1. WHO HANDLES YOUR DATA
1.1. The Office Roots owner is the controller of platform data (account, access, presence, communication, and usage records).
1.2. The employer or administrator of each office is the controller of employment-relationship data (shifts, absences, balances, and time records) processed within that office.
1.3. To operate the Service, we use specialized processors in the following categories: authentication and database, transactional email delivery, voice, video, and screen-share infrastructure, and an optional animated-image catalog. Each processor handles data only on our instructions and within what is strictly necessary.
2. DATA WE COLLECT
2.1. Identity and account: name, email, and access credential (stored under protection by the authentication provider).
2.2. Profile and presence: avatar, display name, position and status in the 3D environment, seats, and last access.
2.3. Real-time communication: audio, video, and shared screen travel transiently to enable the conversation. We do not record or store call content.
2.4. Chat and files: sent messages, recipients, date and time, attachments, and reactions.
2.5. Attendance and HR: clock-in/out records, absences, daily notes, holidays, balances, and schedule profiles, always segregated by office.
2.6. Invites and members: invited emails, roles, acceptance, decline, and activations.
2.7. Support and security: technical access logs, errors, abuse attempts, and support communications.
2.8. Aggregated, anonymized usage: statistics that identify no one, used to operate and improve the Service.
3. PURPOSES AND LEGAL BASES (LGPD, ART. 7)
We process data to: (a) create and maintain your account and authenticate access — contract performance and pre-contractual steps; (b) enable offices, presence, voice, chat, and attendance — contract performance; (c) send confirmation, invite, and password-recovery emails — contract performance; (d) record acceptance of the Terms and this Policy — consent and legal compliance; (e) prevent fraud, abuse, and security incidents — legitimate interest and protection of security; (f) fulfill export and deletion requests — legal compliance; (g) comply with legal, regulatory, or judicial requirements — legal compliance or exercise of rights in proceedings.
4. SHARING
4.1. We share data only with the processors in clause 1.3, with your office administrator (within the limits of their role), and when required by law, court order, or competent authority.
4.2. Each office's data is isolated: we never share presence, chat, voice, or attendance across different organizations.
4.3. We do not sell personal data nor share it for third-party marketing.
4.4. In a corporate reorganization, data may transfer to the successor, keeping the purposes and protections described here, with notice to users.
5. INTERNATIONAL TRANSFERS
Depending on the contracted infrastructure, data may be processed or stored in other countries, always with the safeguards of LGPD Article 33 (contractual clauses, processor warranties, and security measures).
6. RETENTION AND DISPOSAL
6.1. We keep account data while the account is active and as long as needed for the described purposes.
6.2. Chat attachments are automatically deleted after a short retention window. Security logs are kept for a limited period and then deleted or anonymized.
6.3. When you delete your account, we erase memberships, profiles, consents, and associated messages from live systems (messages undergo sender anonymization), except for rotating backups, which expire in the normal retention cycle.
6.4. Time records and labor documents may be kept by the employer for the period required by labor, tax, and social-security law, under the employer's responsibility.
7. YOUR RIGHTS (LGPD, ART. 18)
You may: confirm processing exists; access your data; correct incomplete or outdated data; anonymize, block, or delete unnecessary data; obtain portability in a structured format; learn with whom we share; withdraw consent where it is the basis (without affecting prior processing); and object where the law allows. To exercise these, use the "Privacy and my data" section in the office selector (export and deletion) or the official support channel. We respond within LGPD timeframes and may ask for identity verification to protect your account.
8. SECURITY
We adopt per-office access controls, encryption in transit and at rest, audit trails, and anti-abuse limits. No system is fully immune to incidents: if a relevant event occurs, we will take containment and notification measures required by law. Keep your password confidential and avoid unknown networks for sensitive calls.
9. COOKIES AND SIMILAR TECHNOLOGIES
We use strictly necessary technologies: session and authentication, preferences (such as language and last office), and security. We also use Google Ads to measure campaigns: when you arrive via an ad, Google may set attribution cookies (googleadservices.com/doubleclick.net) to count clicks and sign-ups — basis: consent and legitimate interest in measuring ad effectiveness (LGPD, art. 7, IX). We do no behavioral remarketing of our own. Manage preferences at myadcenter.google.com and by clearing browser cookies. Session data stays in your browser and can be cleared by signing out or clearing browser data.
9.1. Google Ads (campaign measurement): gtag.js tag on the landing page plus a "Sign-up" conversion event (symbolic value of BRL 1.00) after account creation. Processor: Google Ireland/US, with international transfers under LGPD Article 33 safeguards. To opt out of measurement, use a tracking blocker or Google's preference page above.
10. MINORS
The Service is for professional use. We do not knowingly collect data from children under 12; if we identify such a registration, we will remove it. Teen accounts must be managed by a guardian or by the employer for apprentices.
11. CHANGES TO THIS POLICY
We may update this Policy to reflect changes in the Service or the law. Material changes create a new version with a fresh acceptance request in the app.
12. CONTACT AND DPO
Questions, rights requests, and privacy communications should be sent through the official support channel indicated in the app and in transactional emails, addressed to the data protection officer (DPO). We will identify the officer and direct contacts in the next revision of this Policy, without prejudice to immediate assistance through the official channel.
13. GOOGLE CALENDAR INTEGRATION (OPTIONAL)
13.1. Data access (what we read): if you connect your Google account, we read only your primary calendar's events (title, start and end time, location, and description) within a limited window (about 10 minutes in the past to 12 hours ahead, up to 50 events per query), to show meeting reminders and detect the event's voice-zone link. We also read your Google email solely to identify which account is connected in each office (the "Connected: ..." label).
13.2. Data use (why we use it): we use calendar data exclusively to provide these user-facing features (advance meeting reminders, start/end detection, and voice-zone link detection). We do not use the data for any other purpose.
13.3. Data sharing and transfer (who we share with): calendar data is not shared with third parties, sold, provided for third-party marketing, or transferred to data brokers or advertisers. The only processors with access are those in clause 1.3, strictly as needed to operate the Service, plus your office administrator within the limits of their role.
13.4. Data protection (how we protect it): access is read-only — we never create, modify, or delete events in your calendar. The access token lives only in memory while in use; the refresh token is stored encrypted (AES-256-GCM) and never exposed in the frontend or in logs.
13.5. Retention and deletion (how long we keep it): we keep no permanent copy of events — only a transient in-memory cache to display reminders. Tokens are deleted immediately when you disconnect in that office, when your office membership is removed, when the office is deleted, or when you delete your account. You can disconnect at any time in the app's calendar section or in your Google Account (Security > Third-party access); on disconnect, we delete the tokens and immediately stop reading.
13.6. Limited use and AI: the use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements. The app's AI features (voice transcription, meeting summaries, and Kanban estimates) exclusively use the OpenRouter gateway (Whisper models for speech-to-text, Gemini Flash and Llama for text) and receive only voice audio/transcripts and Kanban cards. Google Calendar data (title, times, location, description, and email) is never sent to any AI model or AI service. Every AI call enforces Zero Data Retention with training-data collection denied at routing time, and the account disallows endpoints that train on request data. Calendar data is also not used for targeted advertising, nor transferred to third-party AI services that use such data for training.