Privacy Policy

01Who we are and what this policy covers

anonimiza.ai is an enterprise document protection platform, available at https://shinra.anonimiza.ai. Companies hire us to encrypt, redact and trace documents in their own repositories, which stay where they already are: Google Drive, SharePoint, OneDrive or a file server.

This policy covers this website, the web application and the integrations with repository providers, including Google Workspace and Google Drive.

Two distinct roles apply here, and the distinction decides who a request should be sent to:

• Regarding the CONTENT of a customer company documents, we act as a processor. The customer company decides what is processed and why, and is the controller. We act on its instructions.
• Regarding the data of the people who use the platform (name, corporate e-mail, access logs) and the data collected on this page, we act as the controller.

02Which Google data the app accesses, and why

Access only exists after the company Google Workspace administrator grants it on the Google consent screen. We request these scopes, and no others:

A person reading a document signs in with their own Google account and grants only openid, email and drive.install. None of them gives access to files: they confirm who is reading and add anonimiza.ai to that person's Drive "Open with" menu.

We do not request scopes the product does not use. If a new feature requires another scope, it only takes effect after a new administrator consent.

When someone clicks "Open with anonimiza.ai" inside Drive, Google sends us only the file identifier, the action and the user identifier. We read that file. Beyond it, the platform lists the folders the administrator marked as watched, in order to detect new documents that need protection. No other part of the repository is read.

03How we use this data

Information received from Google APIs is used only to deliver the features the company hired us for:

• Encrypting the document at rest, inside the customer own repository.
• Redacting: masking the sensitive fields that the reader group is not allowed to see.
• Applying the traceability watermark, which allows a leak to be attributed to the reader and to the moment they opened the document.
• Recording processing operations, which is what supports the company compliance reporting under Brazilian data protection law.

And for nothing else. Specifically:

• We do not sell personal data and we do not share it with data brokers.
• We do not use this data for advertising, remarketing or profiling.
• We do not use document content, nor Workspace data, to develop, train or improve generalized artificial intelligence or machine learning models.
• Nobody on our team reads document content, except in the cases described in the next section.

04Limited Use of Google API data

In practice, this means:

• We use information received from Google APIs only to provide and improve user-facing features inside anonimiza.ai.
• We do not transfer this information, except as necessary to provide or improve those features, to comply with applicable law, or as part of a merger or acquisition, and in that case with prior notice and consent.
• We do not use this information for advertising purposes of any kind.
• We do not allow humans to read this information, unless we have the user express consent, for security purposes (such as investigating abuse or an incident), to comply with applicable law, or when the data is aggregated and anonymized for internal operations.

05Where the document travels

The cleartext document does not stay with us. Reading happens in server memory, in this order, and nothing from the original is written to disk on our side:

1. The platform downloads the file from Drive, using the token from the connection the administrator authorized.
2. It decrypts the file, if it is already protected in the vault.
3. It classifies the sensitive fields and applies redaction according to the reader group.
4. It applies the traceability watermark.
5. It serves the modified document to the reader.

When the native Drive preview needs a file to open, the platform creates a temporary copy, already redacted and watermarked for the person who opened it, prefixed with ~anon-. It is created in an area of the company connection account (that account's My Drive, on Google; a dedicated folder in its OneDrive, on Microsoft), outside any shared folder, and is shared only with the verified email of the person who opened it. Any other permission is removed; if one cannot be removed, the copy is deleted and the opening is refused. It is deleted when the tab closes, and a sweeper periodically scans that area to remove anything left over from an interrupted session

Sensitive field classification runs in one of two modes, according to the plan the company contracted:

• Cloud mode: content is sent to our classification engine and, within it, to Google Cloud Vertex AI in a United States region. Under the Google Cloud terms, content sent to Vertex AI is not used by Google to train models.
• On-premise mode: classification runs entirely inside the customer perimeter, on models served by their own infrastructure. Content never leaves the company network.

06Chrome extension for Google Drive

The "anonimiza.ai para Google Drive" extension is installed by the company Google Workspace administrator. It makes a double-click (or the Enter key) on a .senv file in the Google Drive file list open the document in anonimiza.ai, including in shared drives.

It collects, stores and sends no data. On the Drive page it reads only the name and identifier of the item the person activated, and only to tell whether it is a .senv file; when it is, it opens an anonimiza.ai tab with that identifier, and from there the sign-in and the rules of this policy apply. It does not read file content, does not act on other sites and does not load code from outside the published package.

The only setting it reads is the platform address, when the company administrator defines it through a managed Chrome policy.

07What we store, and for how long

We store the minimum needed for the product to work and for the company to be able to demonstrate compliance. Concretely:

08Who we share data with

We do not sell personal data. Sharing happens in three situations, and in none of them does the recipient receive data for its own purposes:

• With the customer company itself, which owns the repository and controls the content.
• With infrastructure vendors strictly necessary to operate the service: Amazon Web Services, where the application and the database run, and Google Cloud, when cloud mode classification is used. They process data only under our instructions.
• With public authorities, when required by law or by court order. In that case we notify the customer company, unless the law itself forbids the notice.

09Security

• Traffic encrypted in transit, with TLS.
• Tokens and secrets encrypted at rest, with keys held outside the database.
• Production access restricted to the responsible team and logged.
• Fail-closed behavior: when the platform cannot determine with certainty the group of the person reading, it redacts everything rather than risk showing too much.
• Per-customer segregation: each connection answers for a single Workspace, and a click that does not match a known domain is refused with a clear message instead of landing on the wrong customer.

No system is infallible. In the event of a security incident with relevant risk, we notify the customer company and the competent authority within the legal deadlines.

10How to revoke access and request deletion

The company can end our access at any time, through any of these paths:

• Disconnecting Google Drive inside the platform itself, under Integrations.
• Removing the app at myaccount.google.com/permissions.
• Removing the installation in the Google Workspace Admin Console, which applies to the entire domain.

Revoking stops access immediately: tokens stop working and no new operation takes place. To also erase what is already stored, write to [email protected]. Deletion is completed within 30 days, except for what the law requires us to keep.

11Data subject rights

Brazilian data protection law grants data subjects confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, and withdrawal of consent. People in the European Union have equivalent rights under the GDPR.

When the request concerns the content of a customer company document, that company is the controller and the request should be addressed to it: we support the response, and the platform has a dedicated flow to receive and answer such requests. When the request concerns your own platform usage data, contact us directly at [email protected].

12International transfers

The platform runs on infrastructure located in Brazil. There are two exceptions, both described above: cloud mode classification uses Google Cloud Vertex AI in a United States region, and the Google APIs themselves are global services. These transfers rely on the vendors contractual clauses and on the legal bases of article 33 of the Brazilian data protection law.

13Minors

anonimiza.ai is an enterprise product, contracted by companies and used by their employees. It is not directed to anyone under 18 and we do not knowingly collect data from children or adolescents.

14Changes to this policy

When this policy changes, the effective date at the top changes with it. Material changes are communicated to customer companies before they take effect, and any change that broadens the use of data received from Google APIs requires new administrator consent, not merely a rewrite of this page.

15Contact

For anything related to this policy, including data subject requests and incident reports: [email protected].