Privacy Policy

PRIVACY NOTICE

NOOU.AI

Last updated: May 5, 2026

BY ACCESSING, USING, OR REGISTERING ON THE APPLICATION AND/OR WEBSITE OF “NOOU.AI” (“Platform”), PROVIDING PRODUCTS OR SERVICES, RELATING TO, AND/OR BENEFITING, DIRECTLY AND/OR INDIRECTLY, FROM THE SERVICES (Services) OF NOOU IA LTDA., A PRIVATE LEGAL ENTITY, REGISTERED WITH THE CNPJ/ME UNDER NO. 63.362.293/0001-77, HEADQUARTERED AT RUA BANIBAS, Nº. 415, SALA 01, ALTO DE PINHEIROS, SÃO PAULO - SP, CEP: 05.460-010 (“Company”), YOU DECLARE THAT YOU ARE AWARE OF AND FULLY UNDERSTAND THE TERMS OF THIS PRIVACY NOTICE (“Privacy Notice”).

For the purposes of this Privacy Notice, “Data Subject” means any natural person who accesses the Platform and/or who relates, directly or indirectly, to the Company. The Company, in most operations, acts as the “Controller”, being responsible for decisions regarding the processing of personal data carried out directly and/or indirectly by the Company.

Among other individuals who may relate to the Company, the following are considered Data Subjects: clients, legal representatives of clients and service providers, partners, vendors and service providers, prospects, and users of the Platform.

If you are using the Platform and/or relating to the Company on behalf of an entity and/or legal entity, you guarantee that you are authorized and have all necessary powers to take notice of and accept this Privacy Notice on behalf of the respective entity and/or legal entity, and you guarantee that the entity and/or legal entity you represent agrees to indemnify the Company for any violation of this Privacy Notice committed by you.

If the Platform and/or the Company's Services are used in any way by minors (under 18 years of age), the processing of personal data of these minors must be authorized by their legal guardians, who must be aware of and agree to the terms of this Privacy Notice.

1. About the Platform and Services

Noou.ai is a digital platform that integrates and makes available third-party artificial intelligence systems to support design teams at all stages of their work, from research and strategy to product and service delivery.

Through the Platform, users can create and organize prompts, rely on specialized AI assistants, access reference libraries, and collaborate with other team members in an integrated environment. The purpose of Noou.ai is to make the creative process more agile, structured, and efficient for design professionals and teams.

2. Data Protection Officer (DPO)

The Company appoints the individual qualified below to the position of “Data Protection Officer (DPO)” (Encarregado), who will then be responsible for assisting and guiding Data Subjects in all matters relating to this Privacy Notice or the processing of personal data carried out by the Company, as well as acting as a communication channel between Data Subjects, the Company, and the National Data Protection Authority (ANPD).

Data Protection Officer (DPO):
Full Name: Fernando Babadopulos
E-mail: privacy@noou.ai

3. Data Processing

To access and use the Platform and/or relate to the Company, the Data Subject will need to provide certain information to the Company, which is essential for the functioning of the Platform and/or for the Company's activities. Thus, the following personal data, among others necessary for the Company's activities (including due to legal or regulatory obligations), will be collected and processed:

1. If the Data Subject is a user registered on the Platform, as well as a client or legal representative of a client:

• Name

• Corporate e-mail

• Telephone number

• CPF (Taxpayer Registry Number)

• Linked company

• Login data

• History of prompts and contents inserted into the Platform

By accessing or using the Platform and/or Services, you, as a Data Subject, are aware - as a natural person and, whenever applicable, also as a representative of a minor, legal entity, or entity represented by you - of the processing of the data listed above, and declare that when providing data of third parties, whether personal or not, on the Platform (directly or by inserting documents containing such data) and/or to the Company, such availability complies with the terms of the legislation in force and does not violate third-party rights, taking responsibility for any and all claims or damages arising from the processing of personal data inserted by you on the Platform (directly or by inserting documents containing such data) and/or provided, in any way, to the Company.

The Company may also obtain your data when you use other Services of the Company and/or its respective affiliates (e.g. events, alumni activities, etc.).

The Company may also collect personal data of the Data Subject from third-party databases, which may or may not be public. The Company may combine this data with existing information it holds about the Data Subject or use it independently.

4. Purposes and Use of Data

This Privacy Notice lists below the main situations in which - and the purposes for which - the data of Data Subjects, as well as third-party data collected in any way by the Company, are used:

Services: (a) registration and identification of users and other interested parties, including to enable access to the Platform; (b) provision and management of the services made available on the Platform, including the operation of AI assistants, prompt management, reference libraries, and collaboration tools, as well as data analysis for personalization, performance, and continuous improvement of the features offered; (c) execution of administrative and financial routines, such as risk and anti-fraud analysis, registration validation, invoicing, collection, reconciliation, and payment processing; (d) ensuring the security of the Platform and operations, including usage monitoring, fraud prevention, identity validation, and data verification; (e) sending operational and informative communications related to the contracted services, Platform updates, security alerts, commercial opportunities, and other relevant information to users; and (f) service and communication with users and interested parties, including to respond to requests, provide support, manage complaints, and maintain the commercial relationship.

Use of the Platform: The Company will use personal data to: (a) facilitate the identification of the Data Subject on the Platform; (b) provide the necessary interactivity on the Platform; and (c) operate and improve the Platform.

Consumption Profile Study: The Company will use personal data to understand the consumption profile of Data Subjects and clients and their needs to improve its products and services.

Advertising: The Company may use personal data to: (a) send marketing e-mails, including newsletters, relating to the Platform, the Services, or the Company and/or companies in the same economic group as the Company; (b) display and/or send advertisements that are compatible with the Data Subject's profile, and such advertisements may refer to the Platform, the Company, and/or third parties. If the Data Subject is no longer interested in receiving advertisements, the Data Subject must contact the DPO, informing them that they no longer wish to receive communications of an advertising nature.

Activities of Data Subjects on the Platform: The Company records access and usage data of the Platform when Data Subjects access or use the Platform in any way. The Platform uses access information, cookies, device information, and IP (Internet Protocol) addresses to identify Data Subjects or record their use of - or activity on - the Platform, as well as to ensure the security of Data Subjects.

Storage and Backup: The Company makes backup copies of information relating to the Platform, the Services, and the Company, which may include personal data.

5. Cookies and Similar Technologies

The Platform may use cookies or other technologies to ensure the security of Data Subjects. Cookies are small text files stored in your computer's memory. A cookie contains information that can be read later by a server located in the domain that issued it. The information that cookies collect includes, among others, the date and time of the Data Subjects' visit, Data Subjects' browsing history, etc.

Cookies bring several benefits, as they allow the identification of returning Data Subjects when they come back to the Platform, enabling their direction to personalized content and/or similar services and products. Cookies also save time, making it unnecessary to enter the same information multiple times.

6. Duration of Data Processing

Personal data will be processed by the Company as long as the purposes indicated in this Privacy Notice persist and/or there is a need to maintain them, such as, for example, to respect legal retention periods, including those described in Law No. 12,965/14 (Brazilian Internet Bill of Rights / Marco Civil da Internet) and Decree No. 8,771/16, or for compliance with applicable legal or regulatory obligations.

Once the purpose or legal necessity is exhausted, the data will be deleted through secure disposal methods, or anonymized for purely statistical purposes.

7. Responsibilities and Declarations of the DATA SUBJECT

The Data Subject declares and acknowledges that, by making data available, including personal data of third parties, on the Platform and/or to the Company (directly or by inserting or making available documents containing such data):

• previously informed the respective third parties and took all necessary measures so that the third parties were aware of the processing of their personal data by the Company;

• in the case of inserting personal data of minors, notified and previously obtained the consent of the legal guardians regarding the processing of such data by the Company;

• in the case of inserting sensitive personal data (racial or ethnic origin, religious conviction, political opinion, affiliation to a union or to a religious, philosophical, or political organization, data referring to health or sex life, genetic or biometric data, when linked to a natural person, etc.), notified and previously obtained the consent of the Data Subjects of such data regarding the processing of said data by the Company;

• the information made available to the Platform, including any personal data, is complete, true, and updated, and does not violate any third-party rights or applicable legal rules.

If the above statements are not entirely correct and/or the obligations assumed herein are not properly fulfilled, the Data Subject takes exclusive and full responsibility for any damages caused to the Company or to any third parties.

The Data Subject is responsible for the activities they perform on the Platform or for the information, including personal data, that they insert into the Platform (directly or by inserting documents containing such data) and/or make available to the Company.

In the event that the Company is sued, at any time, due to facts or acts whose responsibility is attributed to the Data Subject under this Privacy Notice, the Data Subject, as well as the minor, entity, or corporation they represent, will be jointly liable and must: (a) voluntarily intervene in the lawsuit, requesting the immediate exclusion of the Company from the litigation, (b) assume full and exclusive responsibility for the payment and/or remedies claimed, and (c) fully reimburse the Company for costs and expenses incurred as a consequence of the lawsuit. If such exclusion does not occur, the Data Subject, the minor, and/or the entity or corporation that the Data Subject represents, will be responsible for the payment and full compliance with the decision or, if applicable, must immediately reimburse the Company.

8. Data Sharing

This Privacy Notice indicates below the situations in which the personal data of Data Subjects, as well as the personal data of third parties inserted into the Platform in any way by Data Subjects, will be shared by the Company:

Group Companies: The Company may share information, including personal data of Data Subjects and third parties, with affiliates and companies in the same economic group whenever such sharing is important for the operation of the Platform, for the provision of the Services, for compliance with legal or regulatory obligations, and/or is in the interest of the Data Subject.

Corporate Transactions: As a result of any corporate restructuring operations, mergers, acquisitions, consolidations, and the like, the Company may share or even transfer information, including personal data of Data Subjects and third parties, to the natural or legal persons involved in the transaction in any way.

Partners and Service Providers: The Company may share information, including personal data of Data Subjects and third parties, with: (a) technology providers, responsible for systems, software, storage, and data processing; (b) consultants and specialized service providers, including for operational, regulatory, and information security support; (c) financial institutions and partners involved in administrative and financial activities; and (d) companies, organizations, or individuals that perform services on behalf of the Company.

Fraud Prevention and Security: The Company may disclose or share information, including personal data of Data Subjects and third parties, if it believes, in good faith, that access, use, preservation, or disclosure of the information is reasonably necessary to (a) detect or prevent fraud, as well as resolve technical or security issues, and; (b) ensure the security of the Platform, the Company, Data Subjects, and third parties. In this case, data and information may be shared with third parties responsible for the investigation, including judicial bodies, authorities, and information technology or information security companies.

Lawsuits and Investigations: The Company may disclose or share information, including personal data of Data Subjects and third parties, with authorities and/or public bodies, regulatory agencies, legal authorities (e.g. regional police stations), autarchies, consumer defense bodies, government and judicial bodies, and/or lawyers in the following cases: (a) to comply with a court order or government request; (b) to safeguard the rights and prevent liabilities of the Company; (c) to investigate, prevent, or take measures related to illegal, suspected, or actual activities, or to cooperate with public bodies; and (d) to investigate possible violations of the rights of the Company and/or third parties.

Compliance with Legal or Regulatory Obligations: The Company may disclose or share information, including personal data of Data Subjects and third parties, to comply with legal, regulatory obligations, or any other determination before government and judicial bodies, including, but not limited to, Government Ministries and/or Secretariats, federal autarchies, regulatory agencies, and/or legal authorities (e.g. Federal Revenue Secretariat), consumer defense bodies, judicial bodies, and others.

9. PROCESSING AGENTS

Any and all corporations, public or private entities, authorities, bodies, agencies, and/or persons who have access to the personal data of Data Subjects and/or third parties, in accordance with the situations provided for in the chapter “Data Sharing”, will assume the position of processing agent and will be obliged, under the terms of the applicable legislation and/or contracts signed with the Company, to adopt the best security and governance practices regarding the protection and processing of the personal data to which they have access.

10. INFORMATION SECURITY

Information security is very important to the Company. The Company follows industry security standards to help protect information entered into the Platform or obtained in any way by the Company. However, there is no method of electronic storage that is totally secure. THEREFORE, ALTHOUGH WE STRIVE TO PROTECT THE INFORMATION PROCESSED BY THE COMPANY, WHICH INCLUDES PERSONAL DATA, WE CANNOT GUARANTEE ABSOLUTE SECURITY.

The Company will store the personal data of Data Subjects and third parties in a secure environment, committing to adopt reasonable administrative and technical precautionary measures to avoid losses, abuses, alterations, or unauthorized access related to this data.

11. Links

The Data Subject agrees not to hold the Company liable for losses, damages, or other problems of any kind that may arise from the use of websites that contain links to the Platform or whose links are available on the Platform, and is aware that such websites may not adopt appropriate practices regarding the processing of personal data and privacy of Data Subjects.

12. Control of Your Data

The Company will make means available so that Data Subjects can access, correct, delete, or modify the data that was inserted by them into the Platform and/or made available to the Company, and can request the correction, deletion, or modification of their respective personal data. The options for Data Subjects of personal data are listed below:

Confirmation of the existence of processing: Data Subjects of personal data may request confirmation regarding the existence of processing of their personal data.

Right to access your data: Data Subjects of personal data may request a copy of the processed data, which will be made available in a readable and electronic format.

Alteration or correction of data: Data Subjects of personal data may request updates, alterations, or corrections of their data in certain cases, especially if the said data is incorrect or outdated.

Deletion, blocking, and/or anonymization of data: Data Subjects of personal data may request the deletion of their data from the Platform and the Company's repositories without the need to present any justification, as well as request the deletion, blocking, and/or anonymization of said personal data.

Portability: Data Subjects of personal data may request the portability of their data to another service or product provider.

Information about data sharing: Data Subjects of personal data may request information about the public and/or private entities with which the Company shared their personal data.

Information about consent: Data Subjects of personal data may request information about the possibility of not providing consent in specific situations and about the consequences of not providing consent.

Revocation of consent: For cases in which Data Subjects granted consent to the Company for the processing of their personal data, Data Subjects may, at any time, revoke this consent.

Channels to exercise your rights: To exercise the rights listed above, Data Subjects of personal data must direct their request to the DPO. In the said request, it must include: (a) the qualification of the Data Subject (full name and email) of the personal data; (b) the specification of the measure that the Data Subject intends in relation to their personal data, and; (c) if applicable, the specification of the data that is the object of the request. Within 15 days, if the law does not establish a different period, the DPO will respond to the request of the Data Subject of personal data: (a) communicating the fulfillment of the request; (b) presenting a justification, if it is not possible to comply with the request, or; (c) estimating a new period to fulfill the request and the justification relating to the extension of the period.

There are situations in which the Company will need to maintain or cannot alter personal data and, for such reason, cannot fully meet the requests you make, even if the rules above are observed (e.g. when the maintenance of personal data proves necessary for compliance with legal obligations or to comply with a court order).

The Data Subject must immediately inform the Company, through the DPO, when the Company's cooperation is necessary to alter, update, complement, correct, or delete personal data that was made available on the Platform and/or to the Company. The Data Subject must provide all relevant information so that the Company can take the necessary measures within a reasonable period.

13. Claiming Rights

If a Data Subject of personal data believes that the Platform and/or the Company violates their rights and/or their privacy, including regarding the processing of personal data, they may communicate with the Company through the DPO.

Nothing written in this Privacy Notice is intended to exclude or limit any condition, warranty, right, or liability that cannot be legally excluded or limited. Some jurisdictions do not allow the exclusion of certain warranties or conditions or the limitation or exclusion of civil liability. Consequently, only the limitations that are permitted by law in your jurisdiction will apply to you.

14. Cross-Border Data Transfer

THE COMPANY PROCESSES DATA, INCLUDING PERSONAL DATA, WITHIN BRAZIL AND IN OTHER COUNTRIES. IT IS POSSIBLE THAT SOME OF THE COUNTRIES IN QUESTION HAVE LESS PROTECTIVE LAWS REGARDING PRIVACY AND/OR PERSONAL DATA, OR DO NOT EVEN HAVE SPECIFIC REGULATION ON THE SUBJECT.

YOU ARE AWARE OF AND AGREE THAT YOUR PERSONAL DATA AND THE PERSONAL DATA OF THIRD PARTIES INSERTED BY YOU ON THE PLATFORM OR MADE AVAILABLE TO THE COMPANY MAY TRANSIT THROUGH - OR RECEIVE TREATMENT IN - OTHER COUNTRIES.

15. Amendments, Validity, and Effectiveness of Clauses

A waiver or amendment of any provision of this Privacy Notice will only take effect if presented in writing and signed by the legal representatives of the Company. If any provision of the Privacy Notice is invalidated or considered inapplicable, the remaining provisions, whenever possible, will remain valid and effective.

The Company reserves the right to amend the Privacy Notice, as well as any policy or document, at any time and at its sole discretion.

The amendments will enter into force at the time of their respective publication on the Platform. The use of the Platform, the Services, or the maintenance of a relationship with the Company after publication will constitute awareness of any changes to the Privacy Notice. Therefore, we advise Data Subjects to reread the Privacy Notice frequently.

As far as there is a conflict between the content of this Privacy Notice and that contained in another document(s) signed between the Data Subject and the Company, the content of the other document(s) signed by the Data Subject shall always prevail.

16. Applicable Law, Disputes, and Controversies

Any dispute related to this Privacy Notice must be submitted to the Courts of the Judicial District of São Paulo, State of São Paulo, Brazil, which shall prevail over any other, no matter how privileged it is or may become, and will be judged exclusively in accordance with the laws of the Federative Republic of Brazil.

17. Questions and Clarifications

Questions, requests, complaints, and comments about the Platform or about the Privacy Notice may be directed to the Data Protection Officer (DPO).