Table of contents
- Scope and precedence
- Who we are and how to contact us
- Our roles: controller and operator
- Legal bases
- Sensitive personal data
- Children and adolescents (LGPD art. 14 and ECA Digital)
- Your rights and how we answer
- Automated decisions (LGPD art. 20)
- International transfers
- Security incidents
- Marco Civil da Internet
- Consumer rights (CDC and Decreto 7.962/2013)
- Language
- Complaints and authorities
1. Scope and precedence
1.1. This Supplement applies to you if you live in Brazil, use our services from Brazil, or if we collect your personal data in Brazil (Marco Civil art. 11; LGPD art. 3).
1.2. It supplements the Privacy Policy, the Terms of Service and the other documents of the SonhoLab Legal Center. It does not repeat them. Read it together with them.
1.3. If this Supplement conflicts with any other SonhoLab document, this Supplement prevails for you. If any clause of any document reduces a right that Brazilian law gives you, that clause does not apply to you.
1.4. Nothing in the Terms of Service or in any other document excludes or limits rights that cannot be excluded or limited under the law that applies to you.
2. Who we are and how to contact us
2.1. Controller. L. M. PEREZ MONTANA, trade name SonhoLab, a Brazilian Empresário Individual (microempresa), CNPJ 61.620.014/0001-00, with its registered address at Rua Fausto Cabral, 871, Casa A, Vicente Pinzon, Fortaleza-CE, 60181-227, Brazil.
2.2. Contact. Email contacto@sonholab.com · Phone +55 85 99412-2292.
2.3. Encarregado (data protection officer). Leandro Manuel Pérez Montañana, reachable at contacto@sonholab.com. The encarregado receives your requests and complaints, talks to the ANPD, and guides our staff (LGPD art. 41; Res. CD/ANPD 18/2024). The encarregado communicates in Portuguese.
2.4. Small-agent relief. Some of our activities are high-risk (voice, health data, children's data, location, AI). For those activities we do not rely on the reduced duties for small processing agents under Res. CD/ANPD 2/2022.
3. Our roles: controller and operator
3.1. Controller (controlador). We decide how and why your data is processed for: sonholab.com, central registration, the control panel, accounts, billing, support, marketing, waitlists, free tools, and our consumer apps (Hades, PDF Free, SonhoLab Poker and other games).
3.2. Operator (operador). When a business customer (a school, clinic, company or other organization) loads personal data into a System, that customer is the controller. We are its operator and follow its documented instructions (LGPD art. 39). The Data Processing Addendum (DPA) governs that processing.
3.3. If your data is in a customer's System. Send your request to that organization first. If you send it to us, we forward it to the organization and help it answer within the legal deadline.
4. Legal bases
4.1. This table maps each purpose of our processing as controller to its legal basis under LGPD art. 7 (and art. 11 for sensitive data). Data categories and retention periods are in the Privacy Policy and the Data Retention Schedule.
| Purpose | Legal basis |
|---|---|
| Create and run your account and your organization's account; central registration; provide the Systems you select | Performance of a contract (art. 7, V) |
| Billing, invoices and tax records | Legal or regulatory obligation (art. 7, II); contract (art. 7, V) |
| Keep application access logs for 6 months | Legal obligation: Marco Civil art. 15 (art. 7, II) |
| Support tickets and service messages | Contract (art. 7, V) |
| Security, fraud and abuse prevention; rate limiting | Legitimate interest (art. 7, IX), balanced against your rights; for sensitive data, fraud prevention and security (art. 11, II, "g") |
| Marketing emails and waitlists | Consent (art. 7, I). You can withdraw at any time through the link in every message. |
| Website analytics (Google Analytics 4) and other non-essential cookies | Consent (art. 7, I). See the Cookie Policy. |
| AI features you use in our consumer apps | Contract (art. 7, V) |
| Hades voice samples and voice models | Specific and highlighted consent of the voice owner (art. 11, I) |
| Hades crisis protocol (detecting risk of self-harm and showing crisis lines) | Protection of life or physical safety (art. 11, II, "e") |
| Legal acceptance records and consent records | Legal obligation and exercise of rights in proceedings (art. 7, II and VI) |
| Defending or bringing legal claims | Regular exercise of rights in proceedings (art. 7, VI; art. 11, II, "d") |
4.2. Legitimate interest. Where we rely on legitimate interest, we only process the data strictly needed, we keep a legitimate interest assessment, and you can object (art. 10; art. 18 §2). Ask the encarregado for a summary of the assessment.
4.3. If you refuse or withdraw consent. You can still use the parts of a service that do not depend on that consent. If a feature cannot work without the data (for example, a cloned voice without voice samples), we will tell you before you decide (art. 18, VIII). Withdrawing consent does not affect processing already done.
4.4. New purposes. If we want to use your data for a purpose that is not compatible with the original one, we will tell you first. Where the basis is consent, we will ask again (art. 9 §2).
5. Sensitive personal data
5.1. As controller, we process sensitive personal data (LGPD art. 5, II) only in Hades:
- Voice. We treat voice samples and voice models as biometric data. We process them only with the voice owner's specific, highlighted consent, given separately from the Terms of Service. The consent names the purpose, the providers, the retention period and the right to revoke. When the voice owner revokes consent, the voice is removed for everyone (the user who created it and all other users) and deleted from all our systems automatically. Hades is not currently offered to the public; access is limited to invited testers.
- Emotional state in conversations. Hades conversations can reveal health or emotional information. We use it only to provide the conversation you ask for and to run the crisis protocol.
- The rules for voices, memorials and companion AI are in the Hades Addendum: Voice, Biometrics, Memorials and Companion AI.
5.2. As operator, our Systems may hold sensitive data that customers load, such as patients' health data (Clínicas) and students' data (Verita). The customer chooses the legal basis. We never use that data for our own purposes and never use it to train AI models.
5.3. Health data. We never share health data to obtain an economic advantage (art. 11 §4). See the Health Data Addendum (Clínicas).
5.4. Deceased persons. The ANPD's position (Nota Técnica nº 3/2023) is that the LGPD does not apply to the data of deceased persons. Their image and voice are protected instead by personality rights (Código Civil arts. 12 and 20, sole paragraphs). The spouse, ascendants and descendants can ask us to remove a deceased person's voice or memorial. The Hades Addendum explains how.
6. Children and adolescents (LGPD art. 14 and ECA Digital)
6.1. Best interest. Every processing of children's or adolescents' data must serve their best interest (LGPD art. 14). Under Enunciado CD/ANPD nº 1/2023, the legal basis can be any of arts. 7 or 11, as long as the best interest prevails.
6.2. ECA Digital. Lei 15.211/2025 (ECA Digital), in force since 17 March 2026 and regulated by Decreto 12.880/2026, applies to digital services aimed at minors or likely to be accessed by them. For those services we apply these rules:
| Rule | How we apply it |
|---|---|
| Age assurance beyond self-declaration | Self-declared age is never our only check. We do not offer an 18+ product to the public in Brazil until an age-assurance method proportionate to the risk, following ANPD guidance, is in place. We use age-assurance data only to check age, and do not keep it longer than needed for that check. |
| 18+ products | Hades and SonhoLab Poker are for adults only. |
| Accounts of users under 16 | An account of a user under 16 must be linked to a parent or legal guardian, with supervision tools. In Verita, the school creates and links these accounts; families and students cannot self-register. |
| Parental consent under 12 | Where consent is the basis for a child under 12, a parent or guardian gives specific consent, and we make reasonable efforts to verify it (art. 14 §§1 and 5). In Verita, the school collects this consent as controller. |
| Most protective defaults | Services likely to be accessed by minors start with the most protective privacy settings. |
| No profiling or targeted ads | We do not profile minors for commercial purposes and do not show them targeted advertising. Verita has no advertising at all. |
| No loot boxes | Our games have no paid random items ("caixas de recompensa", ECA Digital art. 20). |
| Data minimization in games | We do not make participation in a game depend on giving more data than it needs (art. 14 §4). |
| Harmful content | We remove content that violates the rights of children or adolescents when the victim, a guardian or an authority notifies us, without waiting for a court order. We report child sexual abuse material to the competent authorities. |
6.3. Clear information for children. Where a service is used by children, we provide information in simple language suited to their age (art. 14 §6). See the Children and Student Data Addendum (Verita).
6.4. If we learn that a child used an 18+ product, we close the account and delete the child's data, except what the law requires us to keep.
7. Your rights and how we answer
7.1. Your rights (LGPD art. 18). You can ask us to:
- confirm whether we process your data;
- give you access to your data;
- correct incomplete, inaccurate or outdated data;
- anonymize, block or delete data that is unnecessary, excessive or processed in breach of the LGPD;
- port your data to another provider;
- delete data processed with your consent;
- tell you which public and private entities we shared your data with;
- tell you that you can refuse consent, and what happens if you do;
- revoke your consent;
- oppose processing based on a legal basis other than consent, if it breaches the LGPD;
- review a decision taken solely by automated processing (see section 8).
You can also petition the ANPD (art. 18 §1).
7.2. How to ask. Write to contacto@sonholab.com, or use the tools in your account. Data export is always available in your account on every plan. The procedure is in Your Privacy Rights and How to Exercise Them.
7.3. Deadlines. We confirm whether we process your data and give you access immediately in simplified form, or within 15 days as a complete statement (art. 19). We answer the other requests within 15 days as well. If we cannot act on a request, we tell you why within the same period.
7.4. Identity. We may ask you to confirm your identity before we act. We only ask for the minimum needed.
7.5. Free of charge. Exercising your rights is free.
8. Automated decisions (LGPD art. 20)
8.1. You can ask for a review of any decision taken solely on automated processing that affects your interests, including decisions that define your personal, professional, consumer or credit profile.
8.2. When you ask, we give you clear information about the criteria and procedures used, respecting our trade and industrial secrets.
8.3. As controller, SonhoLab does not suspend or terminate accounts by automated means alone (Terms of Service, Section 13.3). Automated tools such as rate limits can block a specific request, not your account.
8.4. Some Systems let customers use automated features, such as a real estate valuation estimate or the order of a collections list. In those Systems the customer is the controller and answers the review request. We help it.
9. International transfers
9.1. Where your data is. Our primary hosting is Hetzner Online GmbH, in Helsinki, Finland (EU), with Hetzner's automated server backups in Finland. An off-site backup copy is encrypted before it leaves the server and is stored on equipment operated by SonhoLab in Brazil.
9.2. Finland and the EU. Brazil recognizes the EU as providing an adequate level of protection (Res. CD/ANPD 32/2026). Transfers to our EU hosting rely on LGPD art. 33, I.
9.3. United States. Some subprocessors are in the US (for example Stripe, Meta, Google for push notifications and analytics, and OpenAI for our own website chat and support desk). AI providers that a business customer connects with its own key are that customer's vendors, and the customer arranges those transfers. For those transfers we use the ANPD standard contractual clauses in Annex II of Res. CD/ANPD 19/2024, adopted in full and without changes (art. 33, II, "b").
9.4. Transparency page. The Portuguese version of Subprocessors and International Transfers is our transfer transparency page under Res. 19/2024 art. 17. It lists each recipient, its country, its purpose and the safeguard used.
9.5. Copy of the clauses. You can ask for the full text of the clauses we use. We send it within 15 days.
10. Security incidents
10.1. If a security incident may create relevant risk or damage to you, we notify the ANPD and you within 3 business days of learning that personal data was affected (LGPD art. 48; Res. CD/ANPD 15/2024).
10.2. The notice to you is in clear language. It describes what happened, the data involved, the risks, what we did, and how to contact us.
10.3. We keep a register of every incident, including incidents we did not have to notify, for 5 years.
10.4. If the incident affects data we process as operator, we notify the customer (the controller) without undue delay, with a target of 48 hours and a maximum of 72 hours after confirmation, so the customer can meet its own deadline. See Security and Incident Response.
11. Marco Civil da Internet
11.1. Your rights as an internet user (art. 7). You have the right to:
- clear and complete information in our contracts;
- not have your data shared with third parties without your free, express and informed consent, unless the law allows it;
- clear information on how we collect, use, store, protect and process your data, and for which purposes;
- a separate, highlighted consent for the collection and use of your data;
- the deletion of the data you gave us for a given application when the relationship ends, at your request, subject to the log-keeping duties below;
- clear publicity of our usage policies.
11.2. Access logs (art. 15). We keep application access logs (date, time and IP address of each access) for 6 months, confidentially and in a controlled, secure environment. We may keep them up to 12 months when a security investigation requires it. We disclose logs only under a court order or as the law requires. See Government and Law Enforcement Requests.
11.3. Brazilian forum (art. 8, sole paragraph). Any clause that prevents you from going to Brazilian courts over services we provide in Brazil is void. You can always sue us in Brazil.
11.4. Content posted by users (arts. 19 and 21; STF Tema 987). Some services store content that users post or share, such as the Hades shared voice library. Under the regime set by the Supreme Court (STF Temas 987 and 533, 2025, confirmed on appeal in June 2026):
- we assess and act on extrajudicial notices about unlawful content, without waiting for a court order;
- for content that may be a crime against honor (defamation, slander, insult), a court order is still required;
- intimate content shared without consent is removed on notice from the person shown or their representative (art. 21);
- we remove a voice from the Hades library within 48 hours of a valid notice;
- you can send a notice, and a user whose content was removed can respond, through the procedure in Copyright and Content Removal Policy.
12. Consumer rights (CDC and Decreto 7.962/2013)
12.1. When the CDC applies. The Código de Defesa do Consumidor (CDC, Lei 8.078/1990) applies when you acquire our services as the final user. It can also apply to a small business customer that Brazilian courts treat as a consumer. Where it applies, this section prevails over any other document.
12.2. Identification (Decreto 7.962/2013 art. 2). Our business name, CNPJ, physical address, email and phone are in section 2 of this Supplement and at the footer of our website.
12.3. Customer service (art. 4). You can send questions, complaints and cancellation requests to contacto@sonholab.com. We answer within 5 days.
12.4. 7-day withdrawal (CDC art. 49). If you contract a paid plan, a subscription or a purchase online, you can withdraw within 7 days of contracting or of first access, whichever is later, without giving a reason.
- We refund everything you paid, including any fees, by the same payment method.
- You can withdraw by email to contacto@sonholab.com.
- If you bought through Google Play or the Apple App Store, you can ask the store for the refund, or ask us directly.
- You cannot waive this right. Any clause saying "no refunds" does not apply to this right.
12.5. Information in Portuguese (art. 31). Information about our products and services for consumers in Brazil is correct, clear, precise and in Portuguese, including prices, characteristics and risks.
12.6. Abusive clauses (art. 51). A clause in any SonhoLab document is void for you, as a consumer, if it:
- excludes or reduces our liability for defects in the service;
- makes you lose amounts already paid;
- transfers our liability to third parties (such as our providers);
- reverses the burden of proof against you;
- imposes compulsory arbitration;
- lets us change the price or the contract, or cancel it, on our own, without an equal right for you;
- is otherwise incompatible with good faith or fairness.
The US arbitration clause and class-action waiver in the Terms of Service do not apply to you.
12.7. Limitation clauses. Clauses that limit your rights appear highlighted in the Terms of Service (CDC art. 54 §4). If a clause is unclear, it is read in your favor (art. 47).
12.8. Forum (art. 101, I). As a consumer, you can bring a claim in the courts of your own domicile. We can only sue you there.
12.9. Business customers. If you are a business and the CDC does not apply, Brazilian law governs, the courts of Fortaleza/CE have jurisdiction, and the liability cap in the Terms of Service applies.
13. Language
13.1. The master text of our legal documents is in English. For consumers in Brazil, the Portuguese (pt-BR) version prevails. If the English and Portuguese versions differ, the Portuguese version applies to you.
14. Complaints and authorities
14.1. Contact us first, if you wish, at contacto@sonholab.com. You do not have to contact us before going to an authority.
14.2. Agência Nacional de Proteção de Dados (ANPD). Lei 15.352/2026 turned the former Autoridade into the Agência Nacional de Proteção de Dados, a regulatory agency. It supervises the LGPD and the ECA Digital. Website: https://www.gov.br/anpd.
14.3. Consumer bodies. You can also go to the consumer protection body (Procon) of your state or city, or to the federal platform consumidor.gov.br.
Version 0.9.0 (preliminary) · Effective 26 September 2026 · © L. M. PEREZ MONTANA (SonhoLab), CNPJ 61.620.014/0001-00. This version is under legal review; we will notify material changes as described in these documents.