Privacy
policy.

1. Scope and responsibilities

Boomai is responsible for decisions about data processing in the commercial interactions described on this page. This processing is subject to Brazil's General Personal Data Protection Law — LGPD.

The use of Boomai technologies by client companies may involve other data, such as audio, documents, conversations, resumes or voice biometric information. The purposes, responsibilities, legal bases and conditions of each project must be described in the applicable contractual documents and in the notices intended for the people involved.

When the client company decides the purposes and essential elements of processing, it acts as the controller. When Boomai processes data on behalf of and according to that company's instructions, it acts as the processor. For information about a specific project, contact the company you interacted with or our privacy contact.

2. Data provided when contacting us

The form asks for your name, company, work email, phone number and a description of the challenge you wish to address. When you contact us through WhatsApp, we may also receive your phone number, profile information available on that channel and the content of the messages you send.

The form forwards your request to Boomai's contact processing service for delivery to the commercial email address montenegro@boomai.tech. WhatsApp is a separate option, used only when you choose the “I'd rather go straight to WhatsApp” link.

You choose whether to contact us. Without sufficient information to respond, our service may be limited. Avoid including sensitive data, access credentials or personal information about others in this first contact.

3. Purposes and legal bases

We use contact data to respond to your request, understand the need presented, prepare proposals and follow up on the commercial conversation.

In interactions with company representatives, this service may rely on the legitimate interest in responding to a requested contact, respecting your expectations and rights. When the data subject is a party to a potential contract, pre-contractual measures taken at their request may apply.

Processing may also be necessary to comply with legal or regulatory obligations and exercise rights in proceedings. If an activity depends on consent, it must be requested for a specific purpose and may be withdrawn. Simply accessing the website does not constitute blanket authorization for other uses of your data.

4. Browsing, cookies and external services

This version of the website does not incorporate advertising or audience analytics tools. Hosting, protection and access control services may process technical information, such as IP address, request date and time, and browser characteristics, and use identifiers necessary for the environment to function.

Fonts and images are served by the website's own hosting, without connecting to Google Fonts. Form submissions use Formspree to process submitted fields, filter spam and forward the message to Boomai's commercial email address. See the Formspree Privacy Policy.

When you open a conversation in WhatsApp, you start using an external service that also processes data according to its own terms. See the WhatsApp Privacy Policy.

You can manage cookies and permissions in your browser settings. Disabling necessary features may affect access to or operation of some services.

5. Sharing and processing abroad

The operation of the website and contact channels involves the hosting, form processing and communication providers described in this policy. They may receive the data necessary to carry out their activities. Information may also be provided to meet a legal obligation or a valid order from a competent authority.

These services may involve processing data outside Brazil. International transfers under Boomai's responsibility must comply with the mechanisms provided by the LGPD and ANPD regulations. For information about recipients, countries involved and mechanisms applicable to your data, contact our Data Protection Officer.

6. Retention and security

Data is retained for the time necessary to provide the service and fulfill the stated purposes, also considering legal obligations and situations in which retention is permitted by law. There is no single retention period for all types of information.

Access to data in Boomai's activities is limited to authorized people according to their duties. We adopt technical and administrative measures to reduce the risks of unauthorized access, loss and misuse.

You may request information about the retention period applicable to your case or request deletion of the data, subject to the legal grounds for retention.

7. Your rights and how to exercise them

Under the LGPD, you may request:

• Confirmation of processing, access to your data and correction of information.
• Anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data.
• Portability, in accordance with applicable regulations.
• Information about the sharing of your data.
• Information about the possibility of denying consent and its consequences, as well as withdrawing it.
• Deletion of data processed with consent, subject to legal exceptions.
• Objection to processing without consent when the LGPD has been breached.
• Review of decisions based solely on automated processing that affect your interests, where applicable.

Send your request to dpo@boomai.tech. We may ask for proportionate information to confirm your identity and protect your data. You may exercise these rights free of charge, under the terms and deadlines established by law. You may also submit a petition to the ANPD.

8. Updates to this policy

This policy may be revised to reflect changes to the website, our service or legislation. The version date will be shown at the beginning of the page. Changes requiring specific communication or new consent will be handled in accordance with applicable law.