PortuguêsEnglishSign in Create account

STRIXS PRIVACY POLICY

Last updated: November 5, 2026.

This is an English translation provided for convenience. In case of any divergence, the Portuguese version, Política de Privacidade do Strixs, prevails.
Data controller: CORA ASSIST LTDA, CNPJ 69.708.277/0001-70.
Data protection officer (DPO): privacidade@strixs.ai

1. About this Policy

This Privacy Policy describes how STRIXS collects, uses, stores, shares and protects personal data in the course of providing its technology infrastructure services and the integration of artificial intelligence agents with digital environments.

This Policy was prepared in accordance with Law No. 13,709/2018, the Brazilian General Data Protection Law or LGPD, Law No. 12,965/2014, the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet), and other applicable rules.

For the purposes of this Policy:

The terms Controller, Processor, Data Subject, Personal Data, Sensitive Personal Data and Processing are used according to the definitions set out in the LGPD.

2. Party Responsible for Data Processing

STRIXS is operated by CORA ASSIST LTDA, a private legal entity enrolled in the CNPJ under No. 69.708.277/0001-70, headquartered at Av. Brig. Faria Lima, No. 1811, CXPST 17308, Conj. 115, Jardim Paulistano, São Paulo/SP, CEP 01452-001, Brazil.

For matters related to privacy and data protection, contact may be made by e-mail: privacidade@strixs.ai.

With respect to personal data necessary for managing the contractual relationship, billing, customer service, security, support, communication and compliance with its own legal obligations, CORA ASSIST LTDA may act as Controller, under the LGPD.

When the Customer determines the purposes and essential means of processing the personal data of its End Users, the Customer will act as Controller, and CORA ASSIST LTDA may act as Processor, to the extent that it processes data on the Customer's behalf and according to its lawful instructions.

The definition of roles will take into account the activities actually performed, the responsibilities of the parties and, where applicable, the specific data processing instruments entered into between them.

The Customer is responsible for ensuring that there is an adequate legal basis for sharing personal data with STRIXS, as well as for obtaining and keeping the authorizations necessary for its AI Agents to act.

The use of agents integrated with STRIXS does not, in itself, make the End User a contracting party to the Platform's Terms of Use.

3. Data Collected

STRIXS may require registration and authentication to access the Platform, including information necessary to identify Customers, their representatives and the integrated systems.

The data processed arise mainly from the contractual relationship with the Customer, from the use of the technology infrastructure, from the commands sent by AI Agents and from the information necessary to perform the contracted features.

3.1. Identification and contact data

STRIXS may process the following data:

3.2. Data shared through the Platform

STRIXS may process information sent by Customers or their Integrated Agents, including:

The processing of this information will be limited to the contracted features, operational security, the performance of the services and the other legitimate purposes set out in this Policy.

3.3. Third-party data provided by the Customer

When using STRIXS, the Customer may transmit personal data of End Users or of third parties related to the operations, such as names, contact information, addresses, transaction identifiers and other data necessary to perform the services.

In these cases, the Customer is responsible for ensuring that there is an adequate legal basis for processing and sharing such data, as well as for the legitimacy of the commands sent by its AI Agents.

STRIXS will process such information within the limits of its responsibilities and of the lawful instructions received, in compliance with applicable law.

3.4. Service usage and operation data

STRIXS may process technical and operational data necessary for the operation, security and improvement of the Platform, such as:

3.5. Authentication data

To allow access to the Platform, STRIXS may process information necessary to authenticate users, including account identifiers, e-mails, protected credentials, session records and security information.

When access takes place through STRIXS's own authentication, passwords will be protected by cryptographic key derivation mechanisms, without being stored in plain text.

When access takes place through the Sign in with Google feature, STRIXS may receive basic identification information, according to the permissions granted, without receiving or storing the Google account password.

The use of Google authentication does not imply automatic access to e-mails, files, contacts, calendars or other content of the user's account.

The specific conditions of Google authentication are described in Section 11 of this Policy.

3.6. Data from authorized integrations

When the Customer enables additional integrations, STRIXS may process the data necessary to perform the respective features.

These integrations may involve, depending on the contracted configuration:

STRIXS will not access third-party accounts, files or services beyond the permissions and integrations actually enabled.

3.7. External sources and commercial information

To perform automated browsing and product search features, STRIXS may access information made available by websites, merchants and third-party platforms.

This information may include prices, product availability, characteristics of offers, delivery conditions, shipping costs and other data necessary to execute commands.

Access to this information will comply with the contracted features, applicable law and the conditions of the digital environments involved.

4. Sensitive Data

STRIXS does not require sensitive personal data for the ordinary use of its technology infrastructure, except in situations where such information is necessary for specific features and there is an adequate legal basis.

The Customer must avoid transmitting highly sensitive, confidential or unnecessary information, especially when it involves:

The Customer must adopt appropriate mechanisms to prevent the undue transmission of such information by its AI Agents.

If sensitive personal data are received, their processing must comply with the specific legal grounds set out in the LGPD, the responsibilities of the parties and the legitimate purposes of the operation.

5. Purposes of Processing

STRIXS may process personal data for the following purposes:

STRIXS will not use the personal data of Customers or End Users to train artificial intelligence models or for its own behavioral advertising purposes.

For product improvement, effectively anonymized metrics may be used, provided that they do not allow the identification of data subjects by reasonably available means, subject to the legal and contractual restrictions applicable to the origin of the data.

6. Legal Bases

STRIXS may process personal data based on the legal bases set out in the LGPD, according to the nature and purpose of each operation, including:

When acting as Processor, CORA ASSIST LTDA will process data according to the lawful instructions of the Controller Customer and the relevant legal obligations, and it is up to the Controller to identify and observe the legal basis applicable to the purposes it determines.

The commercial authorization granted by an End User for a given purchase or operation does not replace the consent or other authorizations required by law and by the procedures of the responsible financial institutions.

7. Use of Artificial Intelligence

7.1. STRIXS provides technology infrastructure for the integration of artificial intelligence agents operated or made available by its Customers.

7.2. AI Agents are responsible for generating or sending commands to the Platform, according to their settings and the authorizations of the respective End Users.

7.3. To enable the contracted features, information made available by Customers may be processed by technology tools and service providers necessary to execute the commands, subject to the authorized purposes, the responsibilities of the parties and appropriate data protection measures.

7.4. CORA ASSIST LTDA does not assume, merely by making its infrastructure available, authorship of the decisions, recommendations, instructions or statements produced by the integrated AI Agents.

7.5. The Customer is responsible for supervising its AI Agents, defining their limits of action and adopting adequate controls to prevent undue commands, incorrect information and unauthorized operations.

7.6. STRIXS will not use personal data received from Customers or their End Users to train artificial intelligence models, including general-purpose or foundation models.

7.7. The processing of information by artificial intelligence tools, when necessary to perform a contracted feature, must comply with the purpose, confidentiality and data protection restrictions set out in this Policy.

8. Sharing with Third Parties

STRIXS may share personal data with service providers and technology partners when necessary for the operation, security, support and performance of the contracted features.

These third parties may include:

CORA ASSIST LTDA may use different technology components and infrastructure providers in the operation of its products, subject to the processing purposes and the responsibilities applicable to each service.

STRIXS does not sell the personal data of its Customers or End Users.

STRIXS does not share personal data with third parties for its own behavioral advertising purposes.

Sharing will be limited to what is necessary for the authorized purposes, the responsibilities of the processing agents and the applicable legal obligations.

Some service providers may be located or use infrastructure outside Brazil. In these cases, CORA ASSIST LTDA will comply with the rules applicable to international data transfers, including the mechanisms legally required by the LGPD and by the regulations of the competent authority.

9. Websites, Financial Institutions and Third-Party Services

9.1. STRIXS may integrate with websites, merchants, financial institutions, payment providers and other third-party services to enable the execution of commands sent by AI Agents.

9.2. The use of these services may be subject to the terms of use, privacy policies, technical rules and conditions of the respective providers.

9.3. STRIXS does not fully control the operation, availability, policies, security procedures or technical and commercial decisions of third-party services.

9.4. Personal data shared with merchants, financial institutions or other providers may be processed by these third parties according to their own legal responsibilities and the purposes related to the operations carried out.

9.5. The Customer must inform End Users, where applicable, of the identity of the merchants involved in purchases and the relevant information about the use of their personal data.

9.6. The Customer must assess the privacy policies and terms of use of the third-party services used together with the Platform.

9.7. The liability of CORA ASSIST LTDA for the processing of personal data will take into account the activities actually performed under its control and the obligations legally or contractually assigned to it.

10. Integrations with Financial Services and Means of Payment

10.1. CORA ASSIST LTDA is not a financial institution or a payment institution, does not provide regulated financial services on its own behalf and does not assume the regulatory responsibility attributed to the institutions responsible for providing the financial services made available through STRIXS, as described in this section.

10.2. CORA ASSIST LTDA, through STRIXS, acts as a provider of technology infrastructure and integration, making available interfaces for access to and communication with the services provided by financial institutions, payment institutions and other partners, subject to the responsibilities incumbent upon it for the provision of its own services.

10.3. The payment account and payment management services made available through the integration of STRIXS with ASAAS GESTÃO FINANCEIRA INSTITUIÇÃO DE PAGAMENTOS S.A. ("ASAAS"), a payment institution authorized to operate by the Central Bank of Brazil, are provided by ASAAS, including, according to the features contracted and enabled, opening and maintaining payment accounts, transaction processing, issuing and managing charges and boletos, paying bills and boletos, transfers, Pix, withdrawals and other movements carried out through the payment account. ASAAS holds the regulatory responsibility for the financial and payment activities it actually provides, including the applicable identification and registration verification procedures, prevention of money laundering and terrorist financing, and fraud prevention, subject to the legal responsibilities of the other participants.

10.4. The Open Finance features made available through STRIXS may use the technology infrastructure and the authorization journey of LINA INSTITUIÇÃO DE PAGAMENTO S.A. ("LINA"), in a white-label environment, or of other duly authorized participating institutions, according to the contracted integration. The regulated services of financial data sharing and payment initiation, where applicable, will be provided by the responsible participating institutions, within the limits of their respective authorizations and legal and regulatory obligations.

10.5. To enable the contracted features, STRIXS may process and share with ASAAS, LINA and other providers involved the personal data strictly necessary to perform the authorized integrations, including registration information, technical identifiers, tokens, account data, transaction information and operational records. CORA ASSIST LTDA may act as Controller with respect to data processed for the Platform's own purposes or as Processor when it processes data under the instructions of the Controller Customer. ASAAS and LINA will act as independent Controllers with respect to the processing carried out for the purposes of their own services, according to their respective legal responsibilities and privacy policies.

10.6. For opening, maintaining and moving funds in payment accounts, STRIXS may share with ASAAS the registration information and documents necessary to identify the account holder and to provide the services, including name, CPF or CNPJ, contact details, address, date of birth or corporate information, as applicable, as well as the financial information required for registration. Identity documents and identity verification images may be provided by the data subject directly to ASAAS, according to the journey made available. To execute authorized operations, STRIXS may transmit data such as amount, recipient, payment method and account or transaction identifiers, receiving information on the status and confirmation of the operations.

10.7. To enable data sharing within Open Finance, STRIXS may transmit to LINA identification information of the data subject, including CPF or CNPJ, and of the selected financial institution. After authorization in the consent journey, it may receive from LINA the financial data covered by the consent granted, including, according to the features enabled, information on accounts, balances, limits, transactions and other authorized data. The sharing will observe the purposes, periods and limits informed to the data subject in the authorization journey. The banking credentials used for authentication with the institution of origin will be provided directly in that institution's environment, without access by STRIXS.

10.8. To enable payment initiation within Open Finance, STRIXS may share with LINA the information necessary for the operation, including amount, recipient, Pix key or other payment identifier and institution of origin, receiving information on the status and confirmation of the transaction. The completion of payments will depend on the authorization, authentication and confirmation procedures required by the responsible institutions and applicable regulations.

10.9. STRIXS may provide integrations with card vault providers and tokenization solutions, according to the contracted features. Full card data will be processed and protected by the providers responsible for the respective integration, according to the architecture used. STRIXS may receive and use tokens, card brand, last digits and other identifiers necessary to display payment methods and to execute authorized operations, without storing full card data in its integration infrastructure.

10.10. The Customer is responsible for ensuring that its AI Agents send requests for access to financial information, use of tokens and execution of payment operations exclusively within the limits of the authorizations granted by the respective End Users. The commercial authorizations granted to AI Agents do not replace the consents, authentications and other procedures required by the responsible financial and payment institutions.

10.11. STRIXS may retain records of the operations carried out through its infrastructure, including amounts, transaction identifiers, the AI Agents responsible for the commands, merchants or recipients, dates, times, operating rules applied and operation statuses, when necessary for security, traceability, fraud prevention, compliance with legal obligations or the regular exercise of rights. The processing and retention of these records will observe the applicable legal bases, the periods necessary for the respective purposes and the retention rules set out in this Policy.

10.12. The revocation of an authorization, the expiry of a consent, the closing of a payment account or the deactivation of a given integration may limit or prevent the execution of the corresponding features. Consents granted within Open Finance may be revoked through the channels made available by the participating institutions, subject to the applicable rules. Once the authorization ends, STRIXS will stop receiving new data through the revoked consent, without prejudice to the retention of information whose maintenance is necessary to comply with legal or regulatory obligations, for security, fraud prevention or the regular exercise of rights.

10.13. The financial and payment services provided by ASAAS are subject to its own contractual instruments, privacy policies, security procedures and service channels. The data subject may obtain information and support related to financial operations through the channels made available by ASAAS, including the e-mail contato@asaas.com.br, without prejudice to the support provided by CORA ASSIST LTDA in relation to the STRIXS technology infrastructure.

11. Authentication through Google

STRIXS may allow registration on or access to the Platform through the Google authentication feature, using the OAuth 2.0/OpenID Connect protocol.

This feature is intended exclusively for user identification and authentication, and does not imply authorization to access other services or content of the user's Google account.

The use of the data received will comply with the permissions actually granted and the policies applicable to Google services.

11.1. Data accessed through Google

When the data subject chooses to use Google authentication, STRIXS may receive certain basic information from their account, according to the authorized access scopes, including:

Collection will be limited to the scopes actually used by the integration, such as openid, email and profile, where applicable.

STRIXS does not receive or store the password used by the data subject to access their Google account.

11.2. Purposes of Google authentication

The information obtained through Google authentication may be used to:

STRIXS will not use the information received from Google for purposes incompatible with the authorized authentication.

11.3. Limits of access to the Google account

Google authentication does not grant STRIXS general access to the data subject's account.

STRIXS will not access, through this feature:

Any future availability of other Google integrations will depend on the applicable specific permissions and on the necessary update of the privacy information.

11.4. Sharing of data received from Google

Information obtained through Google authentication will not be sold, rented or traded.

These data may be processed by technology providers necessary for authentication, account management, hosting, storage and security of the Platform, subject to the legitimate purposes of the operation.

STRIXS will not use data received from Google for behavioral advertising nor share them with third parties for that purpose.

11.5. Artificial intelligence and Google data

STRIXS will not use authentication information obtained from Google to create, train or improve artificial intelligence models.

The data obtained will be used for the identification, authentication, access management and security purposes described in this Policy.

The processing of information obtained from Google APIs will comply with Google's applicable rules, including the relevant provisions of its user data policy.

11.6. Storage and protection of Google data

Information received through Google authentication will be processed in systems with security mechanisms appropriate to its nature and purpose.

The following may be used:

CORA ASSIST LTDA will adopt measures proportionate to the risks involved and to the characteristics of the technology components used.

11.7. Revocation of access

The data subject may revoke the authorization granted to the Google integration through the security settings of their Google account, in the area dedicated to connections with third-party apps and services.

Revocation may prevent new authentications through the Google account, without necessarily deleting the registration or the records legitimately kept on STRIXS.

The data subject may request the deletion of their personal data through the channels indicated in this Policy, subject to the legal retention cases.

11.8. Deletion of Google data

The data subject may request the deletion of personal data related to Google authentication by e-mail at privacidade@strixs.ai.

CORA ASSIST LTDA will take the appropriate steps to delete or anonymize the data under its responsibility, except in cases where retention is legally permitted or required.

Deletion of data from STRIXS does not imply deletion of the Google account itself, which remains managed by the respective provider.

12. Information Security

STRIXS adopts technical, administrative and organizational measures proportionate to the risks of the activities carried out to protect personal data against unauthorized access, loss, alteration, destruction, improper disclosure or other forms of inadequate processing.

These measures may include, where applicable:

12.1. Storage and cryptographic protection

The technology infrastructure used by CORA ASSIST LTDA may comprise different storage and processing environments, according to the features and components of its products.

Certain sensitive data, credentials and identifiers may receive specific cryptographic protection, including the use of AES-256-GCM.

This protection does not mean that all data processed or stored by the Platform's components receive individual encryption at the application layer.

Other records will be protected by security measures compatible with the identified risks, including access controls, infrastructure security, segregation of permissions and operational protection mechanisms.

12.2. Protection of passwords and authentication

When authentication takes place through STRIXS's own credentials, passwords will be protected by cryptographic key derivation mechanisms, including PBKDF2-SHA256, without being stored in plain text.

When the user chooses Google authentication, credential validation will be performed by that provider, and the Google account password will not be made available to STRIXS.

Additional authentication, identity validation and session protection mechanisms may be adopted according to the features made available.

12.3. Integrity and authenticity of operations

CORA ASSIST LTDA may use cryptographic mechanisms to verify the authenticity of communications received from technology partners, protect identifiers and validate the integrity of certain operations.

These mechanisms may include HMAC-SHA256, depending on the service and the technical purpose involved.

The use of authentication and integrity mechanisms does not necessarily imply encryption of the stored content.

12.4. Technology infrastructure

The different technology components used by CORA ASSIST LTDA may use different storage and processing solutions, including Cloudflare services such as D1, KV and Durable Objects, according to the features implemented.

STRIXS may use additional cryptographic protection and segregation mechanisms in certain components, including individual protection of sensitive records, according to the architecture actually applied.

The use of these resources will comply with the relevant security measures and the applicable contractual and legal obligations.

12.5. Customer responsibilities

The Customer must adopt security measures in the systems and AI Agents under its control, including protection of credentials, management of permissions, validation of commands and prevention of undue access.

Although protection measures are adopted, no digital system or transmission over the internet is completely free of risk.

12.6. Security incidents

In the event of a security incident involving personal data, CORA ASSIST LTDA will take the appropriate measures according to its role in the operation, including investigation, containment, mitigation and cooperation with the other processing agents involved.

When acting as Processor, it will notify the Controller Customer of relevant incidents without undue delay, providing the available information necessary to comply with the relevant legal obligations.

Notifications to the Brazilian National Data Protection Authority and to data subjects will follow the responsibilities of the processing agents and the requirements of applicable law.

13. Data Retention and Deletion

13.1. STRIXS will retain personal data for the period necessary to provide the services, fulfill the purposes described in this Policy, ensure the security of operations, respond to requests, comply with legal obligations or regularly exercise rights.

13.2. Records of commands, transactions and technical operations may be retained for the period necessary for traceability, investigation of incidents, analysis of disputes and compliance with applicable obligations.

13.3. Personal data processed by STRIXS as Processor will be retained or deleted according to the lawful instructions of the Controller Customer, subject to the legal cases that authorize or require their retention.

13.4. Data subjects may request the deletion or anonymization of personal data by e-mail at privacidade@strixs.ai, subject to the responsibilities of the controllers involved.

13.5. After receiving a deletion request, the applicable steps will be taken to delete or anonymize the data, except when their retention is permitted or required by law.

13.6. Backups, technical records and security copies may be kept for limited additional periods, according to the needs of security, disaster recovery and compliance with legal obligations.

13.7. Termination of the contract will not imply immediate deletion of information whose retention is necessary to comply with legal obligations, ensure the security of operations or regularly exercise rights.

14. Data Subject Rights

Under the LGPD, data subjects may request, as applicable:

Requests may be sent by e-mail to: privacidade@strixs.ai.

CORA ASSIST LTDA may request additional information necessary to verify the identity of the requester and to prevent undue access.

When personal data are processed by STRIXS as Processor, the request may be forwarded to the responsible Controller Customer, without prejudice to the cooperation necessary for the exercise of the data subject's rights.

STRIXS will cooperate with its Customers to the extent of its legal and contractual duties.

15. Data of Children and Adolescents

STRIXS is a B2B technology platform and is not intended to be contracted directly by children or adolescents.

AI Agents integrated with the Platform may, depending on the activities of the respective Customers, transmit data related to children or adolescents.

In these cases, the Customer must ensure that there is an adequate legal basis for the processing, respecting the best interests of the child or adolescent and the other applicable legal requirements.

STRIXS will process such information only to the extent necessary for the authorized purposes and the activities under its responsibility, in compliance with the provisions of the LGPD.

16. Remuneration and Payment Data

The use of the STRIXS infrastructure may involve charges according to the prices, consumption units and other commercial conditions accepted by the Customer.

For the management of the contractual relationship and billing, registration data, tax information, contact data, consumption records and information necessary to process payments may be processed.

The processing of data related to STRIXS's remuneration is distinct from the processing of commercial or financial operations carried out by its Customers' AI Agents.

In integrations related to purchases, card tokenization or financial services, data processing will follow the responsibilities of the providers, merchants, financial institutions and other participants involved.

17. Cookies and Similar Technologies

STRIXS may use cookies and similar technologies on its website, dashboard or other digital interfaces to enable access, authentication, security, browsing preferences and performance measurement features.

These technologies may include:

The use of non-essential cookies, where it exists, will comply with the legal transparency requirements and the preferences or authorizations required from data subjects.

STRIXS will not use personal data processed in providing services to Customers for its own behavioral advertising purposes.

Third-party services accessed through the Platform may use their own cookies and other technologies, according to their respective privacy policies.

18. Communications

STRIXS may contact Customers and their representatives by e-mail or other contact channels provided in order to:

Commercial communications will comply with applicable law and the legitimate preferences of the recipients.

Where applicable, the recipient may request that non-essential promotional communications be stopped, without prejudice to the communications necessary to provide the services and comply with legal obligations.

19. Changes to this Policy

This Policy may be updated at any time to reflect changes to the Service, the technologies used, integrations, applicable law or the data processing practices of CORA ASSIST LTDA.

Relevant changes will be communicated by e-mail, WhatsApp message, notice on an official website or other reasonable means, at least 30 days in advance, where applicable.

The date of the last update will appear at the beginning of this Policy.

Continued use of STRIXS after the changes take effect will be considered acceptance of the new version of the Policy, where applicable.

20. Contact and Complaints

Questions, requests or complaints related to privacy and data protection may be sent to:

The data subject may also file a complaint with the Brazilian National Data Protection Authority — ANPD, through the official channels made available by the authority.