Data Use and MCP Policy for Partners

Access to customer data, the Tailor.ia platform and the MCP is conditional on a signed and valid partnership agreement between Tailor.ia and the partner. There is no access on an informal basis, as a courtesy, for extended trials or by referral from third parties.

The partnership agreement incorporates by reference this Policy, the DPA, the Terms of Use and the WhatsApp Compliance Policy.

The following are cumulative conditions for enabling the partner:

Partnership agreement signed by the legal representatives and within its term of validity;

Formal designation of a technical lead and an information security lead;

Express acceptance of this Policy by the people who will receive access;

Named registration of the users who will operate the platform or the MCP.

An agreement that is terminated, rescinded, suspended or expired results in immediate cessation of access, with no need for prior notice.

For as long as the partnership lasts, the partner undertakes to maintain, at a minimum:

Multi-factor authentication (MFA) on all accounts with access to the Tailor.ia platform, the MCP and the associated corporate email accounts;

Named, individual accounts — sharing credentials between people, using generic accounts and passing access to subcontractors without prior written authorization are prohibited;

Access revoked within 24 hours upon the departure or change of role of any enabled user;

Managed devices, with encrypted disks, a supported operating system and malware protection;

Network and environment with no public exposure of credentials, tokens or data dumps in repositories, shared spreadsheets or messaging channels;

Access logs kept by the partner for at least 12 months.

Tailor.ia may request documentary evidence of compliance with these requirements at any time.

The Tailor.ia MCP is remote, authenticated per user and isolated per customer: each person accesses only the data of the customers to whom they have been formally linked by Tailor.ia.

Scope per customer: the partner may connect the MCP only to accounts of customers for which there is recorded authorization from both the customer and Tailor.ia.

Permitted hosts: the MCP must be used only on official, up-to-date hosts (Claude Desktop, Claude Code, Cursor and other hosts approved by Tailor.ia). Intermediating the MCP through proxies, gateways or the partner's own agents without prior approval is prohibited.

No shared keys: there is no API key to be passed on. Attempts to extract, replicate, store or share session tokens constitute a serious violation of this Policy.

Automation: automated, scheduled or batch executions over the MCP require prior written authorization from Tailor.ia, with volume and purpose limits defined case by case.

All MCP calls are logged and attributed to the authenticated user.

The data accessed by the partner belongs to the end customer. The partner acts as a sub-processor, processing data exclusively to perform the services contracted by the customer and according to the documented instructions of Tailor.ia and the customer.

Permitted uses: operating and configuring the contracted journeys, analyzing the performance of the customer's own operation, technical support and diagnostics.

The following is expressly prohibited:

Exporting personal data in bulk, except with written authorization and a defined purpose;

Using one customer's data for the benefit of another customer, the partner itself or third parties;

Enriching, cross-referencing or reselling databases obtained via Tailor.ia;

Using customer data to train, fine-tune or evaluate AI models, whether the partner's own or third parties';

Storing data outside approved environments, including local spreadsheets, personal drives and unapproved tools;

Sending messages, running campaigns or making contacts that are not covered by the contracted scope and the data subject's opt-in;

Security testing, scanning or reverse engineering of the platform or the MCP without written authorization.

The principles of purpose, necessity and minimization set out in the LGPD (Brazil's data protection law) apply to the partner: only the minimum data necessary for the task is accessed.

A compromised partner does not operate. If the partner suffers an intrusion, leak, data hijacking (ransomware), or compromise of accounts, devices or credentials — even without evidence of improper access to Tailor.ia data —, the rules below apply.

Notification within 24 hours: the partner must notify Tailor.ia at [email protected] within 24 hours of becoming aware of the incident, stating the nature, identified vector, affected systems and accounts, period of exposure and measures already taken.

Immediate preventive suspension: Tailor.ia suspends the partner's access to the platform and the MCP and revokes active sessions, regardless of whether the incident originates in the partner's systems or those of third parties it has engaged. Suspension is a containment measure, not a sanction, and does not depend on fault.

Self-suspension: upon identifying the incident, the partner must immediately stop using the platform and the MCP, without waiting for a statement from Tailor.ia.

Conditional resumption: access is restored only after the partner submits, and Tailor.ia accepts: an incident report with root cause, proof of containment and eradication, rotation of all credentials involved, reinstallation or sanitization of the affected devices and a remediation plan with deadlines.

Cooperation: the partner must cooperate fully with the investigation, preserve evidence and logs, and support Tailor.ia and the customer in communications to the ANPD (Brazil's National Data Protection Authority) and to data subjects, when required by the LGPD.

Repeated incidents, failure to notify or refusal to cooperate lead to termination of the partnership.

Use of the Tailor.ia brand and the "Tailor.ia Partner" seal on websites, materials, proposals, signatures and social media is a revocable, non-exclusive and non-transferable license, valid only while the partnership is active and in good standing.

Tailor.ia may withdraw the seal and revoke use of the brand, at its discretion and upon notice, in the following cases, among others:

Termination, rescission, suspension or expiration of the partnership agreement;

A security incident that was not reported, was mishandled or is a repeat occurrence;

Violation of this Policy, the DPA or the WhatsApp and anti-spam policies;

Misuse of customer data;

Misleading communication about the scope of the partnership, about non-existent certifications or about results attributed to Tailor.ia;

Conduct that exposes Tailor.ia customers to reputational, legal or security risk.

Once the seal is withdrawn, the partner must remove all reference to the partnership and the Tailor.ia brand within 5 business days, on all its own channels and third-party channels under its control.

Withdrawal of the seal may occur alone or together with suspension of access, depending on the severity of the case.

Tailor.ia logs and monitors the partner's access to the platform and the MCP, including authentications, queries, volumes and usage patterns.

Anomalous patterns — atypical query volume, access outside the authorized scope, hours inconsistent with the operation, attempts at bulk export — may trigger automatic, preventive blocking until clarified.

Tailor.ia may conduct a documentary audit of the partner's compliance with this Policy, with 10 business days' prior notice, or immediately in the event of an incident.

The partner must respond to security questionnaires and evidence requests within 10 business days.

Once the partnership ends, for any reason:

All access, sessions and MCP connections are revoked on the termination date;

The partner must delete, within 30 days, all local copies of customer data obtained via Tailor.ia, and prove the deletion by signed statement;

The Tailor.ia seal and brand must be removed from all channels within 5 business days;

The obligations of confidentiality, data protection and non-use of the databases accessed remain in force after termination.

The return of data to the end customer is handled by Tailor.ia directly with the customer, not by the partner.

This Policy remains in force for as long as the partnership lasts and is part of the agreement signed between the parties.

Material changes are communicated to the partner 30 days in advance. Changes required by law, by order of an authority or by urgent security needs may take effect immediately.

Failure to comply with this Policy subjects the partner, depending on severity and cumulatively, to: formal warning, suspension of access, withdrawal of the partner seal, termination of the agreement and liability for losses and damages caused to Tailor.ia, to customers and to data subjects.

In case of conflict between this Policy and the partnership agreement, the provision that is more protective of personal data and of customer security prevails.