1. Who is responsible for your data
This Policy explains how [Legal name], a Brazilian company registered under CNPJ [CNPJ], headquartered at [full address] ("Smartfy") processes personal data on the smartfy.cloud website, during purchase and while providing the services, in accordance with Brazil's General Data Protection Law (LGPD) and, where applicable, other data protection laws.
For data collected on the website and in our commercial relationship, Smartfy is the controller. For data our customers host in their applications, Smartfy is a processor (see section 4).
2. What data we collect
- Contact form: name, email, company, phone (optional), interest, plan and message.
- Checkout: name, email, billing details and payment data. Card data is collected and processed directly by Stripe; we have no access to it.
- Onboarding: contact details, tax ID and technical information about the application (domain, repository, data sources).
- Browsing: pages visited, visit source (campaign parameters such as utm_source) and, if you accept cookies, identifiers from measurement and advertising tools.
- Support: the content of conversations by email, chat or WhatsApp.
3. Why we use it and on what legal basis
| Purpose | Legal basis |
|---|---|
| Reply to inquiries and send proposals | Pre-contractual steps at your request |
| Provide the service, bill and support | Performance of contract |
| Issue invoices and meet tax obligations | Legal obligation |
| Security, fraud prevention and website improvement | Legitimate interest |
| Campaign and ad measurement with cookies | Consent |
| Marketing communications about Smartfy | Legitimate interest, with an unsubscribe option in every message |
4. Data hosted by our customers
Data our customers store in their applications and BI instances is their responsibility, as controllers. Smartfy processes it only to provide the service (hosting, backup, monitoring and technical support), under the customer's instructions, and does not use it for any other purpose. If you are an end user of one of our customers, please contact the company responsible for the application.
5. Who we share data with
We share data only with providers needed to operate, and only as much as needed:
- Stripe: payment processing and subscription management;
- Infrastructure and cloud providers: servers, storage, CDN (Cloudflare) and backups;
- Form and email delivery service: receiving website messages;
- Invoicing provider: issuing invoices;
- Measurement and advertising tools (such as Google Analytics, Meta and TikTok), only with your consent;
- Public authorities, when required by law or court order.
We do not sell personal data.
6. International transfers
Some providers (such as Stripe, Cloudflare and measurement tools) may store data outside Brazil. Such transfers follow article 33 of the LGPD, based on contractual clauses and the safeguards these providers offer.
7. Cookies and similar technologies
We use two kinds of browser features:
- Essential: store your language and cookie choices and the visit source in the browser's local storage. They do not require consent.
- Measurement and marketing: Google Analytics, Meta pixel and TikTok pixel, used to measure visits and campaign conversions. They load only if you click "Accept" in the cookie notice.
You can change your choice anytime through the "Cookie preferences" link in the footer, or by clearing this site's data in your browser.
8. How long we keep data
- Inquiries that did not become customers: up to 12 months after the last contact.
- Customer data: for the duration of the contract and then for the period required by law (for example, 5 years for tax records in Brazil).
- Data hosted by customers: deleted 30 days after the contract ends, as set out in the Terms of Service.
9. Security
We apply technical and organizational measures to protect data: encryption in transit (HTTPS/TLS), need-to-know access control, strong authentication on internal systems, backups and monitoring. No system is fully immune to incidents; if a relevant incident occurs, we will notify affected individuals and the authorities as required by law.
10. Your rights
You may request: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data; portability; deletion of data processed based on consent; information about sharing; and withdrawal of consent.
To exercise your rights, email [email protected]. We reply within 15 days. You may also file a complaint with Brazil's National Data Protection Authority (ANPD) or your local data protection authority.
11. Data Protection Officer
Data Protection Officer: [DPO name]. Contact: [email protected].
12. Changes to this Policy
We may update this Policy. The last update date appears at the top of the page. Material changes will be communicated to customers by email.