Privacy Policy

This Privacy Policy describes how OORT Labs ("OORT", "we") collects, uses, stores, shares and protects personal data in the context of the OORT Flows product ("Service", "Platform").

This Policy should be read together with the Terms of Use and the OORT Hub Privacy Policy, which governs user identity and authentication.

• Controller: OORT Labs, [CNPJ 00.000.000/0001-00], headquartered at [full address].
• Data Protection Officer (DPO): [Name] — [dpo@oortlabs.com].

For European users, the representative in the European Union is: [representative name and address, if applicable].

OORT Flows acts in distinct roles according to the nature of the data:

When OORT acts as Processor, processing is carried out strictly in accordance with the Organization's instructions, recorded through flow configuration.

Processing takes place for the following purposes and legal bases (LGPD art. 7 / GDPR art. 6):

OORT Flows does not use User Content to train its own AI models.

Data may be shared with the following categories of third parties, strictly for the purposes above:

OORT Flows may transfer data outside Brazil and the European Economic Area, particularly for:

• Execution on AI providers based in the USA and other countries;
• Storage on global cloud infrastructure.

Transfers follow safeguards set out by LGPD (art. 33) and GDPR (Chapter V), including Standard Contractual Clauses (SCC), countries with adequacy decisions, or specific guarantees agreed with the sub-processor.

The User may request early deletion, subject to legal bases that require retention.

OORT Flows adopts technical and organizational controls compatible with CASA Tier 2 / OWASP ASVS Level 2, including:

• Encryption in transit: TLS 1.2+ across all communication;
• Encryption at rest: integration credentials encrypted with Fernet (AES-128-CBC + HMAC-SHA256), with keys managed via TOKEN_ENCRYPTION_KEYS and rotation supported;
• Cookies: HttpOnly, Secure, SameSite=Lax;
• Local JWT validation via oort-shared (HS256), without dependency on remote Hub calls per request;
• Multi-tenant isolation: every query includes WHERE tenant_id = :tid, with automated tenant_isolation tests as a deploy gate;
• Role-based access control (e.g. tenant_admin for configuration changes);
• Brute-force protection (5 failures → 15-minute lockout), timing-attack mitigation via dummy password hash;
• Upload validation by magic bytes (via python-magic), not just Content-Type;
• Security headers: HSTS, X-Content-Type-Options, X-Frame-Options, CSP, Referrer-Policy, Permissions-Policy, Cache-Control no-store on sensitive routes;
• PII masking in logs;
• Static analysis with Bandit and Ruff on every commit;
• Rate limiting per tenant/user, scaled by operation type;
• Auditing of sensitive events in MongoDB (audit_events).

No system is 100% immune. In the event of a security incident with relevant risk or harm to data subjects, OORT will notify the ANPD and, when required, the affected data subjects, under LGPD art. 48 and GDPR arts. 33–34.

OORT Flows uses cookies strictly necessary for operation:

We do not use advertising-tracking cookies in the product.

Under LGPD (art. 18) and GDPR (arts. 15 to 22), you may exercise:

• Confirmation of the existence of processing;
• Access to your data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
• Portability of data;
• Deletion of data processed based on consent;
• Information about public and private entities with which we share data;
• Information about the possibility of not providing consent and its consequences;
• Withdrawal of consent;
• Objection to processing carried out on the basis of legitimate interest;
• Review of automated decisions that affect your interests (LGPD art. 20 / GDPR art. 22).

OORT Flows is not intended for those under 18 years of age and is not designed to process data from children and adolescents. If we identify inadvertent processing of minors' data, we will proceed with deletion, unless a legal obligation dictates otherwise.

AI features may suggest or execute actions automatically. We strongly recommend maintaining human oversight over decisions that produce legal or material effects on third parties.

Data subjects have the right to request human review of automated decisions, under LGPD art. 20 and GDPR art. 22.

We may update this Policy periodically. Material changes will be communicated via the Platform, email, or OORT Hub. The last update date appears at the top of this document.

Version history can be consulted at [repository address / link].

For questions about privacy and data protection:

• Data Protection Officer (DPO): [Name] — [dpo@oortlabs.com]
• General email: [privacy@oortlabs.com]
• Address: [OORT Labs full address]