Privacy Policy

Volund respects your privacy and is committed to protecting your personal data. This Policy applies to all users who access or use the Volund OS platform, available at os.volund.com.br.

By creating an account or using the Service, you declare that you have read and understood this Policy and consent to the processing described here, when that processing relies on consent as its legal basis.

For the purposes of the LGPD, the Controller of your personal data is:

The DPO is the official channel for exercising your rights as a data subject and for answering questions about the processing carried out by Volund.

We collect personal data in the following categories:

3.1 Registration data

• Full name;
• Email address;
• Password (stored with a cryptographic hash, never in plain text);
• Organization information (name, domain);
• Billing data (name, CPF/CNPJ, billing address, processed by the payment gateway).

3.2 Usage data

• Access logs (IP, date/time, device, browser);
• Interactions with the platform (agents created, runs, approvals);
• Conversations with agents and session history;
• Error data and diagnostic events.

3.3 Data entered by the User

• Content uploaded to knowledge bases;
• Data and instructions configured in agents;
• Results of integrations with external services.

3.4 Third-party data

• If you sign in with Google (OAuth), we receive the name and email provided by Google upon your explicit authorization;
• Data of members invited to an Org (name and email).

Under art. 7 of the LGPD, your personal data is processed for the following purposes and on the following grounds:

Personal data is retained for as long as necessary to fulfill the purposes described in this Policy, according to the following criteria:

• Active account data: kept for the entire life of the account;
• After account closure: data is anonymized or deleted within 90 days, unless a longer retention period is required by law;
• Access logs: retained for 6 (six) months, as required by art. 15 of the Brazilian Internet Civil Framework (Law No. 12,965/2014);
• Tax and financial data: retained for 5 (five) years as required by tax law;
• Agent content: deleted within 30 days after deletion by the User or account closure.

Volund does not sell, rent or trade users' personal data. Sharing only occurs in the following situations:

6.1 Processors and service providers

We share data with vendors that help us operate the Service (cloud infrastructure, payment processing, email delivery, error monitoring). These vendors act as Processors under our instructions and are contractually required to protect the data.

6.2 Third-party AI models

To process messages and run agents, interactions may be sent to language model providers (e.g., Anthropic, OpenAI). This data is used solely to generate the response and is not used to train models, under the agreements signed with these providers.

6.3 Legal requirement

We may disclose data when required by a competent authority, court order or legal obligation, always to the smallest extent possible.

6.4 Corporate reorganization

In the event of a merger, acquisition or sale of assets, data may be transferred to the successor, who will assume the obligations of this Policy. We will notify Users in advance.

The platform uses cloud infrastructure that may be located outside Brazil (e.g., servers in the US or Europe). Every international transfer of personal data is carried out with adequate safeguards, under art. 33 of the LGPD, including:

• Countries with an adequate level of protection recognized by the ANPD;
• Specific contractual clauses that ensure protection equivalent to the LGPD;
• International security certifications and standards (ISO 27001, SOC 2).

Under arts. 17 to 22 of the LGPD, you have the following rights regarding your personal data:

To exercise any of these rights, contact our DPO at privacidade@volund.com.br. We will respond within 15 (fifteen) business days.

You also have the right to petition the Brazilian National Data Protection Authority (ANPD) if you believe your rights have not been honored.

Volund adopts appropriate technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure, destruction or accidental loss, including:

• Encryption of data in transit (TLS 1.2+) and at rest;
• Secure authentication with a two-factor authentication option;
• Role-based access control (RBAC);
• Continuous monitoring and audit logs;
• Periodic security reviews and vulnerability testing;
• Strong password policy and hashed storage (bcrypt).

In the event of a security incident that may affect your personal data, we will notify the ANPD and the affected Data Subjects within a reasonable time, under art. 48 of the LGPD, with information about the nature of the incident, the data involved and the measures taken.

We use cookies and similar technologies to operate and improve the Service. The cookies used may be:

• Essential: required for the platform to work (authentication, organization session). They can't be disabled.
• Analytics: collect aggregated usage data to improve the platform. They can be declined with no functional impact.
• Preferences: remember settings such as language and selected org.

You can manage cookies in your browser settings. Disabling essential cookies may prevent the platform from working correctly.

The Service is not intended for anyone under 18. We do not knowingly collect personal data from minors. If we find that data from minors was collected without proper consent from their legal guardians, we will delete that data immediately.

This Policy may be updated periodically to reflect changes in our practices or legal requirements. When there are relevant changes, we will notify active Users by email or by a notice on the platform at least 15 (fifteen) days before they take effect.

We recommend reviewing this Policy periodically. The date of the last update is shown in the document header.

To exercise your rights, ask questions or file complaints about the processing of your personal data: