Privacy Policy

1. Who is the data controller

Math Group is the controller of the personal data processed by MathAIFlow, for the purposes of the Brazilian General Data Protection Law (Lei nº 13.709/2018 - LGPD) and, where applicable, other data protection regulations.

2. Who this policy applies to

This policy applies to Math Group staff who access MathAIFlow with their corporate account and, where applicable, to external users authorized to use the Platform.

3. What personal data we collect

• Account data: name, email, and your user identifier in the corporate directory.
• Session data: IP address, browser user agent, and access time.
• Credentials for integrations you connect (e.g. Jira, Google Workspace, Microsoft 365, Slack): access and refresh tokens, and the profile returned by the provider (name, email).
• Workflow content: block configuration, environment variables you define, execution records (inputs, outputs, and status of each run), and files you upload.
• Knowledge base: documents you upload and the text excerpts extracted from them, used for semantic search.
• Conversations with the AI copilot built into the Platform.

4. Why we use this data and our legal basis

• Authenticate your account and keep your session secure - performance of your employment relationship with Math Group or of the terms governing use of the Platform.
• Run the workflows you build and deliver their results - contract performance.
• Log security audit events (e.g. email mismatches across identity providers) - compliance with legal obligations and legitimate interest in information security.
• Provide technical support and troubleshoot issues - legitimate interest.

5. How we collect data

• Directly from you, when you create an account, configure a workflow, or connect an integration.
• Automatically, as you use the Platform (execution logs, session data).
• From your identity provider (Microsoft Entra ID) and from third-party integrations you authorize.

6. Who we share data with

We do not sell personal data. We share data in the following situations:

• AI model providers, through Math Group’s internal gateway, to process the AI steps of your workflows.
• Third-party services you connect to a workflow yourself (for example, adding a Jira block sends the relevant content to the Jira/Atlassian API using that connection’s token).
• Infrastructure providers that host the Platform (Microsoft Azure: database, web application, and transactional email delivery).

7. International data transfers

Some of our cloud infrastructure and the third-party integrations you may connect process data outside Brazil. Where that happens, we aim to use providers with contractual safeguards and recognized data-protection certifications.

8. How long we keep data

• Workflow execution logs: 30 days.
• Workflow state snapshots tied to those logs: 31 days.
• Internal operational logs: 90 days.
• Identity audit logs (security): 365 days.
• Expired sessions: kept for 7 days after expiry, for incident investigation.
• When you delete a workspace or account, data is retained for up to 30 days before permanent deletion, as a recovery window in case of mistake.

Your account content (workflows, knowledge base, conversations) is kept while your account is active, or until you request deletion.

9. How we protect data

• Encrypted connection (TLS) between your browser and the Platform.
• Integration credential tokens (OAuth), environment variables, and webhook secrets are encrypted at rest (AES-256-GCM) in the database.
• Role-based access control (admin/editor/viewer) per workspace.
• Audit logging for sensitive authentication events.

10. Your rights

Under LGPD art. 18, you may request: confirmation that we process your data, access to that data, correction of incomplete or outdated data, anonymization/blocking/deletion of unnecessary data, portability, information about who we share your data with, and withdrawal of consent where applicable.

To exercise these rights, contact us through the channel listed in the "Contact" section below, or ask your workspace administrator.

11. Data Protection Officer (DPO)

Math Group’s Data Protection Officer is Rafael Rojas Cunha, reachable at dpo@math.group.

12. Cookies and similar technologies

We use essential cookies to keep your session authenticated and to protect against CSRF attacks. We do not use advertising or tracking cookies in this deployment.

13. Use by minors

MathAIFlow is a corporate tool and is not intended for use by anyone under 18.

14. Changes to this policy

We may update this policy from time to time. The last-updated date is shown at the top of this page.

15. Contact

For questions about this policy or how we handle your data, email dpo@math.group (Data Protection Officer) or contato@math.group (general support), or call +55 11 3163-0800.