Data controller.
NOESIS LTDA (CNPJ to be registered), headquartered in Brazil. DPO / Data Protection Officer: [email protected] — response within 15 business days for LGPD / GDPR requests.
PII and non-PII data.
PII (identifiable)
- Name, email, phone (optional), document (optional)
- Country, preferred language, photo/avatar (optional)
- Self-declared department and role (optional)
- Login logs, IP address, user-agent
- Purchase history and payment records
Usage data (anonymous where possible)
- Test responses, question order seen, time per question
- Derived scores, dimensions, percentiles
- Integrative Chat content
- Aggregate metrics (internal statistics, science training)
Legal basis for processing.
- Contract performance: Registration data, purchase, delivery of reports and certificates.
- Consent (opt-in): Marketing communications, analytics and marketing cookies, inclusion of playful test executions in the integrative context.
- Legal obligation: Fiscal retention of financial transactions (5 years, adjustable by country).
- Legitimate interest: Anonymous aggregate metrics for product improvement, anti-fraud, anti-abuse.
Your rights.
Access and portability
Go to Settings → Privacy → Export data. We generate a ZIP with PDF, JSON, and report copies in under 5 minutes. Limit: once every 60 days.
Rectification
Edit your profile directly in the dashboard. Email changes require re-verification via magic link.
Erasure
"Delete my account" in the dashboard. 30-day withdrawal window. After that, PII is anonymized; audit logs and anonymous aggregate metrics remain.
Revoke consent
Cookies, marketing, and any opt-in can be revoked at any time in Settings → Notifications or via the cookies banner (link in the footer).
When you access NOESIS via a partner company.
Your NOESIS identity is unique per email. The link to a partner company is an additional layer that gives the admin access to anonymous aggregated reports with N≥5 employees — never individual data without explicit consent.
Tests measuring sensitive dimensions (mental health, dark traits, sexuality, religiosity) display a prior notice. You can take the test outside the company context — in that case, the Whitelabel admin does not see the result or any aggregate.
Suspension or deactivation of a Whitelabel does not affect your direct personal access to NOESIS. Reports and certificates already unlocked remain accessible in your personal account.
Retention periods.
- Active user PII: Indefinite while the account is active.
- Inactive user PII: Email warning 30 days prior; no response = anonymization (default: 5 years without login).
- Audit logs: 5 years.
- Financial transactions: 5 years (adjustable by country).
- Backups: Rolling 90-day retention.
Third-party sharing (minimum necessary).
- Payment gateways (Pagar.me, Stripe, Mercado Pago, PayPal): Transaction data to process the charge.
- AI providers (Anthropic, OpenAI, etc.): Only content necessary for report generation / chat response. No identifying PII beyond name when essential for personalization.
- Transactional email providers (AWS SES, ElasticEmail): Only data necessary to deliver the email.
- Hosting and infrastructure: Cloud provider with an active Data Processing Agreement (DPA).
Contact the DPO.
For any request related to your LGPD / GDPR rights: [email protected]. Response within 15 business days. If you prefer, use the contact form with subject "Privacy".