Skip to main content
Tilápia IA

Privacy Policy

Tilápia IA — SaaS Aquaculture Management Platform

Controller and Processor

The controller of personal data is the platform customer (fish farmer or company) who enters data of their users, staff and suppliers into the system. Tilápia IA acts as processor, processing this data exclusively under the controller's instructions and to provide the contracted service.

Legal Bases

The processing of personal data on this platform is based on the following legal bases (LGPD art. 7):

  • Contract performance — processing necessary to provide the SaaS service (art. 7, X)
  • Legitimate interest — operational analytics to improve the service and security (art. 7, IX)
  • Consent — non-essential cookies and marketing communications (art. 7, I)
  • Legal obligation — retention of tax data and audit records (art. 7, II)

Data Processed

The platform processes the following data categories:

  • Account data: name, email, password (Argon2id hash), role and permissions
  • Production data: records of tanks, batches, biometrics, feeding and harvest
  • Environmental data (IoT): temperature, pH, dissolved oxygen and ORP (non-biometric)
  • Access data: IP address (anonymized after 30 days), user-agent, activity logs
  • Billing data: managed by Stripe (we do not store card data)

International Transfer

The platform uses international subprocessors (listed in Subprocessors), including Anthropic PBC (USA) for AI processing with aggregated production data without direct personal data, and Stripe, Inc. (USA) for payments. Transfers are protected by standard contractual clauses (ANPD Resolution 19/2024). Enterprise customers may opt for dedicated infrastructure in the Brazil region.

Data Subject Rights

Data subjects may exercise their rights (LGPD art. 18) via Data Subject Portal:

  • Access to the personal data processed
  • Correction of incomplete or inaccurate data
  • Deletion of data (where there is no legal retention obligation)
  • Portability of production data (JSON or CSV format)
  • Withdrawal of consent for analytics and marketing
  • Objection to processing based on legitimate interest

Data Retention

  • Production data: contract duration + 30 days (recovery period after cancellation)
  • Tax data: 5–11 years per Brazilian tax law
  • Operational logs: 6 months
  • Security/audit logs: 2 years
  • Access IP: anonymized after 30 days

Security

The platform implements technical and organizational measures per LGPD art. 46: multi-tenant isolation (RLS), encryption in transit (TLS 1.2+) and at rest (AES-256), Argon2id password hashing, security headers (CSP, HSTS), audit logs and a formal incident response process (ANPD notification within ≤3 business days).

Data Protection Officer (DPO)

For questions, exercising rights or privacy communications: dpo@tilapia.ia.br

Changes

This policy may be updated. Substantial changes will be announced at least 30 days in advance. The last update date is shown in the footer of this document.

Last updated: February 2026 · Data Subject Portal · Subprocessors · Cookie Policy