Prodgy Privacy Policy
Last updated: October 22, 2025.
I. Definitions
Section titled “I. Definitions”For the purposes of this Privacy Policy, the following definitions apply, in accordance with the Brazilian General Data Protection Law (LGPD - Law nº 13.709/2018):
-
Sleeper Agent: malicious behavior of an AI model that is intentionally programmed to be activated only under specific conditions or inputs, making it difficult to detect in normal security testing.
-
User: natural person who uses the Software.
-
Personal Data: any information related to an identified or identifiable natural person.
-
Sensitive Personal Data: personal data about racial or ethnic origin, religious conviction, political opinion, union membership or membership in religious, philosophical or political organizations, data referring to health or sexual life, genetic or biometric data, when linked to a natural person.
-
Controller: The roles of Controller and Processor vary according to the Usage Modality, as detailed in the Terms and Conditions of Use. General Rule (SaaS/Self-Hosted): the Licensee is the Controller and Programmers is the Processor. However, in Trial mode, Programmers acts as Controller for research, development and product validation purposes.
-
Processor: Programmers, which processes personal data on behalf of the Controller. It is the natural or legal person, under public or private law, that processes personal data on behalf of the controller.
-
Anonymization: use of reasonable technical means available at the time of processing, through which data loses the possibility of association, direct or indirect, to an individual.
-
Purpose: the specific purpose for which personal data is collected and processed.
-
Risky AI Usage: misuse of the Software that constitutes negligent, intentional or malicious conduct and may lead to security vulnerabilities, ethical violations, inadequate access to sensitive data or actions that result in harm.
-
Free Trial (“Trial”): version made available for a limited time, exclusively for evaluation purposes, without guarantee of continuity, technical support or data preservation at the end of the usage period.
-
Software as a Service (“SaaS”): temporary and non-exclusive usage license, with cloud hosting, recurring payment and comprehensive infrastructure management, maintenance and updates under the responsibility of the Licensor.
-
Client Environment Implementation (“Self-Hosted”): corporate license installed on the Licensee’s infrastructure, with greater customization and shared responsibilities regarding security, availability and maintenance.
II. Data We Collect
Section titled “II. Data We Collect”The types of data collected and processed by Programmers on behalf of the Controller are:
Account Information
Section titled “Account Information”- Username
- Corporate email address
- Profile photo (if provided)
This information is provided by the Controller through integrations with authentication providers.
Usage Data
Section titled “Usage Data”- Access logs
- IP address
- Browser type
- Pages visited
- Resources used
- Date and time of activities
Device Data
Section titled “Device Data”- Device type
- Operating system
- Unique identifiers
- Language settings
This information is collected to optimize the User experience in the Software.
Log Information
Section titled “Log Information”- IP address
- Browser type
- Internet service provider
- Referral/exit pages
- Operating system
- Date/time and click data
This information is automatically recorded by our servers and is not linked to other information we collect about the User.
III. Cookie Usage
Section titled “III. Cookie Usage”IV. How We Use Data
Section titled “IV. How We Use Data”We use the collected data for the following purposes:
Provide and Improve the Software
Section titled “Provide and Improve the Software”- Operate the Software
- Provide Services
- Personalize User experience
- Improve functionality, performance and security
Communication
Section titled “Communication”- Send important communications
- Inform about Software updates
- Share information about new features
- Respond to support requests
Analysis and Research and Continuous Improvement
Section titled “Analysis and Research and Continuous Improvement”Security and Fraud Prevention
Section titled “Security and Fraud Prevention”Audit and Compliance
Section titled “Audit and Compliance”- Use usage data and Logs for monitoring
- Investigate and mitigate Risky AI Usage
- Detect ethical violations or conduct that violates these Terms
- Ensure compliance with data protection legislation
This constitutes legitimate interest and security measure.
V. Data Sharing
Section titled “V. Data Sharing”We share data with the following entities:
-
With the Controller: aggregated and anonymized usage data for reporting and analysis purposes, based on contractual obligation compliance.
-
With service providers: data with third-party service providers that assist us in providing Services, such as hosting and data analysis providers, under contractual security and confidentiality obligations.
-
For Legal purposes: We will share data if we believe in good faith that disclosure is necessary for compliance with legal or regulatory obligations (Art. 7º, II, LGPD), or for defense and exercise of rights in judicial, administrative or arbitral proceedings (Art. 7º, VI, LGPD); enforce our Terms and Conditions of Use; detect, prevent or address security or fraud issues; respond to support requests; or protect the rights, property or safety of the Licensor, Users and Licensee.
-
Marketing: only with explicit User consent, we may send marketing communications about our workspaces and services. Users may cancel receipt of these communications at any time.
At no time will User information be commercialized or transferred to third parties for advertising purposes or other unauthorized uses.
VI. Data Security
Section titled “VI. Data Security”We employ robust security measures to protect User data:
Advanced Encryption
Section titled “Advanced Encryption”- Data in transit: TLS/SSL Protocol
- Data at rest: AES 256 standard or higher
Access Control
Section titled “Access Control”- Strict access control
- Limited permissions to authorized users
- Multi-factor authentication when applicable
Data Protection
Section titled “Data Protection”- Regular backups to ensure integrity
- Constant system monitoring
- Detection and prevention of vulnerabilities
Team Training
Section titled “Team Training”- Regular training in information security practices
- Continuous awareness about data protection
VI.A. Security Incident Communication
Section titled “VI.A. Security Incident Communication”VII. Data Retention
Section titled “VII. Data Retention”We will retain User Data for the time necessary to fulfill the purposes described in this Policy, or as required by law or the License Agreement. After this period, data will be securely deleted or anonymized. Data retention criteria are based on collection purpose, legal requirements (e.g., Brazilian Civil Rights Framework for the Internet) and the minimum lifecycle essential for providing the contracted service.
In Trial mode, data will be automatically deleted or anonymized at the end of the trial period, according to the Controller’s retention policy for this mode, with no guarantee of backup or data recovery, as provided in the Terms and Conditions.
VIII. User Rights (Data Subjects)
Section titled “VIII. User Rights (Data Subjects)”Confirmation and Access
Section titled “Confirmation and Access”Right to obtain confirmation that your data is being processed and, if so, access the data and information about the processing.
Correction
Section titled “Correction”Right to correct incomplete, inaccurate or outdated data.
Anonymization, Blocking or Deletion
Section titled “Anonymization, Blocking or Deletion”Right to anonymize, block or delete unnecessary, excessive data or data processed in non-compliance with LGPD.
Portability
Section titled “Portability”Right to receive your data in structured and interoperable format, and to transmit it to another data controller.
Information about Sharing
Section titled “Information about Sharing”Right to obtain information about public and private entities with which your data is shared.
Consent Revocation
Section titled “Consent Revocation”Right to revoke consent for data processing, when processing is based on consent.
Opposition
Section titled “Opposition”Right to oppose data processing based on legitimate interest, if the processing does not serve your interests or fundamental rights and freedoms.
Review of Automated Decisions
Section titled “Review of Automated Decisions”Right to request review of decisions made solely based on automated processing of personal data that affect your interests.