Privacy Policy

1. Who is responsible for your data

The controller of the personal data processed on this site and in the product is Celeris Juris Tecnologia e Inteligência Jurídica LTDA, which operates the IAJUS brand. You can reach us, including our data protection officer (DPO), at contato@iajus.com.br.

2. Public collection and minimization by design

IAJUS is a legal research tool: the purpose of the service is to locate case law and legislation that have been officially published (the public collection), starting from legal theses and legal situations. To answer your query, the service is designed not to require third parties' personal data, applying the principle of necessity (art. 6º, III, of the LGPD) from the design of the product.

We ask that you do not include third parties' personal data in the text of your query, especially sensitive data (such as racial or ethnic origin, religious belief, political opinion, health, sex life, genetic or biometric data, under art. 11 of the LGPD). Write the thesis or the legal situation, without names, documents or other identifiers of people.

To be transparent about what is unavoidable: published decisions and rules may contain third parties' personal data, even with the anonymization applied by the official sources, and we cannot promise a collection free of such data. IAJUS does not build profiles of the people mentioned in the collection and does not make automated decisions with effects on them. The data we process about you, the legal bases and the retention periods are listed in the following sections.

3. What data we collect

We collect only what is needed to give you access to IAJUS, talk to you and run the search:

• BETA sign-up: name, email and phone number, provided by you in the form.
• Contact messages: name, email, organization (optional), subject and the text of the message.
• Access account: email, password (stored only as a hash, never in plain text), your usage plan and your API key (we store only an identifying prefix and a hash, never the whole key).
• Sign-in with Google: name, email (with verification confirmation) and the Google account identifier. We use this data to create or identify your account and to let you sign in.
• Technical data: IP address, browser identifier (user agent) and date/time, recorded for security and to understand how the service is used.
• Collection queries through MCP or a plugin (when you use the IAJUS tools to search decisions, precedents, rules and documents from inside Claude, ChatGPT or another connected platform): the text you type is processed to run the search. In semantic search, it is sent to AI providers to generate the search vector (see section 5) and may stay in the service's temporary memory for up to 24 hours. After automatic filtering, we keep a version of the term for 90 days to diagnose slow queries and improve search; expired terms are deleted in a daily routine. This log also covers collection searches started by Lex and remains separate from the full conversation history. The filtering replaces CPF, CNPJ, OAB references, email and phone number when it can recognize them, but names and other identifiers may remain. For that reason, the term is not anonymous. Access to this log is restricted to authorized staff with an administrative profile. Usage metadata without the query text (tool, filters, date and time, among others) is kept separately, but can be linked to the term through an internal identifier. You can ask for early deletion through the contact in section 8.
• Lex search through MCP or a plugin (standard search and deep search, in beta): here we keep the conversation. The text of your query, the context and constraints you provide and Lex's answer are stored in a history of their own for the MCP and plugin channel, separate from the Studio history, linked to your account and stored encrypted. The conversation can be resumed for 7 days from its creation, with no renewal, and the content remains stored, with no automatic deletion, until you delete it (section 8). The query text is also processed by artificial intelligence models to prepare the answer.
• Conversations with history (chat, deep research and legal filing analysis on the platform, WhatsApp and email): in these channels we keep the content of the conversation (what you write and what the assistant answers) to form your history, so that you can resume and consult it later. This history is linked to your account, is used to provide the service to you, is not sold, does not feed advertising and is not visible to other users. You can delete it whenever you want, all channels at once or just one, and the deletion is real: the content is removed, not hidden (section 8).
• Use of WhatsApp conversations to improve the assistant (during the BETA only): in addition to forming your history, the content of conversations on the WhatsApp channel may be analyzed to improve the answers. This additional use applies exclusively to people who use the WhatsApp channel and only during the BETA period. See section 4 for what we use it for and how we protect this data.
• Product usage to improve it (product analytics), only with your permission: if you allow it, in the app notice or in My account (Minha conta), we record one minimal usage event for each completed collection search and send it to PostHog and Mixpanel. The event contains: the name of the search tool used, the channel (site, MCP, API or unknown), the result (success, partial, incomplete, error or unknown), a duration range, the date and time, technical data about the environment and the system version, and opaque (random) identifiers of your user and of your organization, which only we can link to your account. We do not send the text of your searches, the filters, the documents, your name, your email or your IP address, and we do not record sessions. Without your choice, nothing is sent. The permission applies to the active organization at the time you choose: if you belong to more than one organization, you choose in each. Separately, the system sends Datadog aggregate counts of how that sending is working (events pending, accepted, failed, suppressed, captured, and delay), which do not identify people and do not depend on your choice.

We do not collect sensitive data for marketing purposes and we do not ask for more than what is listed above.

4. What we use it for and the legal basis

• Grant and manage your access to the BETA, your account and your API key: performance of preliminary procedures and of the contract (art. 7º, V) and, for BETA sign-up, your consent (art. 7º, I).
• Tell you about the launch and news: based on your consent (art. 7º, I), which you can revoke at any time.
• Reply to your contact: preliminary procedures at your request (art. 7º, V) and our legitimate interest in assisting you (art. 7º, IX).
• Run the search and send the text of your query to the artificial intelligence providers that support the search: performance of the service you requested (art. 7º, V).
• Keep the history of your conversations in the channels that offer it (chat, deep research and legal filing analysis on the platform, WhatsApp, email and Lex search through MCP or a plugin), so that you can resume and consult them later: performance of the service you requested (art. 7º, V). The history is yours and you can delete it at any time (section 8).
• Security, fraud and abuse prevention, usage logs and diagnosis of slow queries to improve search with filtered terms: legitimate interest (art. 7º, IX).
• Comply with legal obligations and respond to competent authorities: compliance with a legal or regulatory obligation (art. 7º, II).
• Improve the application based on WhatsApp conversations, during the BETA: exclusively for people who use the WhatsApp channel and only while the BETA lasts, we may analyze the content of conversations to improve the quality of answers and fix failures. We process this data with security and minimization, removing direct identifiers whenever possible and without using it for advertising. The legal basis is your consent when you choose the WhatsApp channel (art. 7º, I) and the legitimate interest in improving the service (art. 7º, IX). You can ask us to stop this use at any time at contato@iajus.com.br.
• Understand how the product is used in order to improve it (PostHog and Mixpanel): your consent (art. 7º, I). The choice is optional, applies to the active organization (if you belong to more than one organization, you choose in each) and you can give it in the app notice or in My account and revoke it at any time in My account. When you revoke, we stop sending new events and those not yet sent are no longer sent. When you delete your account, the permission is revoked in every organization in the same operation and pending events are suppressed. What has already been delivered to the providers is subject to each provider's retention period (section 7), unless you ask for deletion at contato@iajus.com.br (section 8).
• Monitor the technical operation of that sending (Datadog): aggregate counts, with no identifiers of people, separate from your analytics choice. They do not involve your personal data.

5. Who we share it with: providers that process data on our behalf (subprocessors)

To work, IAJUS relies on providers that process data on our behalf. This is the complete and current list of who may touch your data, and exactly for what:

We do not sell your data and we do not share it with third parties outside this list. When you sign in with Google, we receive the data described in section 3.

6. International transfer

Some of the providers above (Resend, OpenAI, Google, PostHog, Mixpanel and Datadog) process data outside Brazil, mainly in the United States. These transfers rely on the grounds in art. 33 of the LGPD, in particular the need to perform the service you requested and your consent at sign-up and, for product analytics, your specific consent, given in the app notice or in My account, where the notice itself states prominently, before the choice, that the events are transferred to the United States (art. 33, VIII). As an additional safeguard, PostHog Inc, Mixpanel Inc and Datadog Inc are active participants in the EU-U.S. Data Privacy Framework (dataprivacyframework.gov list, checked on October 23, 2026). We transfer only what is necessary: your email and the content of the email, in the case of Resend, and, in semantic search, the text of your query, in the case of OpenAI and Google, the minimal usage event and the opaque identifiers described in section 3 (only with your permission), in the case of PostHog and Mixpanel, and aggregate counts with no personal data, in the case of Datadog. We prefer providers that offer contractual data protection guarantees compatible with the LGPD. The main database, with your sign-up and your account, is in Brazil (São Paulo).

7. How long we keep it

We keep each piece of data only for as long as its purpose requires:

8. Your rights and how to exercise them

The LGPD (art. 18) guarantees you, in relation to your data, the right to:

• confirm that processing exists and access your data;
• correct incomplete, inaccurate or outdated data;
• request the anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in violation of the law;
• request the portability and the deletion of data processed on the basis of your consent;
• know with whom we share your data (the list is in section 5);
• be informed about the possibility of not giving consent and the consequences of that;
• revoke consent at any time.

How to exercise them:

• Remove your data and your account, and unsubscribe yourself, instantly: use the button request the removal of my data (Portuguese page). You receive a link by email and, when you confirm, we remove your data from our list, delete your account (if you have one) and take you off our communications. All automatic.
• Delete the history of your conversations: ask for deletion at any time at contato@iajus.com.br, for all channels at once or for just one channel (for example, only WhatsApp). The deletion is real: we delete the content of the conversations, we do not hide it. Lex search conversations through MCP or a plugin go when you delete the whole history through Studio, with all channels at once, or when you delete your account; deleting only one channel does not reach them.
• Allow or revoke product analytics: you give the permission in the app notice or in My account and can revoke it in My account at any time. The permission applies to the active organization: if you belong to more than one organization, you choose in each. When you revoke, new sending stops and pending events are suppressed; what has already been delivered to PostHog and Mixpanel follows each provider's retention period (section 7). If you ask at contato@iajus.com.br, we ask PostHog and Mixpanel to delete the events linked to your opaque identifier.
• Other requests, including early deletion of filtered search terms: write to contato@iajus.com.br. We may ask for identity confirmation to protect you, and we reply as soon as possible.

If you believe your rights have not been met, you can file a complaint with the National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD).

9. How we protect your data

Passwords are stored with a strong hash (argon2id), never in plain text. The session cookie is httpOnly and restricted to the site. Connections are encrypted (TLS) and the main database is in Brazil. Even so, no system is 100% immune: if a security incident occurs that may bring you relevant risk or harm, we will notify you and the ANPD within the applicable deadlines, currently within 3 business days, under the ANPD's Security Incident Reporting Regulation (Regulamento de Comunicação de Incidente de Segurança, RCIS).

10. Cookies

We use essential cookies (the login cookie and your theme preference) and, with your consent, audience analytics cookies. The details are in our Cookie Policy (Portuguese page).

11. Changes

This revision, of October 23, 2026, now describes product analytics, which is optional and only with your permission, and the providers PostHog, Mixpanel and Datadog (sections 3, 4, 5, 6, 7 and 8). Nothing is sent to PostHog or Mixpanel without your choice in the app notice or in My account. If we change this policy, we update the date at the top and, when the change is relevant, we notify you on the site. Questions? contato@iajus.com.br.