This document was written in Portuguese. Versions in other languages exist to make reading easier; in case of any discrepancy, the Portuguese version prevails.
01Who processes the data and in what role
This policy applies to the rhye.com.br website and to the Rhye platform. It follows Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and the guidance of Brazil's National Data Protection Authority (ANPD).
The website and the platform are operated by Rhai Inova Simples, a private legal entity registered under Brazilian CNPJ No. 61.202.205/0001-44, headquartered in Brusque, State of Santa Catarina, Brazil, referred to here as "Rhye".
Rhye acts in two different roles, and that changes who is accountable for what:
- As controller, for the data we collect on our own behalf: the contact details left on the website, the data of representatives and Users needed to manage the relationship with the client company (billing, support, communications) and the technical data from use of the website and the platform.
- As processor, for the data the client company enters into the platform about its employees, managers, candidates and other people. In that case, the company is the controller: it decides the purposes, the legal bases and which data goes in. Rhye processes that data only according to the company's documented instructions, under the terms of the agreement and the LGPD Compliance Agreement.
If you are an employee of a company that uses Rhye and want to exercise a right over your data, the first channel is the company itself, which is the controller. Rhye supports the company in handling the request and also receives your request, forwarding it to the company.
02Data we process as controller
Newsletter and website forms. When you subscribe to the newsletter, we store your email, name (optional), language and the source of the sign-up. In the design partners program application, we also store company, position, team size and, if you provide them, the tools you use and the context of your request.
Relationship with the client company. Name, corporate email, position and phone number of the representatives and contacts indicated in the agreement, used for onboarding, support, billing and communications about the service.
Technical data. Access and error logs (IP address, date and time, browser, pages or resources accessed), generated automatically for security, diagnostics and compliance with the Marco Civil da Internet.
Browser preferences. Chosen language and theme, kept in your browser's local storage. In the authenticated app, the session token and a cache of your basic profile data, so you do not have to sign in again on every page.
03Data we process as processor, on behalf of the client company
The client company decides what it enters. In general, the categories are these:
- Identification and contact: name, corporate email, phone number, CPF (Brazilian taxpayer ID), photo.
- Employment data: position, department, business unit, manager, hire date and, when the company chooses to enter them, compensation and benefits.
- Performance and development data: reviews, feedback, 1:1 notes, goals and OKRs, development plans, recognitions, behavioral assessment results.
- Recruitment data: resume, professional history, pipeline stages and selection notes.
- Platform usage data: actions taken, audit logs, conversations with Aeva.
Data subjects: the company's employees, managers and administrators; job candidates; former employees, when imported; and third-party contacts mentioned in records, where applicable.
Sensitive personal data is not envisaged as part of the service. If the company decides to enter data of that nature (health information in a leave record, for example), it must notify Rhye in advance and ensure a specific legal basis.
04What we use the data for and on what legal basis
As controller:
- Sending the newsletter and responding to contact requests: consent, which you can withdraw at any time.
- Evaluating and handling applications to the design partners program: pre-contractual steps, at your request.
- Managing the agreement with the client company, providing support and billing: performance of a contract and compliance with a legal obligation.
- Keeping access logs, preventing fraud and ensuring security: compliance with a legal obligation and legitimate interest in protecting the services.
- Measuring and evolving the product with aggregated and anonymized data: legitimate interest, without identifying individuals.
As processor: the purposes are those defined by the client company in the agreement, within the scope of the platform: organizational structure and positions, job descriptions, recruitment and selection, onboarding, reviews and calibration, feedback and 1:1s, development plans, climate and pulse surveys, recognitions, OKRs, people indicators and conversational assistance through Aeva. The legal basis is defined by the company, which is accountable for it.
We do not use the data for advertising, we do not sell personal data and we do not cross-reference data from different companies.
05Artificial intelligence
Aeva and the other AI features process personal data exclusively to generate answers, analyses, classifications and suggestions within the context of the client company itself, respecting the permissions of the person asking.
The client company's data is not used by Rhye, nor by the language model providers it contracts, to train, fine-tune or improve general-purpose artificial intelligence models. This is a contractual commitment with the providers.
The platform does not make solely automated decisions that produce legal effects or significantly affect people. Indicators, scores, predictive analyses and recommendations are decision support; the decision is human. Upon request from the client company, Rhye provides clear information about the criteria and data considered by those features, subject to trade and industrial secrets.
06Anonymous surveys and protection against re-identification
Responses to pulse surveys and to other surveys configured as anonymous are recorded without any recoverable link to the respondent, within the structure of the database itself, not merely hidden on screen. Results appear only in aggregate form and with a minimum number of responses.
The indicators calculated by the platform suppress results when a segment is small enough to identify someone. Rhye does not fulfill requests to identify respondents of anonymous surveys, and the client company commits, by contract, not to attempt to re-identify them.
07Who we share data with
We do not sell personal data. We share data only with those who need it for the platform to work, in the categories below, under contracts with data protection clauses:
- Cloud infrastructure provider: hosting of applications, databases, file storage and backups.
- Language model provider: processing of text and queries by Aeva and by AI-assisted features, with no use of the data for training.
- Transactional email provider: sending of invitations, notifications and platform communications.
- Google LLC (Google Calendar), only when the company enables the integration and each User individually authorizes, via OAuth, access to their own calendar for 1:1s and meetings.
- Monitoring and logging tool: error and uptime monitoring, with minimized data.
Some of these providers, in particular the cloud infrastructure, language model, and email providers, process data outside Brazil. These international transfers are made with the safeguards of art. 33 of the LGPD, through contractual data protection clauses. The up-to-date list of sub-processors is provided to client companies in the LGPD Compliance Agreement and upon request to the Data Protection Officer (DPO); additions and replacements are communicated in advance.
We may also share data when required by law, court order or a competent authority, notifying the client company unless prohibited by law.
08How we protect the data
- Encryption at rest in databases and backups, and in transit, with TLS, between the browser, internal services and providers. Keys are managed by a dedicated service of the cloud provider, with restricted access.
- Logical isolation per company: every query is bound to the authenticated User's organization, with no possibility of reading across clients.
- Role- and permission-based access control within the platform, configured by the company's administrator, with a chain of position, role and individual adjustments.
- Access by Rhye staff to production environments restricted by function, with individual credentials and periodic review. Human access to individual content only upon written request from the company, limited to what is necessary and logged.
- Audit log of relevant actions (creation, change, deletion, export), with author, date and time, available to the company's administrator.
- Separation between development, staging and production environments; real client data is not copied to development environments.
- Code review before release, continuous updating of dependencies and security fixes, and an incident response process.
- Rhye staff bound by confidentiality agreements and trained on data protection.
No system is infallible. If a security incident occurs that may cause relevant risk or harm to people, we notify the client company without undue delay, within the timeframes set out in the agreement, and the ANPD and data subjects when the law so requires, with the information already available and the measures taken.
09How long we keep the data
- Newsletter: for as long as you want to receive it. Every email includes an unsubscribe option, and a deletion request can be made through the contact at the end of this page.
- Design partners program applications: for as long as needed to evaluate and respond to the request and, if an agreement is signed, for its term.
- Client company data on the platform: for the term of the agreement. At the end, the company may request a full export in a structured format within 30 days. After that, and if no plan is subscribed, we delete the data from production environments within 30 days after the export period ends. Backups are deleted in the normal rotation cycle.
- Access records and technical logs: for the period required by the Marco Civil da Internet and for the limited period needed for security and diagnostics, as defined in the agreement with the client company.
- Data required by legal or tax obligations or for the exercise of rights in legal proceedings: for the corresponding statutory period.
11Your rights
The LGPD guarantees you, at any time and upon request, the rights under art. 18: confirmation that processing exists; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; portability; information about sharing; information about the option not to consent and its consequences; withdrawal of consent; and objection to unlawful processing.
For data that Rhye processes as controller (newsletter, forms, contractual relationship), write to the Data Protection Officer (DPO) through the contact at the end of this page. We respond within the statutory timeframes and may ask for information to confirm your identity.
For data entered into the platform by a client company, the request should be addressed to the company itself, which is the controller. If you write to us directly, we will forward the request to the company and support it in responding, through the platform's features or by direct assistance.
You may also file a complaint with the ANPD.
12Children and adolescents
The website and the platform are not intended for anyone under 18 years of age, and we do not knowingly collect data from children or adolescents. If we learn that this has happened, we will delete the data.
13Changes to this policy
We may update this policy to reflect changes in the product, in the law or in our practices. The current version, with the date of the last update, is always published on this page. Material changes are communicated to client companies through the contacts in the agreement and, where applicable, to newsletter subscribers.
14Data Protection Officer and contact
Rhye's Data Protection Officer (DPO) can be contacted at erickkbonfim@gmail.com, with the subject "Privacy". This is the channel for exercising rights, questions about this policy, incident notifications and requests from client companies about sub-processors and security measures.