Privacy Policy

1. Who controls your data

The controller is Colabtec Digital LTDA, CNPJ (Brazilian company tax ID) 65.787.255/0001-91, headquartered at Alameda Rio Negro, 503, sala 2020 — Alphaville, CEP 06454-000 — Barueri, SP — Brasil. Website: https://colabtec.com.

The channel for the officer in charge of personal data processing (art. 41 of the LGPD, the Lei Geral de Proteção de Dados or Brazilian General Data Protection Law) is [email protected] — the same address as customer service, and that is deliberate: until there is a dedicated address that someone reads every day, we do not advertise one.

Part of the operation takes place in China, at Zhuhai Colabtec Technology Co., Ltd.. The international transfer section explains what that means.

2. When you fill in a form

When you ask to be contacted about a product you fill in a form. We keep the answers to understand and respond to your request, and for nothing else. The basis is art. 7, V, of the LGPD: preliminary procedures related to a contract, at the data subject's request. It is not consent — which is why answering your request does not depend on you ticking any box.

• The team's notes about your request are personal data of yours: you may ask for access to them, and we hand them over. We do not treat an internal note as a secret that can be withheld from you.

3. We do not ask for sensitive data, and please do not send it

The form fields are free text: you can type anything into them, including what we did not ask for.

We do not request sensitive data: racial or ethnic origin, religious belief, political opinion, union membership, health, sex life, genetic or biometric data (LGPD art. 11). Nor do we ask for your CPF (Brazilian individual taxpayer ID) or your passport at this stage. Please do not include them.

If something like that comes in, we delete the excess as soon as we notice, and you may request erasure at any time (art. 6, III, and art. 18, IV). Our products are aimed at adults: we do not offer accounts to anyone under 18 and we delete data of a child or adolescent received without the support of art. 14 of the LGPD.

4. Account and passwordless login

Sign-in is by magic link: you type your e-mail, we generate a random code, send the link and store in the database only its cryptographic digest, never the code. The link is valid for 15 minutes and is deleted once used.

5. Activity logs

We record a trail of what happens in the account: sign-in, account creation, requests for a new link, lockout after too many attempts, and our team's actions on a service request. Each record stores who did it, about whom, the IP address, the action, the date and the time, plus technical data about the event.

It serves to investigate abuse, sustain security and prove who did what. And nothing else: we do not profile you, we do not run advertising and we do not measure engagement with it. Basis: art. 7, IX and VI, and, as to access logs, art. 7, II together with art. 15 of the Marco Civil. Internal rule: the technical field of the record takes no request body and no form content.

6. E-mails

We send four kinds of e-mail: the confirmation that we received your request, the link to sign in to your account, the confirmation of an account deletion request, and the internal alert to our team. We do not send newsletters or campaigns unless you ask for them, through a separate opt-in that is revocable in one click.

We also keep a record that the message went out, with the type, the outcome and the provider's error when there is a failure — without the destination address, only the reference to the service request. It exists because we have to prove that we confirmed receipt of your request (Decreto 7.962/2013, Brazil's e-commerce decree, art. 4, III and VI) and because it is how we find out that an e-mail did not arrive. Basis: art. 7, II and IX.

We also keep a suppression list: if your address rejects our messages or you mark them as unwanted, we record the address and the reason, and we stop writing. It survives the deletion of your account, and it has to — erasing the row would make the system start writing to you again. This is the exception in art. 16, I, and we keep the bare minimum.

7. Cookies

We use one cookie, and it is strictly necessary: the session cookie, which keeps you signed in after the magic link. It holds an opaque value, is inaccessible to JavaScript, lasts 30 days, and in the database only its cryptographic digest exists. Basis: art. 7, V — it does not depend on consent. There is also an authentication cookie for our team in the administrative area, which never touches site visitors.

There is no advertising, audience measurement or third-party tracking cookie on this site. That is why there is no cookie banner here: asking permission for tracking that does not exist would be misleading information.

We do count how many times each page is opened — and nothing beyond that. The count is one number per day, per page, per language, per country and per link origin, added into a counter; there is no cookie, no identifier, no way to know that two openings came from the same person, and your IP address is not stored anywhere in that count. It is the difference between knowing the Suite page was opened 40 times yesterday and knowing who opened it: the first we know, the second we do not, and that is not an oversight — it is the design. Basis: art. 7, IX, legitimate interest in knowing what people look for here.

8. Protection against abuse

We limit the number of sign-in link requests per IP address and per e-mail address within a 15-minute window. This control lives in the server's memory, disappears on every restart and is not written to the database: ephemeral security processing, basis art. 7, IX. On the magic link sign-in form we also use a Cloudflare anti-bot check, which receives a token from your browser and your IP address.

To be exact, because exactness matters here: the product contact form does not yet use that check — today it relies only on a trap field invisible to humans. We are fixing this, and this paragraph changes when that happens.

9. What we do not do

We do not sell any data, to anyone. We do not use the content you send us to train artificial intelligence models.

There is no Google Analytics, pixel, tag manager, session recording, heat map or third-party CRM on this site. The video is served by us, without YouTube, and the fonts are hosted by us: your browser does not talk to Google while you browse.

We take no automated decision about you: the assessment of a résumé, of a project or of feasibility is made by people.

We also do not build visitor profiles, do not follow you across pages or across sites, and store nothing in your browser beyond the session cookie described above.

10. Who else touches your data

We work with few suppliers, and they process data on our behalf and under our instructions, under contract. The list is public and versioned: when someone joins or leaves, this page changes and gets a new version.

• Outside that list, we only share under a court order or an authority's formal request — and we tell you, unless the order forbids the notice.
• We do not use an artificial-intelligence provider that receives your personal data. If we ever do, it enters this table before it enters the code.

11. Your data leaves Brazil

It does, and saying otherwise would be a lie. It goes to Germany (hosting), to the United States (e-mail, site delivery and card payment processing by Stripe) and to China (the Zhuhai team that handles your request).

A point that often goes unnoticed: data does not have to be copied to another server for an international transfer to occur. When someone in Zhuhai opens our administrative area and reads your request, that is already a transfer from Brazil to China. The database stays in Germany; it is the access that crosses the border, and the rule of the ANPD, Brazil's data protection authority, reaches the making available of data and access to it, not transmission alone.

The basis is art. 33 of the LGPD. None of those countries has an adequacy decision from the ANPD — it has not issued a single one to date. That is why the mechanism we adopt is the standard contractual clauses, with content set by the ANPD itself (art. 33, II, b, and art. 35, as provided in ANPD Resolution CD/ANPD No. 19/2024), under Brazilian law and Brazilian courts. For occasional transfers necessary to perform what you contracted — sending your data to the laboratory in Zhuhai so that the visit can happen — art. 33, IX, together with art. 7, V, also applies.

We do not use your consent as the ground, and that is a choice in your favor: consent is revocable, and a revocation would knock out the team's legitimate access to your own service request. Ask at any time, at [email protected], for the safeguards adopted for each destination and the current state of formalization with each one: we answer with what has been signed and with what has not been signed yet. We do not assert compliance we cannot document.

12. How long we keep it

Each number here is the retention ceiling for that category. Today, deletion happens on your request and on account deletion, which erases immediately. The automated sweep that applies these periods row by row runs every hour; asking for deletion is still the fastest route, and we honour it immediately. Once the period is over, the data is deleted, not archived.

• Database backups: we have not yet declared a period, because publishing a number before the routine exists is a promise the system does not keep. When it is live, this line gets its number.

13. Your rights, and how to exercise each one

Every request goes to [email protected], free of charge. We do not ask for an identity document: if the request comes from the account's e-mail address, or if you sign in through the magic link, your standing as the data subject is already proven.

There are two deadlines: the confirmation that we process data about you is immediate, in simplified form; the full statement is issued within 15 days (LGPD art. 19, I and II).

• Confirmation that we process your data — we answer immediately, in simplified form.
• Access — we send everything we hold linked to you: account, contact requests made with your e-mail address even before an account existed, sessions, activity trail, dispatch records, suppression list, the internal notes on your requests and — where they exist — your purchases: orders, payments, subscriptions, granted access and service protocols. Within 15 days.
• Correction — name and language you change in your account. Correcting the e-mail address changes the account key: we ask for a new verification and reconnect your earlier requests.
• Anonymization, blocking or erasure of data that is unnecessary, excessive or processed outside the law — this is the route to remove anything typed into a free field by mistake.
• Portability to another supplier — we export in JSON or CSV, upon express request, subject to trade secrets.
• Erasure of data processed on the basis of consent — we delete it, with three reservations: a current paid subscription, whatever the law requires us to keep (art. 16, I) and the suppression list, which remains.
• Information about who we share data with — it is in the table in this policy.
• Information about not giving consent and what happens then — the consequence of leaving an optional box unticked is written next to it, and not ticking it never prevents an answer to your request.
• Withdrawal of consent — in one click, through the link at the foot of any optional e-mail, or through your account. It takes effect from then on.
• You may also petition the ANPD (art. 18, §1). If we correct, block or erase data of yours, we notify the suppliers with whom we had shared it.

14. If an incident happens

If a security incident with relevant risk occurs, we notify the ANPD and we notify you, within the period set by ANPD regulation, stating what happened, which data was affected, what we have already done and what you can do.

If you find a security flaw, write to [email protected] with [SEGURANÇA] or [SECURITY] in the subject line. No formal report needed.

15. What this policy does not yet describe

Today the site captures contact requests, keeps accounts with magic-link sign-in and SELLS: there is card and Pix checkout, a credit wallet, subscriptions and service tax-note issuance. This policy describes payment and tax data in the sections above — who processes each is in the supplier table, and what we keep and for how long is in the retention table. What it still does NOT describe: use of artificial intelligence over personal data, which does not exist in the system.

16. When we change this text

Every change produces a new version, with a number and a date, and the earlier ones remain accessible. Where the change is relevant — a new supplier, a new international destination, new processing, a different period — we notify account holders by e-mail, 30 days in advance.

This is version 1.2, in force since September 19, 2026. Questions, requests or complaints about privacy: [email protected].