ENPT
Talk to Hórus

Legal · Privacy

Privacy and Data Protection Policy

How Hórus collects, uses, stores, shares and protects personal data in its AI-supported risk and ESG assessment. Last updated: October 14, 2026.

This is a courtesy translation. In case of any discrepancy, the Portuguese version prevails.

On this page
  1. 1. Who we are and to whom this applies
  2. 2. Definitions
  3. 3. How Hórus works (processing context)
  4. 4. Data we collect, purposes and legal basis
  5. 5. Automated decisions and human review
  6. 6. Sharing and processors
  7. 7. International data transfers
  8. 8. Information security
  9. 9. Your rights as a data subject
  10. 10. Retention and deletion
  11. 11. Roles when the contracting company is the controller
  12. 12. Changes to this Policy
  13. 13. Governing law and jurisdiction
  14. 14. Cookies and analytics on the corporate website
  15. 15. Contact

1. Who we are and to whom this applies

This Privacy and Data Protection Policy ("Policy") describes how HÓRUS, a risk management startup supported by artificial intelligence (a spin-off of INDEXTECH Consultoria Empresarial), processes the personal data of executives and companies that use the Hórus platform (horus.tools and portal.horus.tools) and the assessment assistant on WhatsApp.

We are committed to complying with Brazil's General Data Protection Law (Law No. 13,709/2018, LGPD). By using our services, You (the "Data Subject") acknowledge the practices described in this Policy.

Data controller: HORUS TECNOLOGIA LTDA (HÓRUS brand, a spin-off of INDEXTECH Consultoria Empresarial).
CNPJ (Brazilian company registry): 57.135.544/0001-88.
Data Protection Officer (DPO), data subject channel: contato@horus.tools.

2. Definitions

For the purposes of this Policy, the LGPD definitions apply, including:

  • Personal Data: information relating to an identified or identifiable natural person.
  • Data Subject: the natural person to whom the processed personal data refers.
  • Processing: any operation performed on personal data (collection, use, access, storage, deletion, etc.).
  • Controller: whoever decides on the processing, in the context of the assessment, HÓRUS.
  • Processor: whoever processes data on behalf of the controller (our service providers, listed in section 6).
  • Data Protection Officer (DPO): the communication channel between HÓRUS, data subjects and the ANPD (Brazil's data protection authority).
  • Anonymization: a technique by which data can no longer be associated with an individual.
  • Automated decision: processing carried out solely by automated means that affects the data subject's interests.

3. How Hórus works (processing context)

Hórus produces a risk and ESG maturity assessment of a company from three sources: (i) a self-assessment answered by the company's executives; (ii) enrichment with public data about the company, obtained through artificial intelligence services; and (iii) interaction with the Hórus assistant on WhatsApp. The result is a report with maturity indicators and risk signals, delivered to the contracting company.

4. Data we collect, purposes and legal basis

4.1. Executive identification and contact data

  • Data: name, email, phone/WhatsApp, job title, company and, when provided, CPF (Brazilian taxpayer ID).
  • Purpose: to identify the respondent, grant access to the assessment, communicate through the channel and link the answers to the company.
  • Legal basis: performance of a contract/preliminary procedures (art. 7, V) for the contracting company; and legitimate interest (art. 7, IX) in the pre-assessment of leads, always with transparency at first contact.

4.2. Self-assessment answers

  • Data: the executive's answers to the assessment questionnaire (perceptions of management, risks and ESG). We do not request sensitive personal data.
  • Purpose: to generate the company's assessment and report.
  • Legal basis: performance of a contract (art. 7, V).

4.3. Public company data (AI enrichment)

  • Data: public information about the company (news, publications, reviews, market signals and industry data) collected through search and AI services (Firecrawl, Perplexity and xAI/Grok). It refers to the legal entity; partners and executives mentioned in public sources may be identifiable.
  • Purpose: to build the assessment context with external signals. All content carries its source and date, is treated as a perception signal (not fact) and undergoes human review before being included in any report, visible only to the assessed company itself.
  • Legal basis: legitimate interest (art. 7, IX), with a documented balancing test and limitation to the minimum necessary (queries contain only public data about the legal entity).

4.4. Interactions with the WhatsApp assistant

  • Data: messages exchanged with the Hórus assistant and interaction metadata (date/time, channel).
  • Purpose: to conduct the assessment, provide support and keep a record for quality and audit.
  • Legal basis: performance of a contract (art. 7, V) for the contracting client; legitimate interest (art. 7, IX) for quality logging, always minimized.

4.5. Assessment results

  • Data: indicators, maturity level and report derived from the answers and the enrichment, linked to the company and the respondents.
  • Purpose: to deliver the assessment to the contracting company and allow follow-up.
  • Legal basis: performance of a contract (art. 7, V).

We do not use answers or conversations to train AI models or for prospecting without the data subject's specific and prominent consent (art. 7, I). We currently make no such use.

5. Automated decisions and human review

The assessment is prepared with the support of automated processing (artificial intelligence). Under art. 20 of the LGPD, the data subject has the right to request a review of decisions made solely on the basis of automated processing. At Hórus, every assessment undergoes human reading and validation before delivery, and You may request clarification or review through contato@horus.tools.

6. Sharing and processors

To operate the platform, we share strictly necessary data with providers acting as Processors, who are contractually bound to protect the data and use it only for the contracted purposes:

  • OpenAI, generation of the assessment and executive summary from the answers.
  • Firecrawl, search and collection of public web content about the company.
  • Perplexity and xAI (Grok), enrichment with public company data.
  • Meta / WhatsApp (Cloud API), the assistant's service channel.
  • Amazon Web Services (AWS), platform hosting and storage.

We may also share data to comply with a legal or regulatory obligation or an order from a competent authority, and in the event of a corporate reorganization (maintaining a level of protection compatible with this Policy). Hórus does not sell or rent personal data.

7. International data transfers

Part of the processing takes place on servers and services located outside Brazil (for example, AWS hosting in the United States region and the AI services above). In these cases, we adopt appropriate contractual safeguards and require processors to provide a level of protection compatible with the LGPD, in accordance with arts. 33 to 36 of the law.

8. Information security

HÓRUS adopts technical and administrative measures to protect personal data, including:

  • Encryption of data in transit and, where applicable, at rest.
  • Access control under the principle of least privilege and isolation between services.
  • Database segregation and row-level security policies on tables containing personal data.
  • Monitoring, regular backups and recovery plans.
  • Minimization and, where appropriate, anonymization or pseudonymization.

No measure is infallible. In the event of an incident posing a relevant risk to data subjects, we will act to mitigate the impact and notify the ANPD and the affected data subjects, as required by the LGPD.

9. Your rights as a data subject

Under art. 18 of the LGPD, You may, at any time and free of charge:

  • Confirm the existence of processing and access your data.
  • Correct incomplete, inaccurate or outdated data.
  • Request anonymization, blocking or deletion of unnecessary data or data processed in non-compliance.
  • Request deletion of data processed on the basis of consent, except in the cases of art. 16.
  • Request portability to another provider, subject to commercial and industrial secrecy.
  • Obtain information about the sharing of your data.
  • Object to processing based on legitimate interest and, where applicable, withdraw consent.
  • Request a review of automated decisions (section 5).

To exercise any right, write to contato@horus.tools. We will confirm your identity and respond within the LGPD deadlines. Requests to delete personal data are fulfilled within 15 days after identity confirmation; when the individual answer is already part of an aggregated company assessment, the data subject's identifiers are anonymized, preserving only the non-identifiable aggregated result.

10. Retention and deletion

We retain personal data only for as long as necessary for the purposes of this Policy, to comply with legal obligations and for the regular exercise of rights. Interaction records are kept for a defined retention period and, at its end, securely deleted or anonymized. Deletion requests follow the procedure in section 9.

11. Roles when the contracting company is the controller

When the contracting company provides Hórus with personal data of its own employees or third parties (for example, when designating respondents), it acts as the Controller of that data and Hórus as the Processor, processing it according to the instructions and the contract. The company is responsible for ensuring the legal basis and informing its data subjects. For Hórus's own assessment, Hórus is the Controller.

12. Changes to this Policy

We may update this Policy to reflect legal, regulatory or product changes. Relevant changes will be communicated through a notice on the platform or by email. We recommend periodic review. The date of the last update appears at the top of this page.

13. Governing law and jurisdiction

This Policy is governed by the laws of the Federative Republic of Brazil, in particular Law No. 13,709/2018 (LGPD). The courts of the district of Vitória, Espírito Santo, Brazil, are elected to settle matters arising from this Policy, to the exclusion of any other.

14. Cookies and analytics on the corporate website

The horus.tools website uses Google Analytics 4 (Google LLC) to measure, in aggregate, how pages are visited and which contact buttons are used. These analytics cookies are only enabled if you click "Accept" on the notice shown on your first visit; the legal basis is consent (art. 7, I, of the LGPD). If you decline, no analytics cookies are stored.

Your choice is stored only in your browser. To change it, clear the horus.tools site data in your browser settings; the notice will appear again. The site also stores in your browser the language you choose (Portuguese or English), only to open the page in that language on later visits; this information is not sent to Hórus or to third parties. Data collected by Google Analytics may be processed outside Brazil, as described in section 7.

15. Contact

Questions about this Policy or the processing of your data, and the exercise of rights: contato@horus.tools.