Privacy policy

Forward Intelligence, LLC (United States) and Forlex Ltda. (Brazil)

Version 6.4.1 | 15 October 2026

Who is responsible for your data

This policy explains how personal data is handled when you visit our websites, create an account or use our services, including enabled AI features and connected tools.

Forlex Ltda. (Brazil), CNPJ 49.118.347/0001-22, is the controller for forlex.ai and its public contact forms. Forward Intelligence, LLC (United States) is the controller for forwardintelligence.ai and fwdi.ai and their public contact forms. For other activities, the applicable collection notice and agreement identify the responsible entity. You can contact that entity through the privacy channels below.

For our own account administration, billing, communications, support and service security, we determine the purposes of processing where we act as controller. When we process customer documents, prompts, outputs and related content under a customer's instructions, our role follows the applicable agreement and data processing addendum. The customer may be responsible for deciding how that content is used. If your request concerns customer-controlled content, we will help direct it to the appropriate customer where legally permitted.

We adopt the most protective compatible requirement across LGPD, GDPR and CCPA, as amended by CPRA, as our common privacy standard. The duties applicable to each activity depend on its facts, the entity's role and the relevant jurisdiction. Mandatory retention and legal holds continue to apply.

What data we process and why

Depending on the website or service you use, data may include:

• Identity and professional contact details, account preferences and access information.
• Authentication records, device information, IP addresses and security logs.
• Billing and transaction records, support messages and service-use metadata.
• Customer content, including prompts, documents, outputs and associated indexes. This content may include personal data about other people and sensitive personal data.

We process data to provide the requested service, authenticate accounts, administer billing and statutory records, answer support requests, prevent fraud, protect services and send permitted communications. Processing must have an applicable legal basis. Depending on the activity, this may be performance of a contract, a legal obligation, legitimate interests or consent, subject to the conditions of the applicable law. Sensitive personal data requires the specific grounds and safeguards applicable to it.

Additional notices apply where an institutional channel, citizen service, integration or other feature has a distinct processing purpose. Information made publicly available remains subject to applicable privacy protections.

AI features and restrictions on model training

AI features process inputs and generate outputs to deliver the response or function you request. Our policy prohibits using customer content, personal data, service-use data, metadata, interaction logs and generated results to train, fine-tune, validate or improve AI models. We require providers processing these data for our services to observe the same restriction. Verification of provider contracts and settings has not yet been completed for every provider. Contact our privacy team for the provider-specific safeguards and review status relevant to your service.

AI outputs can be inaccurate or incomplete. They require human review appropriate to the intended use. Where automated decisions affect a person's rights or interests, the applicable review, explanation and other legal safeguards must be respected. Separate research or model-development activities require their own lawful sources and purposes; this policy grants no permission to reuse customer data for those activities.

Cookies and privacy choices

Necessary technologies support website functions and security. Optional browser analytics, advertising and session recording on this website are currently paused. The privacy preferences available in your browser can record rejection or withdrawal; they do not enable those paused purposes.

Where consent is required for non-essential tracking, you can refuse it or withdraw it. Where CCPA/CPRA applies, you may exercise the applicable sale or sharing opt-out and sensitive-information rights, including through qualifying opt-out preference signals. You do not need to create an account to exercise those choices. Consent for one purpose does not waive another privacy right. Contact our privacy team for assistance with a choice that is not available through your service's interface.

Recipients and international processing

Our services may involve authorised hosting, authentication, communications, support, billing and AI providers, connected tools you choose, professional advisers and authorities where disclosure is legally required. Optional integrations receive the data needed for the selected function under the applicable terms.

Hosting locations, international transfers and remote access depend on the service and its providers. They require the applicable legal mechanism and safeguards for the specific route, including onward transfers. You may request information about the recipients, locations and safeguards relevant to your data at privacy@forlex.ai or privacy@fwdi.ai.

Retention and security

Retention depends on the data category, purpose, applicable agreement and legal requirements. Data should be deleted or returned when its authorised purpose ends, subject to lawful retention, legal holds and the applicable backup expiry cycle. Data retained for a legal duty must remain restricted to that duty. Contact our privacy team for the retention period or criteria relevant to your data.

Our security program requires measures proportionate to the risk, including authorised access, protection of data and backups, logging, incident response and verification of deletion. If an incident triggers a legal or contractual notification duty, we provide the required communications under the applicable rules.

Your privacy rights

Depending on the applicable law, you may request confirmation and access, correction, deletion, anonymisation or blocking, portability, information about sharing, withdrawal of consent, objection or restriction, and review of relevant automated decisions. You may also complain to the competent supervisory authority. We do not unlawfully discriminate against you for exercising a privacy right.

California consumers covered by CCPA/CPRA may request the categories and specific pieces of personal information collected about them, correction and deletion, opt out of sale or sharing for cross-context behavioural advertising, and limit covered uses or disclosures of sensitive personal information. An authorised agent may act on your behalf under the applicable rules. Sale or sharing opt-outs do not require identity verification.

Requests are free and do not require an account, Trust Center access or a confidentiality agreement. Where identity verification is needed, it must be proportionate to the request. Please do not send unnecessary identity documents or personal data about other people.

Response times

Under LGPD, confirmation and access follow article 19: a simplified immediate response or a complete response within 15 days, as applicable. Other rights follow their applicable rules. Under GDPR, we generally respond within one month of receipt; a justified extension of up to two further months requires notice within the first month.

For covered CCPA requests to know, correct or delete, acknowledgement is due within 10 business days and a response within 45 calendar days of receipt. A justified further 45 days requires an explanation and notice. Applicable sale or sharing opt-outs and sensitive-information limits must be fulfilled as soon as feasible and within 15 business days.

Where duties overlap for the same request, the earliest applicable deadline applies to the same obligation. Identity verification does not restart a deadline that runs from receipt. If a lawful exception, refusal or extension applies, we explain it as required.

Children and adolescents

Customer documents and institutional services may include data about children and adolescents. Processing such data requires the applicable age safeguards, lawful basis, transparency and attention to their best interests. Contact our privacy team about the safeguards applicable to a specific service or concern.

Our privacy officer and contact channels

Rafael Maciel, of Lara Martins Associados, is the Group's external LGPD officer, engaged as DPO as a Service. He also supports GDPR and CCPA/CPRA privacy matters within the contracted scope.

Send questions or rights requests to privacy@forlex.ai or privacy@fwdi.ai. Requests received through these channels are forwarded to our legal teams and Rafael Maciel. If you cannot reach a privacy channel, contact legal@forlex.ai or legal@fwdi.ai.

Updates to this policy

We review this policy at least annually and when our processing, providers, legal duties or contact details change materially. We communicate relevant changes through the applicable channels. Using a service or reading this policy does not provide blanket consent to every processing purpose.