Last updated: September 10, 2026 · Version 2.3

Privacy Policy — ARBON Platform

In accordance with Law No. 13.709/2018 (LGPD — Brazil's General Data Protection Law) and Law No. 12.965/2014 (Brazilian Civil Rights Framework for the Internet).

Translation notice. This is an English-language translation of ARBON's Privacy Policy, provided for convenience only. This Policy is governed exclusively by the laws of Brazil, in particular the LGPD. It describes ARBON's data-protection practices under Brazilian law and is not a representation of compliance with the GDPR, the CCPA, or any other jurisdiction's data-protection framework. In the event of any conflict, ambiguity, or divergence between this translation and the original Portuguese-language document, the Portuguese version prevails and is the only legally binding text.

This Privacy Policy describes how ARBON TECNOLOGIA EM RECRUTAMENTO LTDA ("ARBON", "we"), CNPJ 67.821.928/0001-08, collects, uses, shares, and protects personal data in connection with the interview behavioral analysis platform available at arbonhr.com ("Platform"), the ARBON Live browser extension, and our websites.

This Policy is an integral part of the Terms of Use. Acceptance of both documents is recorded electronically on each user's first access.

Data Protection Officer (DPO): Gustavo Gobato Alves da Silva — arbon@arbonhr.com

1. Our two roles (and why it matters to you)

When ARBON is the Controller. With respect to the data of Platform Users (recruiters, managers, and administrators at client companies), the data of visitors to our websites, and the data of business contacts, ARBON decides the purposes and means of processing and acts as the data Controller.

When ARBON is the Processor. With respect to the data of Candidates — the individuals whose interviews are submitted to the Platform — ARBON processes the data on behalf of and under the instructions of the client company, which is the Controller. It is the client company that defines the purpose of processing and that has the duty to obtain consent, or another valid legal basis, from each Candidate before submitting any interview to the Platform. ARBON contractually requires this commitment and provides consent mechanisms (such as the confirmation dialog in the ARBON Live extension), but does not stand in for the client company in fulfilling this obligation.

When the Client is an individual person. Not every Client of the Platform is a company: a recruiter, headhunter, or recruitment and selection professional may contract the Platform individually, in their own name, with no legal entity registered as the Client. In that case, that individual person themself takes on the role of Controller for the data of the Candidates they submit to the Platform — with the same duties assigned, throughout this Policy, to the "client company": defining the purpose of processing, obtaining consent or another valid legal basis from each Candidate before submitting any interview, and answering for that processing before the Candidate and the ANPD. Every reference in this Policy to "client company" should be read as a reference to the Client, whether a legal entity or an individual person. Unlike when the Client is a company — which can distribute this responsibility internally across HR, legal, and managers —, when the Client is an individual person this responsibility falls entirely on that individual, with no intermediation. For this reason, contracting by an individual Client requires prior electronic confirmation that they hold this authorization (Terms of Use, Clauses 4.5 through 4.7).

If you are a Candidate and wish to exercise your rights over data processed on the Platform, the primary path is the Client (company or individual person) that conducted your selection process. You may still contact us at arbon@arbonhr.com: we will forward your request to the responsible party and provide the technical support necessary to assist with it.

2. What data we process

User registration data (Controller): name, email (corporate or professional), company (when applicable), job title, phone number, password (stored only as a cryptographic hash).

Usage and security data (Controller): date and time of access, IP address, user agent, actions taken on the Platform (audit logs), and records of acceptance of the Terms of Use and this Policy (version, date, time, IP).

Interview content (Processor): audio, video, or text submitted by the client company, the resulting transcripts, and the analytical reports derived from them. This content may contain personal data of Candidates and interviewers and, in some cases, sensitive data, to the extent the Candidate mentions it during the interview. ARBON does not request or require sensitive data.

No media is stored. Audio, video, and image files — whether captured by the ARBON Live extension or submitted by upload — are used exclusively to generate the transcript and are permanently discarded immediately after processing. ARBON does not record, retain, or keep a copy of any original media. The only content that remains on the Platform is textual (transcripts and reports), encrypted, under the client company's control, which may delete it at any time.

Payment data (Controller): processed by a certified third-party payment processor (PCI-DSS standard). We do not store full card numbers.

Website browsing data (Controller): cookies and identifiers, as described in section 12.

The Platform is B2B and is not intended for individuals under 18 years of age, whether as Users or as Candidates.

3. Legal bases (art. 7 of the LGPD)

• Performance of a contract: operating the Platform, authentication, support, billing.
• Legitimate interest: information security, fraud prevention, audit logs, service improvement using aggregated and anonymized data, communication with B2B business contacts.
• Consent: marketing communications (opt-in, revocable at any time) and non-essential cookies.
• Compliance with a legal or regulatory obligation: retention of access logs (art. 15 of the Marco Civil da Internet), tax and accounting obligations.
• Regular exercise of rights: retention of acceptance records and contracts.

In our role as Processor, we handle Candidate data according to the instructions and legal basis established by the client company acting as Controller.

4. What we use the data for

Providing and operating the Platform; generating transcripts and analytical reports; authentication and access control; transactional communications (service notices, completed reports, billing); support; billing; security, auditing, and fraud prevention; compliance with legal obligations; product improvement, as described in section 6; and, with consent, marketing communications.

We do not sell personal data. Ever.

5. How artificial intelligence works at ARBON

5.1. The Platform applies artificial intelligence models to interview transcripts to generate a behavioral score, alerts with textual evidence, consistency analysis, and suggested questions.

5.2. Decisions are human. ARBON does not make hiring decisions. Reports are inputs that support decision-making. Client companies contractually commit to ensuring human review of decisions, and data subjects have the right to request review of decisions made solely on the basis of automated processing (art. 20 of the LGPD).

5.3. Bias-resistant design. The Platform is built not to infer or use gender, race, age, or social class as an analysis factor. The analysis is based on the verbal content of the interview — what was said and how it was structured.

5.4. Use for calibration and improvement. ARBON uses data derived from use of the Platform — interviews, transcripts, behavioral analyses, scores, alerts, and feedback — exclusively in anonymized and aggregated form, with no possibility of re-identifying Candidates or client companies, to calibrate, evaluate, and improve its analysis workflows and to produce statistics and benchmarks. Identifiable data and sensitive personal data (art. 5, II of the LGPD) are never used for this purpose. The AI model providers engaged by ARBON do not use submitted data to train their own models, in accordance with those providers' commercial terms. The client company may revoke this authorization at any time, by written notice to arbon@arbonhr.com, ceasing the use of new data as of receipt of the revocation, without prejudice to the use, in anonymized form, already made up to the date of revocation.

6. ARBON Live browser extension

The ARBON Live extension (Chrome) integrates the Platform with video calls on Google Meet, Zoom Web, and Microsoft Teams Web. Specific rules apply:

• Consent comes first: capture only begins after the User explicitly confirms in a dialog shown at the start of each new session. It is the User's responsibility to ensure that all meeting participants have been informed of, and have consented to, the recording/analysis before it starts.
• Audio is never stored: the tab's audio is streamed over encrypted transport (TLS) to the transcription provider and discarded immediately after processing. We do not record, persist, or give third parties access to the original audio.
• Transcript: the resulting text is encrypted and associated with the client company's account, which may delete it at any time.
• Permissions: the extension requests only the permissions necessary for it to function (tabCapture, activeTab, storage, scripting, offscreen, and host permissions for Meet/Zoom/Teams and for the ARBON API), each used exclusively for the purpose described in the Chrome Web Store listing.
• Local storage: only the authentication token, to avoid requiring a new login on every use. No history, transcript, or additional metadata is kept in the browser.
• No advertising tracking and no sharing of data for third-party marketing purposes.

7. Who we share data with (sub-processors)

We use providers that process data on our behalf, under contract, with security and confidentiality obligations consistent with this Policy:

Each row corresponds to a single contracted provider, under security and confidentiality obligations consistent with this Policy. The name of the infrastructure, transcription, payment, and email providers is available upon request to arbon@arbonhr.com, including for client audit or due-diligence purposes.

The application, API, database, and file storage are operated directly by ARBON, on its own infrastructure contracted from a hosting provider, without intermediation by third-party managed database or storage services.

Beyond these sub-processors, data may be shared: (a) with public authorities, pursuant to a legal obligation or an order from a competent authority; (b) in corporate transactions (mergers, acquisitions), with the protections of this Policy remaining in effect; (c) for the regular exercise of ARBON's rights in judicial or administrative proceedings.

The list of sub-processors may be updated; the current version will always be on this page. Material changes will be communicated to clients.

8. International transfer

The Platform is hosted entirely within Brazilian territory. The application, API, database, and stored files reside on a server located in Campinas/SP, Brazil.

International transfer occurs only in processing carried out by specific sub-processors: audio transcription, Anthropic (AI analysis), and payment processing (the name of the remaining providers is available upon request — see section 7). These transfers are based on art. 33 of the LGPD, under contractual clauses that ensure a level of protection compatible with Brazilian law. In the case of transcription, audio is transmitted as a stream and discarded after processing, with no storage abroad.

9. How long we retain data

• Interview audio, video, and images: not stored — permanently and immediately discarded after the transcript is generated, both in the ARBON Live extension flow and in the upload flow. No copy of the original media exists in ARBON's systems.
• Interview content (transcripts and reports): for the duration of the client's contract, or until deleted by the client on the Platform. After the contract ends, retained for up to 90 days solely for export and portability, and then permanently deleted, unless a legal retention obligation applies.
• Trial ended without a purchase: data available for export for 30 days, then deleted.
• Registration data and contractual records (including acceptances): for the duration of the relationship and for up to 5 years after it ends, to comply with legal obligations and for the regular exercise of rights.
• Access and audit logs: a minimum of 6 months (art. 15 of the Marco Civil da Internet), retained for up to 12 months.
• Marketing data: until consent is revoked.

10. Your rights (arts. 18 and 20 of the LGPD)

You may request, at any time: confirmation of whether processing exists; access to your data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessive data; portability; deletion of data processed with consent; information about data sharing; information about the possibility of not consenting and its consequences; withdrawal of consent; and review of decisions made solely on the basis of automated processing.

Channel: arbon@arbonhr.com, addressed to the Data Protection Officer. We respond within 15 calendar days. We may request proof of identity to protect your data against fraudulent requests.

If you are a Candidate, we will direct your request to the Controller company for your selection process and provide technical support for handling it (section 1).

You may also file a complaint with ANPD — Brazil's National Data Protection Authority (gov.br/anpd).

11. How we protect your data

We adopt technical and organizational measures consistent with the state of the art, including: encryption in transit (TLS 1.2+) and at rest; passwords stored with a strong cryptographic hash; authentication with short-lived tokens; role-based access control (RBAC) with ownership validation on every route; isolation between client accounts (multi-tenant); rate limiting; audit logging and monitoring; the principle of least privilege for internal access; and periodic security assessments, including penetration testing conducted by independent third parties.

Upon a client company's written request, ARBON will provide a specific document detailing its security architecture and the infrastructure providers used in delivering the services.

No system is immune to incidents. In the event of a security incident posing a material risk or harm to data subjects, we will notify affected clients within 72 hours of becoming aware of it, and notify the ANPD and data subjects as required by, and within the timeframes of, art. 48 of the LGPD.

12. Cookies

On our websites we use: (a) essential cookies, necessary for authentication and functionality (legal basis: performance of a contract/legitimate interest); and (b) analytics and marketing cookies, only with consent, manageable through the cookie banner and your browser settings. Declining non-essential cookies does not prevent use of the Platform.

13. Changes to this Policy

Material changes will be communicated at least 30 days in advance, by email and/or notice on the Platform, and will require a new electronic acceptance from Users. Each version is numbered and dated; the version history is available upon request.

14. Contact

ARBON TECNOLOGIA EM RECRUTAMENTO LTDA · CNPJ 67.821.928/0001-08 Data Protection Officer (DPO): Gustavo Gobato Alves da Silva — arbon@arbonhr.com