we use it and on what legal basis

When the legal basis is legitimate interest, we process only what is necessary, in line with your reasonable expectations and without overriding your rights; you can object through the channel in section 10.

5. The Iara installer: your VPS and AI Provider credentials

This section describes what our code does. We are committed to maintaining these practices and updating this Policy if they change.

5.1. What you provide. VPS IP address; the root user password or a private SSH key (one of the two); optionally, the VPS public host key; the Telegram bot token; your numeric Telegram ID; the AI Provider (ChatGPT/OpenAI or Claude/Anthropic). In the Claude flow, also the authorization code Anthropic shows after you authorize it in your account.

5.2. Sole purpose. We use this data only to perform the installation you requested on your VPS at that time. We use it for no other purpose, do not access your VPS outside installation, and retain no means of returning to it.

5.3. No retention.

• The credentials stay only in memory installation service while the installation is running.
• The password is written to a temporary file with restricted permissions (0600, in a 0700 directory) solely to authenticate SSH, and the file is deleted when the SSH session ends. The same rule applies to the SSH key.
• As soon as SSH authentication succeeds, the password and key are discarded from memory. The bot token is discarded after being written to the configuration file on your VPS. The Provider's authorization code is forwarded to your VPS once and then discarded.
• None of this is written to a database, permanent storage, an API response or a log. Before service logs are written, a filter replaces any secret with "[redigido]".
• Installation state exists only in memory: if the service restarts, the installation in progress is lost and none of it remains. The service supports at most 8 simultaneous installations.
• We do not receive or store API keys or access tokens for the AI Provider. Authentication takes place between your VPS and the Provider, in your account; the resulting credentials stay on your VPS.

5.4. Register on the installer's initial screen. The screen asks for your name, email and phone number. These details currently stay only in the installation service's memory: they are not stored in a database or read by the team, and disappear when the service restarts. Your browser keeps only a local flag indicating that registration was completed (section 11). If we start using this registration for another purpose (such as installation support), we will update this Policy first.

5.5. Where it runs and who can access it. The installation service runs on an Ideia Business server, hosted by a third-party cloud provider (Hetzner Online GmbH, in datacenter in Ashburn, Virginia, United States; this means there is an international transfer, section 7), with HTTPS, a firewall, a dedicated unprivileged system user, directory isolation and listening only on the local network. It can only be accessed after you sign in to Órbita, using a secret shared between Órbita and the service. Transparency: this server is shared with other Ideia Business services, and its administrator (root) inherently has the technical ability to access any process's memory. We mitigate this with the measures above and immediate disposal of credentials; migration to a dedicated server is planned. For this reason, and as good practice, we recommend changing your VPS root password immediately after installation and switch to key-based access.

5.6. VPS identity. If you do not provide a host key, your VPS identity is accepted on first contact ("trust on first use"). Providing the host key reduces the risk of the installer connecting to an impostor server.

5.7. What stays on your VPS. The open-source agent that runs Iara, the service that keeps it running, the configuration file containing the bot token and your Telegram ID (so only you can talk to your Iara) and, in the Claude flow, the Provider's command-line tool. All of this is under your control, and we retain no access.

5-A. The Órbita onboarding interview: your responses and dossier

This section describes what our system does in the interview. We are committed to maintaining these practices and updating this Policy if they change.

5-A.1. What it is. The interview is your first conversation with Iara inside Órbita, by voice or text: about twelve questions about you, your business, what Iara can do on her own and your priorities for the next 90 days. It is the method's "Descreva" step, and only starts when you choose to begin. You can skip any question, pause, switch between voice and text at any time, and stop to return later. Before the first question, Iara explains that she is an AI and what is stored.

5-A.2. What we store and why. Each answer is saved as text in your account as soon as you respond, so you can stop and pick up where you left off. We also store Iara's interpretation (what she understood), whether the answer came by voice or text, and whether the question was skipped. The sole purpose is to understand your business, personalize your Iara and build the dossier. We do not use the answers for advertising, sell them, show them to other Members or use them to train AI models. Completing the interview adds points to your learning path (section 13.2).

5-A.3. The dossier. At the end, you see all your answers in a summary you can correct. The dossier is saved only when you confirm that summary, and only its contents are retained in the dossier. It organizes the answers in the format your Iara uses (who you are, your business, what she may and may not do without asking, your 90-day priorities and outstanding issues) and stays in Órbita for you to copy and paste into your installed Iara. We do not send the dossier to your VPS or an AI Provider: you transfer it yourself. If you redo the interview, the previous one stays in your account history until you request deletion.

5-A.4. Audio and voice mode by browser. We do not record audio, either in the database or in files. Your voice is converted to text before reaching us, and we receive only the text. In browser voice mode, which is the default, we do not send your audio to any third party and we do not receive it: your own browser's speech recognition converts your speech to text. However, the browser may send audio to the manufacturer's transcription service (Google in Chrome), under its own rules and without a contract with us. Similarly, Iara speaks using a browser or system voice, and some of these voices work online: in that case, the manufacturer receives the text Iara speaks, including her interpretation of your answers. If you do not want this, use the text interview (which does not activate the microphone) or turn off Iara's voice.

5-A.5. The contracted voice provider. There is a second mode, for continuous conversation, that uses a voice provider we contract. It is currently disabled. It will only be enabled by our express decision. Before that, we will publish a new version of this Policy naming the contracted provider and the country where it processes data. When it is enabled and you choose to speak:

• your audio, the transcript, text you type during the conversation, Iara's speech and your first name pass through the provider for the duration of the conversation so it can conduct the interview in real time;
• we continue to store the answers as text only, through our own API, under the same rules in this section;
• the provider acts as processor: processes this data only to provide the service, under a data processing agreement that prohibits the provider from using it for any other purpose, including training models;
• the provider has servers outside Brazil, so there are international transfer (section 7). We will only enable this mode with the safeguards of art. 33 of the LGPD, particularly the standard contractual clauses approved by ANPD (Resolução CD/ANPD nº 19/2024) in the agreement with the provider;
• it is your choice: the screen shows which mode is active, and text mode provides the same interview without sending your voice to anyone.

5-A.6. What to avoid in the answers. Do not paste a key, password or token. The screen asks you not to, and the system rejects and does not save answers that look like keys or contain phrases such as "a senha é...", but the filter does not catch everything. Also avoid your customers' data and sensitive data (health, religion, political opinions and the other categories in art. 5º, II, of the LGPD): the interview asks for system names and a description of your business, not third-party data. If such information appears in an answer, you can correct it in the summary before confirming or request deletion.

5-A.7. How long we store it, and how to delete or export it.

• Time limit: answers, Iara's interpretations and dossiers are kept while you have access to them because they form the foundation of your Iara. Once your access ends, we retain them for another 90 (ninety) days, counted from end of access — rather than the end of voice or support alone, which does not count (Terms, chapter 6.5, c): - for Primeira Iara, access ends 12 months after payment confirmation (Terms, chapter 3.4); - for Iara Completa, access ends at the end of the paid period, after cancellation by you or by the billing platform for nonpayment (an overdue boleto or card payment still being collected is a suspension, not termination: the countdown does not start while it lasts); - in the event of withdrawal, refund or chargeback (and on termination for a breach of the Terms), access ends immediately and Órbita no longer displays any content; the 90-day period starts on that date, and a copy must be requested by emailing the data protection officer.
• Warning before deleting: at least 15 (fifteen) days before deletion, we email your account address with the deletion date. Deletion takes place only after both deadlines (the 90 days and the 15-day notice period); if notice is late, deletion is delayed accordingly, never brought forward.
• If we cannot notify you: if the email cannot be sent (email provider unavailable or not configured, address rejected), nothing is deleted. We retry every hour, keep the data under restricted access, and have the deletion routine record how many entries were retained because notice could not be sent, so our team can resolve it. We never delete without notice; in this case, we keep the data a little longer, until notice is sent.
• If access is restored (renewal or a new purchase before deletion), the countdown stops: nothing is deleted while a plan is active.
• End of account: if the account is closed, interviews are deleted before the registration data.
• Delete at any time: request this by emailing the data protection officer (section 10). Within 15 days, we delete all your interviews, answers and dossiers together, along with the interview points. Only an audit trail record remains, stating that a deletion occurred and how many interviews were deleted, without their content.
• Get a copy: the dossier is visible in Órbita, ready to copy. A complete copy, including all answers and the status of your access rights, is available as a structured file (JSON) at https://arsenal.ideiabusiness.com.br/api/arsenal/orbita/exportar, while signed in, for as long as you have access and for 90 days after it ends. Outside that period, or if you prefer, request it via the same email address; we send it in a structured format within 15 days.

6. Who we share it with (processors and third parties)

We do not sell personal data. We share it only with the parties needed to operate the service, within the limits below.

We have agreements with our processors requiring confidentiality, security and use solely for the contracted purpose.

7. International data transfer

Some of our processors have servers outside Brazil. Transfers are based on art. 33 of the LGPD and ANPD rules on standard contractual clauses (Resolução CD/ANPD nº 19/2024), as shown in the table:

You can request more information about these transfers through the channel in section 10.

8. How long we store it

We keep each item of data only as long as needed for its purpose or as required by law. Retention periods:

After the retention periods expire, data is securely deleted or anonymized. Data that must be retained to meet a legal obligation (art. 16, I, of the LGPD) or for legal defense (art. 16, II) is kept under restricted access until that need ends.

9. How we protect data

Measures in force in our system (Article 46 of LGPD):

• Encryption in transit: all access to Órbita, APIs, the database and the installation service uses HTTPS/TLS; SSH connections to your VPS are encrypted.
• No Member password: access uses a single-use magic link, valid for 15 minutes. Its token is generated from 32 random bytes and stored only as a hash SHA-256; the link cannot be reconstructed from the database.
• Sessions: session cookie with attributes HttpOnly, Secure, SameSite and prefix __Host- (sent only to our domain, over HTTPS, with no script access), valid for 8 hours, with the token stored only as a hash and revoked on logout.
• Team password (administration): at least 16 characters, stored as a hash scrypt (cost 32768, random salt), constant-time comparison, a 15-minute lockout after 5 failed attempts, and a cookie with SameSite=Strict. Members cannot access administrative areas.
• Request limits: at most 5 link requests every 15 minutes per email and per source; the rate-limit key is an HMAC of the email and IP, not the data in plain text.
• Payment webhook: we accept only events signed by Kiwify (HMAC verified in constant time); events with an invalid signature are rejected and logged without the secret.
• Access gate: every Órbita path is blocked by default; only users with a valid session and an active plan are allowed in, as checked on the server with each request ("fail closed").
• Security headers: protection against embedding in other sites (X-Frame-Options: DENY) and content misinterpretation (nosniff), no referrer sent to third parties (Referrer-Policy: no-referrer), and camera and geolocation disabled; the microphone is permitted only on the interview page and requested only when you choose voice.
• Immutable audit trail: the audit events cannot be changed or erased by the system.
• Installer: see section 5 (secrets only in memory, 0600 temporary files deleted, secrets filtered from logs, service with its own user and isolated directories, firewall, HTTPS).
• Interview: answers are saved only through our API, for the Member concerned, with a valid session, active plan, up-to-date acceptance and origin verification; each answer has a size limit, and answers that look like keys or passwords are rejected. The voice provider's key, if any, stays only on the server: the browser receives only a short-lived credential.
• Least privilege and secrets: service keys and tokens are kept in the hosting environment's variables, outside the code; webhook tokens are rotated as needed.
• Backup: copies of the database according to the provider's practices, with restricted access.
• Team access: restricted to those who need it, using strong passwords and short sessions, with an audit record.

No measure guarantees absolute security. You can help by protecting your email inbox (your access key), your VPS and your third-party accounts.

10. Your rights and how to exercise them

Under art. 18 of the LGPD, you may request the following at any time, free of charge:

• confirmation that we process your data and access to them;
• correction incomplete, inaccurate or outdated data;
• anonymization, blocking or erasure of unnecessary, excessive or unlawfully processed data;
• portability of your data to another provider, in a structured format;
• erasure data processed on the basis of consent;
• information about who we share data with, and about the option of refusing consent and its consequences;
• Withdrawal of consent (for example, disable your public profile);
• objection to processing based on legitimate interest;
• review of automated decisions (section 13);
• complaint to ANPD (gov.br/anpd) or consumer protection bodies.

How to request: email to dpo@ideiabusiness.com.br from the address registered in Órbita (this is how we verify your identity). If the request comes from another address, we will ask for confirmation through your registered email. Representatives must provide a power of attorney. Requests about the interview (copies or deletion of answers and the dossier) use the same channel (section 5-A.7).

Time limit: we respond within 15 days. Simple requests (confirmation of processing, summary access) are handled immediately whenever possible. If complexity means we need more time, we will explain why and give you the new deadline.

Limits: some data cannot be deleted while a legal obligation (tax law, Marco Civil) or the need to defend rights applies (section 8). In those cases, we explain which data and why, and restrict access to it. In the immutable audit trail, deletion takes place through anonymization your account record: the internal identifier remains, but your name, email and phone number are removed.

11. Cookies and browser storage

We use only strictly necessary cookies. We do not use tracking, advertising or social media cookies, or analytics tools. That is why there is no cookie banner: necessary cookies do not require consent.

Local browser storage (localStorage), only on the installer page: the current installation's identifier and tracking token, an idempotency key (to avoid starting two installations when the page reloads), and a flag indicating that initial registration was completed. These items stay only in your browser, are not sent to third parties, and are deleted by the installer on completion or failure; you can also remove them by clearing site data in your browser. No password, key or bot token is stored in the browser.

Third-party sites Órbita links to (Kiwify, Telegram, AI Providers) use their own cookies under their own policies.

12. People under 18

Ideia Arsenal and Órbita Ideia are intended for people aged 18 or over. We do not intentionally collect data from children or adolescents. If we learn that an account belongs to someone under 18, we will close it and delete the data, unless retention is legally required. If you are responsible for a minor and believe they have registered, contact the data protection officer (section 16).

13. Automated decisions

13.1. Access based on payment. Your access is granted, suspended and revoked automatically, based on the events Kiwify sends us (payment approved, renewed, overdue, refunded, chargeback, canceled), using a table that maps products to access rights. There is no profiling or assessment of your characteristics: this is an objective rule tied to payment. If you believe there has been an error, you can request review by one person through the channel in section 16 (art. 20 of the LGPD); the team can grant or correct access rights manually, with an audit record.

13.2. Gamification. Points and ranks are calculated automatically from objective events (lesson completed, skill installed, attendance, case published, interview completed), using fixed rules and without affecting your access to the product. Public display requires your consent (public profile).

13.3. Interview dossier. The dossier is built automatically from your answers using fixed rules, and is saved only after you check and confirm the summary. It does not affect your access to the product and is not used to assess you.

13.4. We make no other automated decisions affecting your interests, and do not use your data to train AI models.

14. Security incidents

If a security incident could cause you significant risk or harm (for example, unauthorized access to the database), we will notify ANPD and the affected data subjects within a reasonable time, under art. 48 of the LGPD and ANPD regulations on incident reporting (Resolução CD/ANPD nº 15/2024), describing what happened, the data involved, the risks, the measures taken and our recommendations for you. We keep an internal record of incidents, including those that do not require notification.

You can report a suspected incident to dpo@ideiabusiness.com.br. If you receive an access link you did not request, ignore it: it works only once and expires in 15 minutes; let us know if it happens again.

15. Changes to this Policy

We may update this Policy to reflect changes to the product, providers or law. Each version has a number (date) and an effective date. Changes affecting purposes, legal bases, sharing, international transfers or retention periods are materials: we will notify you in advance by email and in Órbita and request fresh acceptance on your next visit; when consent is the legal basis, we will request new consent. Wording or contact changes take effect on publication, with notice in Órbita. Previous versions are available on request.

16. Contact

• Data protection officer (DPO): Victor Lopes Paiva — dpo@ideiabusiness.com.br
• General support: contato@ideiabusiness.com.br
• Controller: Ideia Business Soluções Tecnológicas LTDA · CNPJ 30.082.914/0001-00 · Rua Siqueira Campos, 940, 1º andar, Centro Histórico, Porto Alegre/RS, CEP 90010-000
• National Data Protection Authority: gov.br/anpd

Version 2026-09-28-1 · In force since 28/09/2026