This page records when each legal document of UDISOFTBOX CONSULTORIA E TECNOLOGIA LTDA ("INGESTIA") changed and what changed. It exists for a practical reason: the date of the version you accepted is stored in your environment, and without this record that date would mean nothing to you.
1. How versioning works
- Each document carries, at the top, its last updated date. That date is the version's identifier.
- At the moment a customer accepts the Terms of Use, INGESTIA stores the date of the accepted version alongside their environment. It is not the text that is stored, it is the identifier — and this history is what ties one to the other.
- A material change (one that alters a right, an obligation, a processing purpose, a legal basis or a price) raises the date and enters the table below. A typographical correction or a wording adjustment that does not alter meaning does not raise the date.
- The full text of any earlier version is preserved in the Platform's source code version control, with the date and authorship of every change. You may request the complete text of a specific version through the channel in section 4, and we will send it.
- The Portuguese version is the legally binding one. English and Spanish are courtesy translations, updated alongside it.
2. Timeline
October 5, 2026
A broad revision, prompted by an internal audit that compared every statement in the documents with the system's actual behaviour. Where the two diverged, the system was treated as the truth and the text was corrected — and in some cases the system was corrected so as to deliver what the text promised.
| Document | What changed |
|---|---|
| Terms of Use | Went from 12 to 16 sections. Added: Confidentiality, Customer Indemnity, Customer Cloud (BYOC) and Compliance, sanctions and integrity. Also added: the order of precedence among the documents, the commitment that Customer data is not used to train or fine-tune any AI model, the minimum age of 18, the consumer's 7-day right of withdrawal, the prohibition on using an AI answer as the sole basis for a decision about people, and the requirement of a prior assessment for data of a sensitive nature |
| Privacy Policy | The artificial intelligence, international transfer, retention and cookies sections were rewritten. The AI section now describes the real model: the environment's AI runs with the Customer's own key, and the content sent to the provider is what is described there — including the sending of sample rows, which the previous text denied. Session recording declared. Declared that the audit trail stores the executed SQL, which may contain a filter value |
| Subprocessor List | From 17 to 18 vendors, adding session recording, the AI provider chosen by the Customer, key-value storage and the media partners that were missing. Role, purpose, data and country for each |
| Data Processing Agreement (DPA) | Clarified that, with the Customer's own AI key, the AI provider is not an INGESTIA subprocessor. International transfer rewritten on the art. 33 hypotheses that actually apply, in place of a reference to an annex that did not exist |
| Service Level Agreement (SLA) | New. Response deadlines by severity, internal reliability objectives and what falls outside the commitment — with the written reason why there is no contracted availability percentage |
| Cookie Policy | New. A list by name, purpose and duration, as the ANPD's guidance requires, including the website's own cookies |
| Acceptable Use Policy | New. What acceptable use is, the proportionate measures in the face of a breach, and the safe harbour for whoever reports a flaw in good faith |
| Information Security Policy | New. The existing controls and — in section 13 — what INGESTIA does not have, named |
| Data Retention Policy | New. Deadline, purpose and legal basis per record. The same list the automatic purge routine executes |
| Vulnerability Disclosure Policy | New. Channel, response deadlines and safe harbour |
| Website Privacy Notice | New. The processing of people who visit the website without being Platform users |
| Version History | New. This page |
System changes made on the same day so that the documents would become true, being what the documents describe:
- sending data to the advertising partner from our server now requires advertising consent, and omits IP address, browser and identifiers without it;
- the website's own cookies (
ig_aid,ig_sid,ig_attr) now require consent and are deleted on withdrawal; - account deletion stopped reporting success when it had failed;
- the purge routine for the retention deadlines entered operation — before, the deadlines were declared and nothing executed them;
- the metadata database left the list of processing in the United States: we measured the region and it is São Paulo, Brazil. It was the only statement corrected on this date that was wrong in the more burdensome direction — the data subject read that their account data left the country, and it does not.
June 19, 2026
First publication of the legal documents: Terms of Use, Privacy Policy, Subprocessor List, Data Processing Agreement (DPA) and SaaS Licence Agreement.
The SaaS Licence Agreement remains at this version — it was not altered on October 5, 2026.
3. How you are told about a change
- The new date appears in the document and on this page.
- A material change to the Terms of Use or the Privacy Policy is communicated to active customers through their registered contact channels, with reasonable notice.
- Where the change affects the legal basis or purpose of processing that depends on consent, the decision is asked for again — prior consent is not reused for a new purpose.
- A change that reduces a Customer's rights does not apply retroactively to the period already contracted.
4. Requesting an earlier version
Write to the Data Protection Officer stating the document and the date of the version you want: Encarregado de Dados (DPO) — encarregado@ingestia.io · privacidade@ingestia.io