Privacy Policy

Last updated: August 10, 2026

This Policy describes how O Conselho ("we", "our") collects, uses, shares and protects your personal data when you use our web and mobile application available at oconselho.ai (the "Service"). We comply with the Brazilian General Data Protection Law (Law 13,709/2018 — LGPD) and with the Apple App Store guidelines.

1. Data we collect

1.1 Registration data

• Name, e-mail, profile photo (via LinkedIn OAuth, Sign In with Apple or Google Sign-In)
• Password login restricted to administrators and to the Apple review account (open password registration is disabled during the closed beta)
• Professional data via LinkedIn (title, headline, experience) when you authenticate through it — used to personalize the advisors' context
• Public LinkedIn profile enrichment via a third-party provider (Apify), executed automatically in the background after your first login to personalize the experience. You can request removal of this data at any time through the e-mail below.

1.2 Financial data (via Pluggy / Open Finance)

• Balances, positions, statements and investments from the institutions you connect
• Connections are authorized by you directly in the Pluggy widget, regulated by the Central Bank of Brazil
• We do not store your banking passwords — we use tokens issued by Open Finance

1.3 Usage data

• Financial decisions you submit for the advisors' analysis
• History of interactions with the Boardroom (AI deliberations), including messages exchanged with each advisor
• Vector representations (embeddings) of your conversations, stored separately to power the advisors' persistent memory (RAG system)
• Technical logs (IP address, device type, app version)

2. How we use your data

• AI advisors: your financial data and profile are used to generate personalized analyses by the advisors you choose (the catalog includes personas such as Banker, Oracle, Macro, Visionary, among others). The models are accessed via third-party APIs — Perplexity (Sonar) and Google Gemini — under the providers' no-training policies on enterprise plans.
• Portfolio sync: we periodically query Pluggy to keep your portfolio up to date.
• Persistent memory (RAG): embeddings of your conversations are stored in our database (PostgreSQL with pgvector) so the advisors keep context between sessions without resending everything on each question.
• Communication: we send notifications about important events in your portfolio or the app.
• Product improvement: aggregated, anonymous usage analysis to improve the experience.

3. Automated decisions and AI

The Platform uses automated processing and artificial intelligence models to generate wealth and strategic analyses, personalize the advisors' responses, adapt the tone of communication to your professional profile, produce insights, contextual greetings and recommendations, and calculate score, rank, archetype and other gamification elements.

These features have an assistive and informational purpose and are part of the Platform's core experience. You remain responsible for your personal, wealth and financial decisions. Where applicable, you may request additional information about the general criteria involved in automated processing, subject to trade and industrial secrets and to the applicable technical and legal limitations.

4. Legal bases (LGPD)

• Consent — to connect accounts via Pluggy
• Performance of contract — to provide the contracted service
• Legitimate interest — for security, fraud prevention and product improvement

5. Data sharing

We share data only with:

• Pluggy — regulated Open Finance provider in Brazil
• Perplexity AI and Google (Gemini) — providers of the AI models that generate the advisors' analyses, under no-training policies
• Apify — public LinkedIn profile enrichment provider, triggered only with your consent
• LinkedIn, Apple and Google — authentication providers (OAuth, Sign In with Apple and Google Sign-In)
• Infrastructure providers — Replit (hosting) and Neon (PostgreSQL database), all subject to confidentiality agreements
• Authorities — when required by law or court order

We do not sell your personal data to third parties.

6. International data transfers

Some vendors, technology partners or sub-processors may be located abroad or process data in other countries, including as a result of the use of cloud solutions, authentication, Open Finance, profile enrichment or AI models.

In such cases, we adopt reasonable and adequate measures to ensure that these transfers comply with the LGPD and take place with a compatible level of protection, including through contractual clauses, vendor assessments and applicable technical and organizational safeguards.

7. Storage and security

• Data encrypted in transit (TLS 1.2+) and at rest (AES-256)
• Open Finance tokens stored separately, never exposed to the client
• Administrative access restricted and audited
• Servers hosted on enterprise-grade cloud infrastructure

8. Retention

We keep your data while your account is active. After account deletion, personal data is removed within 30 days, except for records we must keep due to legal obligations (up to 5 years for tax and regulatory purposes).

9. Cookies and similar technologies

The Platform may use cookies, SDKs, pixels, logs and similar technologies for authentication, session maintenance, security, usage measurement, performance improvement, experience personalization and prevention of fraud and technical failures. Where required by law or by good transparency practices, you may receive additional information about these technologies in a specific notice or cookie policy.

10. Your rights (LGPD)

At any time, you may:

• Access, correct or export your data
• Request deletion of your account and associated data
• Revoke connections with financial institutions
• Revoke profile-enrichment consents
• Request review of decisions made solely on the basis of automated processing, where applicable
• File a complaint with the Brazilian National Data Protection Authority (ANPD)

To exercise any right, write to privacidade@oconselho.ai.

11. Children

The Service is intended for people aged 18 or older. We do not knowingly collect data from minors.

12. Changes to this Policy

We may update this Policy from time to time. Material changes will be communicated by e-mail or in-app notification at least 15 days in advance.

13. Governing law and jurisdiction

This Policy is governed by the laws of the Federative Republic of Brazil. The courts of the Judicial District of São Paulo/SP are elected as the competent forum, except where a mandatory legal provision states otherwise, to settle any disputes related to this Policy.

14. Contact

Data Protection Officer (DPO):

• E-mail: privacidade@oconselho.ai
• General support: suporte@oconselho.ai
• Support page: oconselho.ai/support