Privacy Policy

This Privacy Policy describes how Turing ("Turing", "we") collects, uses, shares, and protects personal data in the context of using the app.turing.com.br platform and other related interfaces/plug-ins and services ("Services"), with primary storage and processing on AWS (United States).

By using the Services, you acknowledge that you have read and understood this Policy.

1 Roles (Controller vs. Processor) and Scope

• Corporate clients/Organizations. When Turing provides Services to an organization (e.g., a law firm or legal department) and you access through that organization, it is common for the Organization to be the Controller and Turing to act as Processor for content entered on the platform (conversations, documents, legal data).
• End users. For registration, billing, security, marketing, and support data, Turing tends to act as Controller.
• User content. "Content" includes messages, uploaded documents, generated outputs, Workflow/Grid executions, and entered legal data. Content processing may occur as Processor (when linked to the Organization) and, in some cases, as Controller (e.g., product improvement, when permitted and with an adequate legal basis).

Legal basis (LGPD): [Law 13,709/18, Arts. 5, VI and VII; 7; 11; 18].

2 What data we collect (categories)

Below is a map of the main data, aligned with the inventory provided by you.

2.1 Table — Data collected

2.2 Automatically collected data (technical)

We collect typical technical data for operations and security:

• Access logs: IP, date/time, endpoints, audit and security events
• Device and browser data: operating system, user agent, settings
• Usage data: features used, session duration, query volume
• Cookies and similar technologies: essential (session/CSRF), functional, and, where applicable, analytics

3 Processing purposes and legal bases (LGPD)

We process personal data for the purposes below, always observing necessity, adequacy, and data minimization [Law 13,709/18, Art. 6].

3.1 Table — Purpose x Legal basis x Examples

4 How data is processed (including AI/RAG)

Turing offers features that may process Content through third-party services for:

• Response generation and classification (LLMs)
• Embeddings and vector search (for context retrieval)
• Document parsing (structured extraction from PDFs/DOCX/PPTX)
• Cloud integrations (Google/Microsoft) when you connect your account

5 Data sharing (processors and third parties)

We share data only when necessary to operate the Services, fulfill obligations, or at your choice (e.g., integrations).

5.1 Table — Main third parties and data sent

6 International transfer (Brazil → USA) and AWS storage

Data processed by Turing may be stored and processed in the United States, on AWS infrastructure (and, as per the listed vendors, by other sub-processors), in compliance with the LGPD [Law 13,709/18, Arts. 33 to 36].

7 Retention and deletion

Turing does not have an automatic global TTL for most data, as per its current design, which requires transparency and governance.

7.1 General rules (operational guidelines)

8 Data subject rights (LGPD)

You may exercise the rights provided under the LGPD [Art. 18], including:

• Confirmation of processing and access
• Correction of incomplete/inaccurate data
• Anonymization, blocking, or deletion (when applicable)
• Portability (when applicable)
• Information about data sharing
• Withdrawal of consent (when consent is the legal basis)
• Objection to processing based on legitimate interest (when applicable)

8.1 How to make a request

Send your request to: suporte@turing.com.br

We may request identity verification to prevent fraud, a practice aligned with market standards.

When the Organization is the Controller: we will direct or guide you to contact the administrator/controller (e.g., law firm/company), pursuant to the applicable agreement.

9 Information security

We adopt reasonable technical and organizational measures to protect data against unauthorized access, loss, and alteration, with mandatory HTTPS:

• Access control through roles/permissions
• Session management (sessionid cookie) and CSRF protection (csrftoken + header)
• Internal service tokens (e.g., X-Internal-Service-Token)
• Security monitoring and logs (as needed)
• Cloud storage with security controls (AWS)

10 Cookies and similar technologies

We use cookies for:

• Essential: authentication/session and security (CSRF)
• Functional: user preferences
• Analytics (when applicable): usage metrics for product improvement

You can manage cookies in your browser; disabling essential cookies may affect functionality.

11 Children and minors

The Services are intended for a professional audience. We do not direct the Services to individuals under 18 years of age. If we identify improper collection, we will take measures for deletion and blocking.

12 Changes to this Policy

We may update this Policy periodically. We will publish the current version and, when applicable, notify you by email or within the product itself.

13 Data Protection Officer (DPO) Contact and Privacy Channel