PRIVACY NOTICE

To make this Notice easier to understand, we provide a summary table of the information that will be presented to you in this document:

This Notice is addressed to all data subjects, natural persons, who use PUPILA’s services through our Platform (“USER”), as well as to people whose images are submitted to the Platform by USERS, regardless of the country in which they are located.

Your personal data will be processed by PUPILA. We act predominantly as the Personal Data Controller, which means we decide how your personal data will be processed, applying good data protection practices and following the provisions of the LGPD and other applicable laws.

With regard to images submitted to the Platform, the USER is responsible for the content they upload and for obtaining, prior to submission, the acknowledgment and consent of the individuals portrayed, through the term described in Section 6. PUPILA recommends that no personal data of third parties be uploaded that is unnecessary for the purpose of using the Platform and/or has not been expressly consented to.

The information we process about you may have been provided directly by you to PUPILA, provided by USERS, or collected automatically through our Website or Platform. Let’s take a closer look at each of these data collection situations:

To respect your privacy, we understand that all processing of personal data must be limited to the minimum necessary, in a relevant and proportional manner, to allow the intended purpose to be achieved.

Therefore, the personal data we collect about you will vary depending on the relationship you choose to have with us. Below, grouped by category, we present the main personal data that may be processed by us and the purpose of the processing:

1. Registration data: full name;
2. Contact information: phone number and email;
3. Images and biometric data: photographs and images of people submitted to the Platform, including facial and physical characteristics that may be considered biometric data; and
4. Attributes associated with your electronic devices: internet service provider, operating system, browser (type, version, enabled options and installed plugins), display settings (size/resolution and number of colors), date and time of access, pages viewed through cookies, characteristics of the access device; IP address (with date and time); IP origin; language preference; country setting; click information and geolocation.

As a rule, we do not collect sensitive personal data on our Website. However, as detailed in Section 6, the images submitted to the Platform may involve the processing of biometric data, which is considered sensitive personal data.

The Platform allows USERS to submit photographs and other images of people in order to achieve the purpose expected by PUPILA. These images may contain facial and physical characteristics that, when subjected to specific technical processing to reproduce a person’s features in the generated images or to uniquely identify them, may be considered biometric data and, therefore, Sensitive Personal Data under the LGPD and other applicable laws.

Images of people may only be submitted to the Platform with the prior acknowledgment and the specific and highlighted consent of the individual portrayed, formalized through a dedicated term that informs the purposes of the processing. The USER who submits images of third parties is responsible for obtaining and keeping this term and for ensuring that they have all the necessary authorizations, including with regard to image rights. Submitting images of individuals under 18 (eighteen) years of age is not permitted.

Images and any biometric data will be processed exclusively to enable the execution of the PUPILA activities requested on the Platform, and will not be used to identify or authenticate people, nor shared for purposes other than those described in this Notice.

The individual portrayed may withdraw their consent at any time by emailing privacy@pupila.ai, in which case their images and biometric data will be deleted, except where retention is required by law.

The Personal Data we collect may be used as described in the table below:

Cookies are files or pieces of information that may be stored on your devices when you access PUPILA’s Website/Platform. We use cookies to make use easier and to adapt our pages to the interests and needs of data subjects, as well as to compile information about the use of the Website, helping to improve its structure and content. Below you can see the types of cookies and their respective purposes, which justify the use of the information we collect, in accordance with the LGPD:

PUPILA may share your personal data, in which case sharing will be restricted to the minimum necessary and required to fulfill specific purposes previously informed to you in this Notice. Thus, we may share your data with third parties in the following situations:

• With business partners and service providers, to enable the operation of communication and marketing channels, as well as the provision of the structures necessary for our services to be viable;
• In the event of a corporate transaction, such as mergers, acquisitions, spin-offs and incorporations;
• With administrative and judicial authorities, when necessary to comply with a legal obligation or to assist in the investigation of suspicious or illegal activities;
• With law firms, legal advisors and other legal representatives, when necessary to defend PUPILA’s interests in administrative, arbitration or judicial proceedings; and
• With operators and service providers essential to our activities, including information technology services, data hosting, cloud database hosting, Power BI (Business Intelligence), among others, in accordance with the instructions and purposes set out in the contractual instruments signed with PUPILA.

Some of these operations may involve the transfer of personal data to other countries, as detailed in Section 10.

In any of the cases above, PUPILA will use its best efforts to establish responsibilities with the companies receiving personal data, through appropriate contractual instruments containing provisions on legal bases, purposes, forms of processing and security measures, among other safeguards granted to data subjects, in accordance with the LGPD and other applicable laws.

As PUPILA serves clients and data subjects located in different countries, it may transfer and/or store Personal Data in the United States and/or in other countries where it has facilities, business activities or service providers. Thus, your Personal Data may be transferred to other countries or regions, including to other entities of its group or to contracted operators, such as cloud data storage providers.

When transferring your Personal Data outside your country of residence, we do so in accordance with applicable law and adopt appropriate measures to ensure the protection of your data, ensuring that any processing occurs lawfully, only under our instructions and for the purposes informed, under the terms of the data processing agreement signed with the respective recipient.

For transfers from Brazil, we will observe the mechanisms provided for in Article 33 of the LGPD and in the regulations of the ANPD (Brazilian National Data Protection Authority). For transfers from the European Union, the European Economic Area or the United Kingdom to countries that are not recognized as having an adequate level of protection, we will use appropriate and necessary safeguards.

Please be aware that, outside the jurisdiction of your residence, your Personal Data will be subject to local laws, which may not offer the same level of protection as the legislation of your country and may provide for disclosure to governments, courts, law enforcement authorities or regulatory bodies of that jurisdiction. Images and biometric data will only be transferred when necessary to generate the requested images and with the same safeguards described herein.

To protect the privacy of data subjects, the personal data processed by PUPILA will be automatically deleted when it is no longer useful for the purposes for which it was collected, or when the data subject requests its deletion, unless its retention is expressly authorized by applicable law or regulation.

Images and biometric data submitted to the Platform will be kept only for the period necessary to generate the requested images or until the data subject withdraws consent, whichever occurs first, except where retention is required by law.

We emphasize that information may be retained to comply with legal or regulatory obligations, for transfer to third parties – provided that data processing requirements are respected – and for PUPILA’s exclusive use in exercising its rights in judicial or administrative proceedings.

Finally, the data subject should be aware that their request may be lawfully rejected, either for formal reasons (such as their inability to prove their identity) or for legal reasons (such as a request to delete data whose retention is permitted to PUPILA by current legislation).

We use reasonable market means and those required by law to preserve the privacy of the personal data we collect. Thus, we adopt several precautions, in accordance with the guidelines on security standards established in Decree No. 8,771/2016, such as:

• Protection against unauthorized access to our systems;
• Restricted access controls and enhanced security measures for the processing of images and biometric data;
• Access granted only to previously authorized persons at the location where the collected information is stored, including PUPILA employees and representatives and/or duly authorized partners; and
• Anyone who comes across personal data must commit to maintaining absolute confidentiality. A breach of confidentiality will result in civil liability under applicable law.

In addition to technical efforts, we also adopt institutional best practices aimed at protecting personal data. It is important to note that, although PUPILA makes its best efforts to preserve privacy and protect data subjects’ data, no transmission of information is completely secure, so we cannot fully guarantee that all data received or sent will not be subject to unauthorized access carried out with methods designed to obtain information improperly.

Data protection rights vary according to the data subject’s country of residence. Find the section that applies to you below. If you are not sure which section applies, contact us and we will help you.

If you have any questions, you can contact us at privacy@pupila.ai.

Some of the information provided here may be updated or changed. Therefore, we advise you to check this Privacy Notice periodically. Whenever there is a change, we will inform you on our home page. This Privacy Notice was last amended and published on our Website/Platform in: October 2026.