← Ouvia
Português · English

Privacy Policy

Last updated: August 5, 2026

1. Who we are and scope of this Policy

Ouvia is a technology platform for creating, running, and analyzing research conducted by artificial intelligence agents. It is operated by SCALEMIND CONSULTORIA LTDA., Brazilian company registration number CNPJ 60.238.900/0001-01, with offices at Avenida Paulista, 726, Room 1202, Bela Vista, São Paulo, SP 01310-910, Brazil (“ScaleMind,” “Ouvia,” “we,” or “us”).

“Ouvia” is a product name and commercial brand used by ScaleMind. References to Ouvia do not represent that the trademark has been registered with any trademark office.

This Policy describes how we process personal data relating to:

This Policy should be read together with the Ouvia Terms of Use and, for a specific research project, the privacy notice or information provided by the Customer responsible for that project.

2. Roles of Ouvia and the Customer

Roles may vary depending on the processing activity.

2.1. Ouvia as controller or business

Ouvia acts as a controller, business, or equivalent entity when it determines the purposes and essential means of processing, particularly for:

2.2. Customer as controller or business; Ouvia as processor or service provider

For research content and data collected from Participants, the Customer normally acts as the controller or business because it determines the audience, script, questions, purposes, legal bases, eligibility rules, and use of the results.

Ouvia generally acts as a processor or service provider, processing data under the Customer's instructions to provide the contracted services. The Customer is responsible for giving Participants legally required notices, identifying an appropriate legal basis, and obtaining authorizations or consent when required.

3. Personal information we may process

3.1. Customer and Platform User information

We may process:

Full payment card information is processed by our payment provider and is generally not made available to Ouvia.

3.2. Participant information and Research Content

Depending on the Customer's script and configuration, we may process:

Ouvia does not require Participants, by default, to provide a name, national identification number, telephone number, email address, or other direct identifier. However, a Customer may include such information in a script, upload it to the Platform, or request it during a research session. In those cases, the Customer is responsible for the necessity, legality, and transparency of the collection.

The Platform may also record technical data strictly necessary for operation, security, and abuse prevention, such as IP address, access date and time, and basic device information.

3.3. Sensitive information

Research may involve health information, political opinions, religion, racial or ethnic origin, union membership, sexual life, genetic or biometric data, or other information treated as sensitive under applicable law.

Customers may collect sensitive information only when they have a legitimate purpose, an appropriate legal basis or consent, and safeguards proportionate to the risk. Ouvia processes that information as a processor or service provider unless applicable law imposes a direct obligation on Ouvia.

4. Sources of information

We may obtain information:

5. How we use information

When Ouvia acts as controller or business, we may use information to:

For Research Content processed on behalf of a Customer, the Customer determines the purposes and legal basis. Ouvia processes the content under the Customer's documented instructions, subject to applicable law.

6. Artificial intelligence, recordings, and analytics outputs

Ouvia uses artificial intelligence agents to conduct voice or text interviews, interpret responses, create transcripts, and generate summaries, classifications, topics, metrics, and other analytical outputs.

Research Content, including audio, responses, and transcripts, is not used by Ouvia to train general-purpose artificial intelligence models or to improve third-party AI products or models.

Ouvia may use aggregated operational statistics designed not to identify Customers or Participants, such as the number of research projects, average duration, feature usage, completion rates, and processed volume. These statistics are used for operations, capacity planning, security, billing, business reporting, and understanding service usage—not to train models on interview content.

AI-generated outputs may contain errors, omissions, bias, or inappropriate interpretations. Customers should review outputs before using them for material decisions. Ouvia does not make decisions about Participants on behalf of Customers.

7. Recording notices and Customer responsibilities

For recorded interviews, the Customer must ensure that, before or at the beginning of the recording, the Participant receives clear information about:

Ouvia may provide notice tools, but the Customer is responsible for reviewing the notice, adapting it to the project, and ensuring the legality of recording and processing.

8. How we disclose information

Ouvia does not rent personal information. We disclose information only as reasonably necessary to the following categories:

8.1. Hosting and infrastructure

We use virtual private server (VPS) infrastructure located in São Paulo, Brazil, to host Platform components, databases, and files, depending on the technical architecture.

8.2. Artificial intelligence agent providers

We use specialized providers of AI agents, voice processing, transcription, natural language processing, and related storage. These providers may process and store audio, transcripts, metadata, and instructions needed to deliver the service.

8.3. Google Analytics and Google Ads

We use Google Analytics to understand how visitors and Users interact with the website and certain Platform areas, and Google Ads to run and measure advertising campaigns (Search, YouTube, and remarketing). These services may process cookie identifiers, session statistics, approximate geolocation, and browser and device information. We do not intend to send Research Content, audio, transcripts, names, email addresses, telephone numbers, tax identifiers, or other direct identifiers to these tools.

8.4. Meta and LinkedIn (advertising)

We use the Meta Pixel (Facebook/Instagram) and the LinkedIn Insight Tag to measure and optimize advertising campaigns on their respective networks. These services may process cookie identifiers, on-site navigation events, and browser and device information, associated with the ad that led to the visit. We do not intend to send Research Content, audio, transcripts, names, email addresses, telephone numbers, tax identifiers, or other direct identifiers to these tools.

8.5. Payment and business providers

We may disclose necessary information to payment providers, currently including Stripe, and to providers of email, authentication, support, accounting, audit, security, and professional consulting services.

8.6. Authorities and corporate events

We may disclose information to comply with law, valid legal process, or a government request; investigate fraud or incidents; protect rights and safety; or complete a merger, financing, acquisition, restructuring, or asset transfer, subject to applicable safeguards.

Vendors receive only the information needed for their functions and are subject to contractual confidentiality, security, and data protection obligations appropriate to their services.

9. International data transfers

Although Ouvia's primary infrastructure is located in São Paulo, some providers—particularly AI-agent, analytics, advertising (Google, Meta, LinkedIn), payment, support, or security providers—may process information in other countries.

For information subject to Brazilian data protection law, we use an applicable transfer mechanism, such as contractual safeguards, approved standard contractual clauses, an adequacy decision, or another legally permitted mechanism.

10. Cookies and advertising pixels

Ouvia may use:

Where required by applicable law, non-essential cookies and pixels will be activated only after the User makes a choice in the cookie notice shown on the website. Users may review or withdraw permission at any time, without affecting processing that occurred before withdrawal.

Users may also delete or block cookies in browser settings. Blocking necessary cookies may impair Platform operation.

Ouvia does not use Research Content for behavioral advertising and should not configure Google Analytics, Google Ads, the Meta Pixel, or the LinkedIn Insight Tag to receive personally identifiable information from research sessions.

11. Retention, cancellation, backup, and deletion

11.1. Active accounts

While a Customer account is active, account information, Research Content, audio, transcripts, analyses, and reports may be retained to provide the contracted features, subject to purpose limitation, necessity, and the Customer's instructions.

Tax, financial, security, fraud-prevention, and legal-defense records may be retained for applicable legal or limitation periods after account closure.

11.2. Cancellation and 30-day period

After a subscription ends or an account is cancelled, the Customer has 30 days to request a backup or export of available data.

Privacy rights requests are free. Additional business services for preparing, consolidating, migrating, converting, or specially delivering a full account backup may be subject to a fee disclosed in advance.

After the 30-day period, Ouvia may begin deleting or de-identifying account data from active systems and instruct relevant providers to discontinue active storage, except for:

11.3. Requests during an active account

The absence of an automated deletion button does not prevent the exercise of privacy rights. Access, correction, restriction, de-identification, or deletion requests may be submitted to the privacy channel.

When Ouvia acts as a processor or service provider, a request may be referred to the Customer, and Ouvia will provide reasonable technical assistance.

12. Security

We use technical and organizational measures reasonably proportionate to processing risks. Measures may include access controls, authentication, credential management, activity logging, backups, logical separation, system updates, monitoring, and protected communications.

No system is completely secure. Customers must protect credentials, restrict access, configure permissions, and notify us promptly of suspected unauthorized use.

13. Privacy rights

Depending on applicable law and Ouvia's role, individuals may have rights to:

We may request information to verify identity and prevent unauthorized disclosure. For Research Content, please provide the Customer name, research title, link used, approximate date, and other details that help locate the record.

14. Children and teenagers

Ouvia accounts are intended for individuals who are at least 18 years old or have authority and legal capacity to contract for an organization.

Customers must not conduct research involving children or teenagers without complying with applicable child privacy requirements, age-appropriate transparency, best-interest standards, and parental or guardian involvement.

For U.S. Participants, Customers must not knowingly use Ouvia to collect personal information from children under 13 unless Ouvia has provided prior written authorization and COPPA-compliant procedures, including verifiable parental consent where required, have been implemented.

15. Participant incentives and payments

Audience selection, invitations, eligibility, research logistics, incentives, prizes, reimbursements, and payments promised to Participants are solely the Customer's responsibility.

Ouvia is not a party to the payment relationship, does not guarantee incentives, and is not responsible for disputes regarding eligibility, amount, timing, taxes, or payment method unless a separate written agreement expressly states otherwise.

16. Supplemental U.S. State Privacy Notice

This Section provides additional information for U.S. residents where state privacy law applies. Applicability depends on legal thresholds, the individual's relationship with Ouvia, and the nature of the processing.

16.1. Categories and purposes

During the preceding 12 months, Ouvia may have collected the categories described in Section 3, including identifiers, customer records, commercial information, internet or electronic activity, approximate geolocation, audio information, professional information, inferences or analytics, and sensitive information contained in Research Content.

Sources, business purposes, and recipient categories are described in Sections 4, 5, and 8. We retain information according to Section 11.

16.2. Sale, sharing, and targeted advertising

Ouvia does not sell Research Content for money and does not use Research Content for cross-context behavioral or targeted advertising.

Website identifiers may be processed through Google Analytics, Google Ads, the Meta Pixel, and the LinkedIn Insight Tag for advertising measurement. Where applicable law treats this processing as a sale, sharing, or targeted advertising, Users may exercise an opt-out through our cookie controls (declining the cookie notice prevents these pixels from loading) or a recognized universal opt-out signal, such as Global Privacy Control, when technically and legally applicable.

16.3. State privacy rights

Depending on applicable state law, a U.S. resident may have the right to:

Requests may be sent to dpo@ouvia.io. We may verify identity and, where permitted, accept an authorized agent's request. We will respond within the period required by applicable law and provide appeal instructions when required.

17. Changes to this Policy

We may update this Policy to reflect legal, regulatory, technical, or operational changes. The last-updated date appears at the beginning. Material changes may be communicated through the website, Platform, or email.

18. Contact

Privacy email: dpo@ouvia.io