PRIVACY POLICY

FORLEX, LLCVersion 5.0Last updated: January 09, 2026

FORLEX, LLC, a company incorporated in Delaware, United States, and its sister company FORLEX Ltda., a legal entity registered in Brazil under CNPJ No. 49.118.347/0001-22 (together, "we", "our", or "FORLEX"), operate together and are committed to protecting the privacy and personal data of users, clients, and other data subjects. This Privacy Policy ("Policy") explains how FORLEX collects, uses, stores, shares, and protects personal data on www.forlex.ai (the "Site") and through the services offered on our platform (the "Services"), in compliance with:

• Law No. 13.709/2018, the Brazilian General Personal Data Protection Law (LGPD);
• Regulation (EU) 2016/679, the General Data Protection Regulation (GDPR);
• Resolutions and guidelines issued by Brazil's National Data Protection Authority (ANPD), as applicable.

By using our Services, you acknowledge that you have read and understood this Policy. If you have questions, contact our Data Protection Officer (DPO) at privacy@forlex.ai.

1. Definitions and Glossary

For the purposes of this Policy, the following definitions are adopted, in compliance with Art. 5 of the LGPD and Art. 4 of the GDPR:

2. Core Principles

This Policy is structured based on the principles of Art. 6 of the LGPD and Art. 5 of the GDPR:

• Purpose: data is collected only for legitimate, specific, and explicit purposes communicated to the data subject. Further incompatible processing is prohibited.
• Adequacy: processing must be compatible with the purposes communicated to the data subject.
• Necessity: processing is limited to the minimum necessary, using relevant, proportional, and non-excessive data.
• Transparency: information about processing must be clear, accurate, and easy to access.
• Free Access: data subjects may obtain free and easy access to information about the form and duration of processing.
• Data Quality: accuracy, clarity, relevance, and currency of the data.
• Security: technical and administrative measures to protect against unauthorized access, destruction, loss, alteration, or dissemination.
• Prevention: measures to prevent harm resulting from processing.
• Non-Discrimination: prohibition of processing for unlawful or abusive discriminatory purposes.
• Accountability: demonstration of the adoption of effective compliance measures.
• Privacy by Design and by Default: data protection is built into system design (Art. 46, §2, LGPD / Art. 25, GDPR), ensuring that only strictly necessary data is processed by default.

3. Our Role as a Data Processor

FORLEX primarily acts as a Data Processor, processing personal data on behalf of, and under the instructions of, its clients (Data Controllers).

This Policy applies when FORLEX is responsible for processing personal data, such as website, account, billing, support, security, and communication data. Customer Content is processed by FORLEX as a Processor on behalf of the applicable client, unless otherwise stated in a written agreement. Requests related to personal data included in Customer Content should generally be directed to the client that controls that content. If FORLEX receives such a request while acting as Processor, FORLEX will forward or redirect the request to the relevant client when appropriate and legally permitted.

3.1. Account Types

• Corporate Client (CNPJ): The organization is the Controller and is responsible for determining the purpose and legal basis for processing its users' data. FORLEX processes this data strictly on behalf of the organization.
• Individual Client (CPF): The individual is the Controller of their own personal data. If they manage additional users, they also act as Controller for that data.

Regardless of the account type, the data subject is always the natural person whose data is processed and retains all rights provided by applicable law.

3.2. Data Processing Agreement (DPA)

FORLEX enters into a DPA with each client, covering: (i) the scope and purpose of processing; (ii) categories of data; (iii) security measures; (iv) conditions for sub-processing; (v) breach-related obligations; and (vi) data return or deletion procedures.

4. No Use of Data for AI Training

FORLEX commits that personal data, usage data, and any content provided or generated by data subjects while using the Services will NOT be used, directly or indirectly, for:

• Training, development, fine-tuning, validation, or improvement of artificial intelligence models, machine learning models, or neural networks, whether by FORLEX or third parties;
• Feeding knowledge bases, linguistic corpora, or datasets intended for the development of natural language processing (NLP) technologies or generative models;
• Any form of data mining or automated pattern extraction to enhance AI algorithms or systems;
• Creating automated behavioral profiles to feed predictive models, except when strictly necessary to provide the service under contract and with the Controller's specific consent.

This prohibition applies to all categories of data processed by FORLEX, including personal data, navigation data, metadata, interaction logs, executed queries, uploaded documents, and generated results. FORLEX requires its sub-processors and AI service providers to follow the same restriction and prohibits them from using data processed through the FORLEX platform to train their models. Any breach of this clause by a sub-processor will be treated as a security incident, handled under Section 12, and will trigger an immediate review of the contractual relationship.

Technical Note: FORLEX may use AI to provide the Services under contract, such as document analysis. This use occurs only at inference time, without retaining or reusing the data for training.

5. Personal Information We Collect

We collect information that can identify a data subject ("Personal Information") in the following scenarios:

5.1. Provided by the Data Subject

• Registration Data: name, email, phone number, job title, company name, and other data needed to create an account.
• Communication Data: name, contact, and message content during interactions with FORLEX.
• Payment Data: billing data processed by a PCI-DSS certified intermediary.
• Support Data: name, email, phone number, and support request information.

5.2. Collected Automatically

• Log Data: IP address, browser, date/time, visited pages.
• Usage Data: features used, time zone, country, user-agent, device.
• Device Data: OS, browser, and settings.
• Cookies: as described in Section 7.

5.3. Social Media

When interacting with our pages on social platforms, we may collect contact data voluntarily provided and receive aggregated analytics from the operators of those platforms.

5.4. Information from Clients and Third Parties

Clients may provide information about their authorized users, such as name, email, role, and organization context, so FORLEX can provide and administer the Services. FORLEX may also receive limited business contact or security-related information from vendors, event organizers, security providers, or other partners where permitted by applicable law and relevant to the purposes described in this Policy.

5.5. Customer Content

Customer Content may contain personal data. FORLEX processes Customer Content to provide the Services, maintain security, support requested workflows, and comply with the applicable client agreement and DPA. Customer Content is not used for AI Training as described in Section 4.

6. Purposes and Legal Bases for Processing

FORLEX does not sell, trade, or rent personal data. We process personal data to:

7. Cookie Policy

FORLEX uses explicit and granular consent for non-necessary cookies, in line with ANPD guidance.

7.1. Classification

• Necessary: essential for operation. Basis: Legitimate Interest. Cannot be disabled.
• Analytical: user behavior. Basis: Consent.
• Advertising: ad personalization. Basis: Explicit Consent.
• Functionality: preferences (language, region). Basis: Legitimate Interest.

7.2. Consent

The cookie banner provides three equal options: Accept All; Reject Non-Necessary; and Manage Cookies, with non-necessary categories disabled by default.

7.3. Mapping

8. Sharing of Personal Data

• Sub-processors: hosting, cloud, payments, and analytics providers. Data is shared only as needed to meet contractual obligations and under the terms of the DPA.
• Business Transfers: mergers, acquisitions, or reorganizations, with appropriate safeguards.
• Legal Obligations: when required by law, regulation, or court order.
• Affiliates: entities under common control with FORLEX, in compliance with this Policy.
• Other Users: actions visible to users within the same organization.
• Connected Tools: when a client or user chooses to connect approved third-party tools, those tools may receive data needed to provide the requested integration and will be governed by their own terms and privacy policies.

8.1. Sub-processor Management

All sub-processors are contractually required to: (i) process data according to FORLEX's instructions; (ii) implement compatible security measures; (iii) not use data for AI training; and (iv) cooperate with audits. A list of sub-processors is available from the DPO upon request.

9. International Data Transfers

• Data may be stored in Brazil, the EU, or the United States, depending on the client's choice.
• Transfers comply with Chapter V of the GDPR and Chapter V of the LGPD.
• Brazil: SCCs from Resolution CD/ANPD No. 19 incorporated into the contract.
• EU: EU-U.S. Data Privacy Framework (DPF) and European Commission SCCs as an additional safeguard.
• Transfer Impact Assessment (TIA): an impact assessment is conducted for each international transfer.

10. Data Subject Rights

Data subjects may have the following rights under the LGPD (Art. 18) and GDPR (Arts. 15-22), including in a B2B context:

• Confirmation and Access (Art. 18, I-II, LGPD / Art. 15, GDPR)
• Rectification (Art. 18, III, LGPD / Art. 16, GDPR)
• Anonymization, Blocking, or Elimination (Art. 18, IV, LGPD/Art. 17, GDPR)
• Portability in structured format (Art. 18, V, LGPD / Art. 20, GDPR)
• Deletion of data processed with consent (Art. 18, VI, LGPD / Art. 17, GDPR)
• Information about Sharing (Art. 18, VII, LGPD)
• Revocation of Consent (Art. 18, IX, LGPD / Art. 7, 3, GDPR)
• Opposition to processing (Art. 18, §2, LGPD / Art. 21, GDPR)
• Review of Automated Decisions (Art. 20, LGPD / Art. 22, GDPR)

Contact: privacy@forlex.ai. We respond within 15 business days, subject to extensions allowed by applicable regulations. Identity verification may be required.

11. Automated Decisions and Profiling

FORLEX may use automated processes to provide the Services. In such cases:

• No decision producing significant legal effects will be based solely on automated processing without human review.
• The data subject can request information regarding criteria and procedures (Art. 20, §1, LGPD).
• Data processed in automated operations is not retained for AI training (Section 4).

12. Information Security

FORLEX uses technical and organizational measures proportionate to the risk (Art. 46, LGPD / Art. 32, GDPR), including:

• Encryption: TLS 1.2+ in transit; AES-256 at rest.
• Access Control: principle of least privilege with MFA.
• Monitoring: IDS/IPS, continuous log analysis.
• Internal Policies: documented with periodic review.
• Training: ongoing team training.
• Audits: vulnerability testing and penetration testing.
• Records: logs of processing operations (Art. 37, LGPD / Art. 30, GDPR).

12.1. Incident Management

In the event of a security incident posing a risk to data subjects:

• Notification to the ANPD within a reasonable time (Art. 48, LGPD).
• Notification to the supervisory authority within 72 hours (Art. 33, GDPR), when applicable.
• Communication to affected data subjects when there is a high risk.
• Full documentation of the incident.

12.2. Impact Assessment (DPIA)

FORLEX conducts a DPIA when processing may result in a high risk (Art. 38, LGPD / Art. 35, GDPR), especially in operations involving new technologies, large scale, or sensitive data.

13. Storage and Data Deletion

Retention period: 5 years or the duration of the contractual relationship (whichever is greater), unless otherwise required by law.

Upon termination:

• Data will be securely deleted or irreversibly anonymized.
• Data in backups will be isolated until final deletion.
• FORLEX retains only what is necessary during the retention period.

14. Children and Minors

The Services are not directed to individuals under the age of 18 (Art. 14, LGPD / Art. 8, GDPR). Inadvertent collection should be reported to privacy@forlex.ai.

15. Links to Third-Party Websites

FORLEX is not responsible for the privacy practices of third-party websites. Data subjects should review the policies that apply to those websites.

16. Changes to this Policy

Substantial changes will be communicated through: (i) publication of the updated Policy on the Site; (ii) email notification; or (iii) a prominent notice on the platform. Continued use indicates acceptance.

17. Communication Policy

Communications are limited to relevant matters. An unsubscribe option is available at any time.

Warning: FORLEX will NEVER ask for passwords or financial data by email or phone. Suspicious communications should be reported to privacy@forlex.ai.

18. Applicable Law and Jurisdiction

This Policy is governed by Brazilian law, including the LGPD. For data subjects in the EU, the GDPR also applies. Jurisdiction is based on the district of FORLEX's headquarters, while preserving any data subject rights to their home jurisdiction under applicable law.

19. Data Protection Officer (DPO)

• Officer: Daniel Bichuetti
• Email: privacy@forlex.ai
• Address: Av Fued José Sebba, 700 - Goiânia/GO - CEP 74805-100

Document generated on 01/09/2026. Replaces all previous versions.