Last updated: July 21, 2026
This Privacy Policy describes how Project Engineer ("Project", "we", "us"), operated by Global Match Engenharia de Produção (Brazil, CREA-SP 5071200171), collects, uses, shares, and protects personal information. It is written to comply with the privacy laws of the markets we serve: Brazil (LGPD), the United States (CCPA/CPRA and other state privacy laws), Canada (PIPEDA and Quebec Law 25), the United Kingdom (UK GDPR and Data Protection Act 2018), and Australia (Privacy Act 1988 and the Australian Privacy Principles).
We collect the following categories of personal information:
We use personal information to: provide and operate the platform; process payments and manage subscriptions; respond to support requests; improve the AI agents and service quality; meet legal and regulatory obligations; and send service-related communications.
Where the UK GDPR applies, we rely on these lawful bases (Art. 6): consent (e.g., optional marketing, sensitive data), contract performance (providing the service you subscribed to), legal obligation (tax, regulatory, and record-keeping duties), and legitimate interests (service improvement, security, and fraud prevention, balanced against your rights).
Our AI agents process the documents and business information you provide to generate recommendations, and our AI receptionist answers and may record calls on behalf of your business.
We share personal information only with the service providers needed to run the platform:
We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined by the CCPA/CPRA. We honor Global Privacy Control (GPC) browser signals. We may disclose information if required by law, court order, or to protect our legal rights.
We are based in Brazil and our service providers operate in multiple countries. When personal information is transferred internationally, we protect it using appropriate safeguards: contractual clauses aligned with the EU/UK Standard Contractual Clauses and the UK International Data Transfer Agreement (IDTA) where required, comparable contractual protections for transfers from Quebec (Law 25, s. 17) and Brazil (LGPD, Art. 33), and reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles (APP 8).
We keep personal information only for as long as your account is active and as needed to provide the service. After account closure, we retain billing and transaction records for the periods required by tax and commercial law (typically 5 years in Brazil), and delete or anonymize other personal information within 12 months, unless a longer period is required by law or legal claims.
Your data is encrypted in transit (TLS 1.3) and at rest (AES-256). Agents handling sensitive data run on a segregated LLM environment. Access is limited to authorized personnel under confidentiality obligations.
For the NR1 agent (psychosocial risk assessment, MTE Ordinance No. 1,419/2024), we may process data classified as sensitive under Art. 11 of the LGPD and Art. 9 of the UK GDPR (information related to worker health). This data is processed only with the specific, explicit consent of the data subject or their employer, used exclusively to generate the risk inventory and action plan required by NR-1, and never shared for any purpose other than the legal occupational health and safety obligation.
Regardless of where you live, you can contact us at any time to exercise your rights at privacidade@aionreceptionist.com. We will not discriminate against you for exercising any privacy right.
Rights to confirmation of processing, access, correction, anonymization, portability, and deletion. Response within 15 business days (Art. 19). You may also complain to the ANPD (Autoridade Nacional de Proteção de Dados).
Residents of California and other US states with privacy laws have the right to: know/access the categories and specific pieces of personal information we collect, use, and disclose; delete personal information (subject to legal exceptions); correct inaccurate information; opt out of the sale or sharing of personal information (we do not sell or share it); limit the use of sensitive personal information (we use it only to provide the requested service); and non-discrimination for exercising these rights. We respond within 45 calendar days, extendable by a further 45 days where permitted. You may use an authorized agent, and we may need to verify your identity before acting on a request.
You have the right to access and correct your personal information, withdraw consent (subject to legal and contractual restrictions), and challenge our compliance. Quebec residents additionally have the rights to deletion, data portability in a structured, commonly used technological format, and information about any automated decision-making. Our Privacy Officer (section 13) is the person in charge of the protection of personal information for the purposes of Law 25. We respond within 30 days. You may complain to the Office of the Privacy Commissioner of Canada (OPC) or, in Quebec, the Commission d'accès à l'information (CAI).
You have the rights to be informed, of access, to rectification, to erasure, to restrict processing, to data portability, to object, and in relation to automated decision-making and profiling. We respond within one month. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
You have the right to access (APP 12) and correct (APP 13) your personal information, and to complain about our handling of it. We respond within a reasonable period (generally 30 days). If you are not satisfied with our response, you may complain to the Office of the Australian Information Commissioner (OAIC) at oaic.gov.au.
Our website uses privacy-respecting analytics (Google Analytics 4, served through a first-party proxy) to measure traffic and improve content. We do not use advertising or cross-site tracking cookies. Where required (including the UK under PECR), non-essential cookies are used only with your consent. You can control or delete cookies through your browser settings at any time.
Our services are directed to businesses and are not intended for children under 16. We do not knowingly collect personal information from children under 13 (COPPA) or sell the personal information of consumers under 16 (CCPA). If you believe a child has provided us personal information, contact us and we will delete it.
If a personal data breach occurs that is likely to result in risk or harm to you, we will notify you and the competent authority as required by applicable law — including the UK ICO within 72 hours (UK GDPR), the Canadian OPC where there is a real risk of significant harm (PIPEDA), the OAIC and affected individuals under Australia's Notifiable Data Breaches scheme, the ANPD in Brazil, and US state breach-notification laws.
We may update this Privacy Policy from time to time. Material changes will be announced on this page with an updated revision date, and, where required, notified by email. The current version is always available on this page.
Email: privacidade@aionreceptionist.com
Phone: +55 (11) 99479-8464
Mailing address: Global Match Engenharia de Produção, São Paulo, SP, Brazil