Privacy policy

1. Who is the controller

CAOS is an open-source project. The controller of the data processed at caos.ltd is EPRS Tecnologia da Informação Ltda (trade name Dukits), CNPJ 61.250.160/0001-83, based in Florianópolis, Brazil.

For anything about privacy, including data-subject requests, write to privacidade@caos.ltd.

2. What we collect

• E-mail and consent: your e-mail, the date and time you agreed, and the exact text you accepted.
• Where you came from: campaign parameters (UTM) and the referring page of your first visit in the session.
• Your answers to the Ataya chat, if you agree to answer: name, type of work, company, team size, how you use AI, management challenges, what AI has not solved yet, the tools you use and, if you wish, your LinkedIn.
• A record of the conversation: whether you accepted or declined the invitation, which questions you saw, which answers you saved or changed, whether you left or finished, always with date and time.
• Security data: the Cloudflare Turnstile anti-bot check and the infrastructure process your IP and browser signals to block bots and abuse. We do not keep your IP in your sign-up record.
• We do not ask for your phone number, tax ID or sensitive personal data. Please do not type that kind of information, or third-party data, into the free-text fields.

3. What we use it for, and the legal basis

• Confirming your e-mail and sending early-access news: consent (art. 7, I, LGPD).
• Understanding who uses CAOS, prioritizing early access and guiding the product from your answers to Ataya: consent, given when you agree to answer.
• Delivering the gift to those who finish the conversation: consent.
• Protecting the site against bots, fraud and abuse: legitimate interest (art. 7, IX).
• Proving consent and unsubscribes and meeting legal or regulatory duties: legal obligation (art. 7, II) and regular exercise of rights (art. 7, VI).

4. Ataya and automated decisions

Ataya is a virtual assistant with a fixed script, built to ask questions. It does not use generative AI and decides nothing on its own. Answering is optional: if you decline or stop halfway, you stay on the list once you confirm your e-mail, but you do not get the gift, which depends on finishing the conversation.

Early access is prioritized by people on the team. You can ask for a review of any decision that affects you at privacidade@caos.ltd.

5. Who we share it with

We do not sell or rent data. We use Cloudflare as a processor: site hosting, database, transactional e-mail delivery and the Turnstile anti-bot check. We may share data with authorities when the law requires it.

If you join a CAOS WhatsApp group, WhatsApp’s own terms and policy also apply. We do not collect your phone number through the site.

6. International transfers

Cloudflare runs a global network, so data may be processed outside Brazil (art. 33, LGPD), under the contractual and security safeguards that provider offers.

7. How long we keep it

• While you are on the list or until you ask for deletion.
• If you unsubscribe you stop receiving messages. We keep the minimum (e-mail, consent date and unsubscribe date) for as long as needed to prove we honored the request and to meet legal duties.
• Sign-ups that were never confirmed may be deleted periodically.
• When you ask for deletion, we erase the sign-up, your answers and the conversation record, except what the law requires us to keep.

8. Cookies and browser storage

We use no advertising cookies and no third-party analytics. We store in your browser only what is needed: where the visit came from (sessionStorage, cleared when you close the tab) and your progress in the Ataya chat (localStorage, so you can resume). Cloudflare Turnstile may use its own technologies to check that you are not a robot.

9. Your rights

Under art. 18 of the LGPD you may, at any time:

• confirm that we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• ask for anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• ask for data portability;
• know who we share it with;
• withdraw consent and ask for deletion of data processed on that basis;
• object to a processing activity and ask for review of automated decisions.

10. How to exercise your rights

Write to privacidade@caos.ltd from the e-mail you signed up with. We reply within 15 days. To leave the list, use the unsubscribe link in every e-mail, which works in one click.

If you are not satisfied, you may file a complaint with the Brazilian data protection authority (ANPD).

11. Security

We use encrypted connections (HTTPS), restricted access to data, random tokens in links and validation of what we receive. No system is completely immune to failure: if an incident could cause significant harm, we will notify you and the ANPD as the law requires.

12. Children and teenagers

CAOS is aimed at professionals in agencies and marketing teams. We do not intentionally process data of anyone under 18.

13. Changes to this policy

If something changes in a relevant way, we will publish the new version on this page with the update date. Before using your data for a new purpose, we will ask for new consent where the law requires it.