Lupa CuboPlus Privacy and Data Use Notice

Courtesy translation. This text translates the Portuguese original. The Portuguese version is the legally binding one and prevails in case of any divergence.

This Notice explains how end users' personal data is processed in Lupa CuboPlus ("Lupa"), under Law No. 13.709/2018 (LGPD, the Brazilian General Data Protection Law). Each party's role depends on the purpose: regarding the content of queries, your Organization is the controller and Cubotimize is the processor; regarding the platform's usage, billing and security records, Cubotimize is the controller. Section 1 details both.

1. Roles (controller and processor)

The role depends on the purpose, and there are two.

Regarding the content of queries and access to the data in the Qlik apps:

• Controller: your Organization decides why and how data is processed in Lupa: which Qlik apps are made available, who gets a seat, which fields are blocked and which limits apply.
• Processor: Cubotimize Soluções em Inteligência Tecnológica LTDA ("Cubotimize") processes this data only according to the Organization's instructions, does not use it for its own purposes, does not sell it and does not use it to train models.

Regarding the usage, billing and security records of the platform itself:

• Controller: Cubotimize. This is data it decides to collect to measure usage, control licenses and protect the service, with the retention periods in section 9.

Declaring both roles is more honest than declaring only the first: whoever sets retention periods and uses the usage record for billing is deciding purposes, and that is the role of a controller, whatever the label in the contract.

2. The architecture already limits what can be processed

Before the list of data, the product's design, because it answers half of the privacy questions:

• Lupa does not open connections from the outside into your Organization's network. The one talking to the Qlik server is the user's own browser, from inside the network.
• The language model receives only metadata and aggregated results. App metadata (field names, measures, dimensions, expressions) and results already aggregated by the Qlik Engine, limited to at most 200 rows per query. Lupa does not send tables or extracts of the source data, and there is no tool that reads table rows.
• The choice of query dimensions belongs to whoever asks, and that is why there is a lock. Aggregating by a field that identifies a person would return one row per person, even though the query is aggregated. To prevent that, your Organization defines which fields identify a person (employee number, CPF, the Brazilian taxpayer ID, name) and Cubotimize registers them in the operations panel, per app or for all apps, as blocked fields. From then on the service refuses any calculation that uses them as a dimension or inside an expression, before the query goes out. It is a refusal in code, not an instruction to the model. The current list can be checked upon request.
• Lupa inherits the user's Section Access: it does not reach data the user could not already reach on their own.
• By design, there is no patient, customer or identifiable individual data in Lupa's records.

3. Personal data processed

The only personal data processed by Lupa is the user's identification in Qlik, plus the technical data needed for operation and auditing:

What is explicitly not processed

• We do not store the text of questions or answers on our servers. The usage record is quantitative.
• The conversation stays only in the user's browser memory, in the extension's private area, without being written to disk, so that reloading the Qlik page does not lose the context. It is never uploaded to our servers and is deleted when the browser is closed, 10 hours after the last message (one workday), when another user signs in to Qlik in the same browser or, right away, with the clear conversation button. See the Cookie Policy.
• We do not store the data returned by the Qlik Engine. It travels through the user's browser and the gateway during the answer and is not persisted.
• We do not use advertising cookies or marketing trackers.
• There is no personal data in query strings: everything travels in the request body.

Recording the content of questions and answers is a separately contracted option, which requires a contract amendment with the Organization, a defined retention period and an updated version of this Notice. It is not implemented.

4. Purposes

• Enable answers to the user's questions about the authorized Qlik apps.
• Control the license, seats and usage limits contracted by the Organization.
• Measure usage for cost management by the Organization.
• Notify the Organization's managers by email when the questions contracted for the month are running out or have run out: at most three notices per month. The notice contains only the quantities (contracted, used and remaining), and never who asked or what was asked.
• Security, detection of unauthorized use and proper operation of the service.

5. Legal basis

The legal basis follows the role in section 1.

Content of queries and data in the Qlik apps: the legal basis is defined by your Organization, which is the controller of this processing.

Usage, billing and platform security records, for which Cubotimize is the controller:

• Performance of a contract between Cubotimize and your Organization (art. 7, V), to measure the usage billed, apply the contracted quota and notify managers when it is running out; and
• Legitimate interest of Cubotimize in protecting the service against unauthorized use (art. 7, IX, and art. 10), with a documented legitimate interest assessment available to your Organization upon request.

Lupa is not intended to process sensitive personal data (art. 11 of the LGPD). This rests on a technical control, and not only on this sentence: the result is always aggregated, and the fields your Organization defines as blocked are refused before the query goes out (section 2). The only point that depends on guidance is the text of the question: do not write personal data in it.

6. Sharing

• Your Organization (authorized managers) accesses the usage and event records through the portal.
• Language model providers receive the user's question, the app metadata and the aggregated results, never rows of source data. The provider in use is configurable and disclosed to the Organization.
• Strictly necessary infrastructure (hosting, database, network).
• We do not sell data and do not use it for advertising or model training.

7. International transfer

Language model provider. Lupa currently uses Google Gemini, from Google. The provider in use is disclosed to the Organization, appears in the administration panel and may be changed with notice. The provider's commercial terms are attached to the contract, with the commitment not to use the content of requests to train or fine-tune models.

⚠️ That commitment is the provider's, not Cubotimize's: the provider processes the request, and its obligation is what matters for your Organization to assess.

Where the data is kept. Lupa's database (licenses, seats and the usage, event and installation records) and the application servers (the service that talks to the model and the management portal) are in Brazil. Two stages are not restricted to Brazil:

• processing by the language model, done on the provider's infrastructure, in a global region: the question, the app metadata and the aggregated results may be processed outside Brazil;
• the traffic protection network (Cloudflare), which is global by design and serves each request from the nearest point.

International transfer. Because of the model processing, there is a transfer outside Brazil. It is based on art. 33, II, "b", of Law 13.709/2018: the standard contractual clauses approved by the ANPD (the Brazilian data protection authority), which are part of Google's data processing addendum for the paid Gemini API services (Appendix 3C, dedicated to the LGPD).

What the provider keeps, and for how long. Lupa uses the paid Gemini API. Under it, Google does not use prompts or responses to improve its products. It keeps prompts and responses for 55 days, only to detect and prevent violations of its usage policy, and in that control authorized Google staff may review flagged content. The fixed context Lupa keeps cached at the provider (instructions and app metadata, with no user question) expires after 15 minutes without use. The whole path, from the browser to the service and from the service to the provider, is encrypted in transit (TLS).

The provider's documents, in their current version, straight from the source:

• Gemini API Additional Terms of Service, in the part on paid services;
• Google's data processing addendum as a processor, with Appendix 3C (LGPD) and the Brazilian standard contractual clauses;
• Services covered by the addendum, which lists "Gemini API Paid Services";
• Gemini API abuse monitoring, with the 55-day period.

Since what is sent to the model is restricted to metadata and aggregates, the exposure is limited to the text the user writes in the question. The Organization should instruct its users not to write personal data in the text of the question.

8. Data subject rights (art. 18 of the LGPD)

You may request confirmation, access, correction, deletion, portability, information about sharing and review of automated decisions. Since the controller is your Organization, exercise these rights preferably with it (manager, HR or the Organization's data protection officer/DPO). Cubotimize supports the Organization in responding.

9. Retention

The three periods below have a daily automatic purge routine.

• Event records (access refusals, with origin): 12 months.
• Usage records (consumption, cost and latency, with no question or answer): 24 months.
• Installation records not assigned to a license: 30 days from that installation's last contact with the service.
• Seat registry: for as long as the seat lasts; deactivation preserves the usage history already recorded.
• Longer periods only upon instruction from the Organization or legal obligation.

The Organization may request deletion before the period ends through the channel in section 12.

10. Security

• TLS on all transport; database connection over TLS.
• License key stored only as a SHA-256 hash: the raw key is never persisted or logged.
• Tenant isolation in the database (RLS), and not only in the application.
• Authentication by short-lived token, revalidated on every request and renewed every 7 days.
• Audit trail of access and security events.
• Support access to data is restricted and logged.

11. Automated decisions

Lupa does not make automated decisions with legal effect or impact on people. It presents numbers and explanations; the decision is always human.

12. Contact

• To exercise rights over the content of queries and the data in the Qlik apps, contact your Organization first, as it is the controller of that processing.
• To exercise rights over the usage, event and installation records, for which Cubotimize is the controller, write to the data protection officer at the address below. We respond clearly and completely within 15 days, the period set by art. 19, II of the LGPD.
• Questions about Lupa's operation: [email protected], or the product channel, [email protected].
• Cubotimize's data protection officer (DPO): Renato Freitas, [email protected].

Version history

A privacy notice applies in the version in force at the time of processing. That is why every change to the text changes the version and the date, and previous versions remain published.

Who operates Lupa