.jpg?v=17965b387749f798d0bbf2b708c10baeafa89626)
Who we are
Tess Tecnologia LTDA. (CNPJ 60.806.420/0001-91) is the sole owner, controller, and operator of the artificial intelligence platform Tess AI ("Platform"), and is the exclusive contracting party toward users. Tess integrates dozens of third-party AI models to offer generation and editing of text, image, video, audio, and much more. Where Brazilian law applies, we follow the LGPD. Where we offer the Platform to people in the European Economic Area or the United Kingdom, we follow the GDPR (and the UK GDPR). Where we collect personal information from California residents, we follow the CCPA/CPRA.
Who this Notice applies to
This Notice applies to all data subjects who interact with Tess, including registered users, workspace administrators, invited team members, and site visitors, in Brazil, the European Economic Area, the United Kingdom, or California, regardless of the plan contracted (individual or enterprise).
The Platform is not directed at children. We do not knowingly collect data from anyone under 18. If we learn that we have collected a child's data without the required legal basis (including the specific consent in Art. 14 of the LGPD or Art. 8 of the GDPR, where applicable), we will delete that data. On corporate accounts, the controller customer decides whether users in its organization may access the Platform.
Glossary of terms
To make reading easier, we explain below the main terms used in this Notice:
Controller
Who decides how and why personal data are processed.
Operator
Who processes data on behalf of the controller, following its instructions.
Data subject
The natural person to whom the personal data relate.
Processing
Any operation with data: collection, use, storage, sharing, deletion, etc.
Sensitive personal data
Data about racial/ethnic origin, health, biometrics, political opinion, among others.
Legal basis
The justification in the LGPD, the GDPR, or, where relevant, the CCPA that authorizes each processing activity.
Our role: controller and operator
For LGPD and GDPR purposes, Tess's role depends on how you use the Platform. Under the GDPR, the equivalent roles are controller and processor:
We act as controller
When you sign up and use the Platform as an individual, we make the decisions about the processing of your account and registration data — and we are responsible for them.
We act as operator
When you access the Platform through a workspace, enterprise account, or via the API of a corporate client, it is the contracting company that acts as controller. In that case, we process the data following its instructions.
What data we collect
When using the Platform, we may collect the following categories of data:
Identification data
First name, last name, and email address.
Account and billing data
Username, billing information, and subscription history.
User-generated content
Text prompts, uploaded files, sample images, and results (Assets) generated on the Platform.
Technical data
IP address and system logs, for operation, maintenance, and security.
These data come from three sources: what you provide to us, what the Platform records automatically during use (such as IP and logs), and, when Tess acts as operator, what the corporate customer instructs us to process. Name, email, and billing data are necessary to create the account and perform the contract; without them, it is not possible to register or process payment. Content sent to the models is optional and depends on what you choose to enter. Non-essential cookies depend on consent, as described in the Cookie Policy.
For California residents, these categories correspond, under the CCPA/CPRA, to identifiers, commercial information, internet activity, user-generated content and, when you choose to provide them, sensitive personal information (such as photo and voice used in avatars, or sensitive data you include in a prompt). We have collected these categories in the 12 months before the date of this Notice, for the purposes in section 6.
Why we use your data and legal basis
Every processing of data at Tess has a specific purpose and a corresponding legal basis under the LGPD and, where the GDPR applies, under Regulation (EU) 2016/679:
| Data | Purpose | Legal basis (LGPD) | Legal basis (GDPR) |
|---|---|---|---|
| Name and email | Create and identify the account, authenticate login, and communicate with you. | Performance of a contract (Art. 7, V) | Performance of a contract (Art. 6(1)(b)) |
| Billing data | Process subscriptions, billing, and issuance of invoices. | Performance of a contract and legal obligation (Art. 7, V and II) | Performance of a contract and legal obligation (Art. 6(1)(b) and (c)) |
| Generated content (prompts, files) | Execute the AI features you request. | Performance of a contract (Art. 7, V). Sensitive data you enter: specific consent (Art. 11, I) | Performance of a contract (Art. 6(1)(b)). Sensitive data you enter: explicit consent (Art. 9(2)(a)) |
| IP address and logs | Operation, security, fraud prevention, and compliance with the Brazilian Internet Civil Rights Framework (Marco Civil da Internet, Law No. 12,965/2014). | Legal obligation (Art. 7, II) and legitimate interest (Art. 7, IX) | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) |
| Email (marketing) | Sending news and communications, when applicable. | Consent or legitimate interest (Art. 7, I or IX) | Consent or legitimate interest (Art. 6(1)(a) or (f)), with a right to object |
| Photo and voice (avatars) | Optional creation of digital avatars. Sensitive data, used only with authorization. | Specific consent (Art. 7, I and Art. 11, I) | Explicit consent (Art. 6(1)(a) and Art. 9(2)(a)) |
For California residents, the purposes above are business purposes under the CCPA/CPRA. Tess does not sell personal information and does not share it for cross-context behavioral advertising.
Purposes that may not be expected
In the interest of transparency, we highlight uses that may not be obvious to you:
- Product improvement: we analyze aggregated and anonymized usage metrics to improve features — without using your content to train AI models (see section 9).
- Fraud and abuse prevention: we may analyze usage patterns to detect malicious activity, spam, or violations of the Terms.
- Security and audit: logs may be reviewed in investigations of security incidents.
These uses rely on legitimate interest (Art. 7, IX, of the LGPD and Art. 6(1)(f) of the GDPR). You may object to them, and also to direct marketing, at any time, using the form in section 13. Objecting to marketing does not affect essential security or legal-obligation messages.
Sharing with AI models
The Platform integrates dozens of third-party artificial intelligence models to automate processes such as generation of text, image, video, audio, and avatars. Only data directly entered by the user (prompts, files) are shared with these models to enable the requested feature — never additional personal data.
The prompts and files you enter (text, image, audio, and video) may, at your discretion, contain personal data or sensitive personal data. When the content you enter, on your own initiative, contains personal data, its processing will observe the legal basis of specific consent and the safeguards described in the Privacy Policy. Tess does not request or use additional personal data beyond those you enter to enable the requested feature.
Besides AI model providers, we may share data with operators that provide services to us under contract: cloud infrastructure, payment and billing providers, and the consultancy that acts as Data Protection Officer. We may also disclose data when the law, an authority, or the defense of a right requires it. Those recipients process the data to perform the contracted service. Tess does not sell personal information or share it for cross-context behavioral advertising, under the CCPA/CPRA.
Your data does not train AI models
Tess expressly declares that it does not use prompts, uploaded files (images, videos, documents), system instructions, cached content, or the generated responses to train or improve its AI models or third-party models.
For integrations with Google Workspace, we guarantee that data accessed via the Google API are not used to develop or train generalized AI/ML models, in compliance with the Google API Services User Data Policy.
International data transfer
To operate the Platform and enable the artificial intelligence models, your data may be processed on servers and by providers located outside Brazil, including the United States and other countries where our cloud and AI providers maintain infrastructure.
These international transfers are carried out under Arts. 33 to 36 of the LGPD and, where the GDPR applies, under Chapter V of the Regulation: an adequacy decision, where one exists, or standard contractual clauses (Art. 46), always with contractual and technical safeguards to maintain a level of protection compatible with applicable law.
Some of the artificial intelligence models and infrastructure providers integrated into the Platform are located outside Brazil. In such cases, the data necessary for the feature may be transferred internationally. Such transfers are carried out with adequate protection guarantees, under the terms of Arts. 33 to 36 of the LGPD, ensuring that the data maintain a level of protection compatible with that required by Brazilian law.
For corporate clients, these contractual safeguards are detailed in the Data Processing Agreement (DPA) mentioned in section 4.
Information security
We adopt technical and organizational measures to protect your data, including:
- Encryption of data in transit and at rest;
- Access control restricted to authorized personnel;
- Continuous security monitoring;
- Regular assessments and penetration testing;
- Parental control: workspace administrators may monitor the execution history of other users on shared accounts.
Despite these efforts, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
Data retention and deletion
Your personal data are stored only for as long as necessary to fulfill the purposes of this policy. As a reference for timeframes:
- Account data and generated content: kept while your account is active and deleted after closure, except for legal obligation.
- Access logs and IP: kept for at least 6 (six) months, pursuant to the Brazilian Internet Civil Rights Framework (Marco Civil da Internet, Law No. 12,965/2014).
- Billing data: retained for the period required by tax law.
- Inactive accounts: may have data deleted after a prolonged period of inactivity.
To request the removal of your personal data, simply send an email to our support or the form in section 13. We confirm identity when necessary and respond within the timeframes of applicable law: as provided in Art. 19 of the LGPD; as a rule, within 1 month under the GDPR (Art. 12), extendable where the law allows; and within 45 days under the CCPA, extendable once by another 45 days. Deletion does not cover data whose retention is mandatory by law.
Your rights (LGPD, GDPR, and CCPA)
As a data subject, you may exercise the rights of the law that applies to you. Under the LGPD:
- Confirmation of the existence of processing and access to your data;
- Correction of incomplete, inaccurate, or outdated data;
- Anonymization, blocking, or deletion of unnecessary or excessive data;
- Obtain a copy of the personal data we store about you;
- Portability of data to another service provider;
- Deletion of data processed with consent;
- Withdrawal of consent at any time, as easily as it was given;
- Information about public and private entities with which we share data;
- Review of automated decisions that affect your interests (Art. 20 of the LGPD and Art. 22 of the GDPR);
- Petition the National Data Protection Authority (ANPD).
Where the GDPR or the UK GDPR applies, you may also:
- Restrict processing, in the cases provided for in Art. 18;
- Object to processing based on legitimate interest and to direct marketing (Art. 21);
- Lodge a complaint with the supervisory authority of your country.
If you reside in California, the CCPA/CPRA also gives you the right to:
- Know the categories and specific pieces of data collected, the sources, the purposes, and the recipients;
- Request deletion and correction;
- Opt out of the sale or sharing of personal information. Tess does not sell personal information or share it for cross-context behavioral advertising;
- Limit the use of sensitive personal information to what is necessary to provide the requested service;
- Not be discriminated against for exercising these rights;
- Use an authorized agent, upon proof of authorization.
To exercise these rights, preferably use the form below, a channel managed by the Data Protection Officer (DPO) and monitored daily. The email in section 16 remains an alternative channel. We may ask for information to confirm your identity. Responses follow the timeframes in section 12. The “Privacy preferences” button at the top of this page is the channel for communication and privacy choices.
Consent and communications
By accepting the Terms of Service and the Privacy Policy at login, you acknowledge this Notice. Acceptance does not turn every processing activity into consent: each purpose uses the basis in section 6. Consent, where it is the basis, may be withdrawn at any time, as easily as it was given, without affecting processing already carried out. Refusing non-essential consent does not prevent use of features that rely on a contract. Tess may send communications by SMS, email, WhatsApp, and phone for technical support, service updates, and security information. You may manage your communication preferences at any time, except for essential security and legal compliance messages.
Human reading of data is prohibited, except: (i) explicit user consent; (ii) security purposes (investigation of bugs or abuse); (iii) compliance with legal obligations; or (iv) aggregated data used internally in accordance with applicable law.
Changes to this Notice
This Privacy Notice may be updated periodically. In the event of material changes, we will notify you through the Platform or by email before the changes take effect, whenever required by law.
Changes take effect from the date of publication on this page. Where a change requires consent, we will ask for that consent again; continued use does not replace it. We recommend reviewing this notice, the Privacy Policy, and the Terms of Service periodically.