Privacy Policy

Data controller

The data controller is George Braga Sena (CPF 721.389.982-15), which operates ControlaDocs.

Address: Rua Tiradentes, 149.

For the data that the customer company enters in the system (documents, responsible people, third-party emails, comments and attachments), the customer company decides how it is processed and is the controller of that data. ControlaDocs acts as a processor: it processes that data only to provide the contracted service, following the customer's instructions. The customer company is responsible for informing the people it adds (for example, the responsible people who receive email alerts).

Data protection officer: the controller itself, through the support email in the "Contact" section (small-scale processing agent, ANPD Resolution CD/ANPD No. 2/2022).

Data we collect

• Account data: users' names and email addresses.
• Company data entered in the system.
• Documents and files you register or upload, with their expiration information, responsible people, and comments.
• System usage records per user: sign-ins (date and device), screens opened and actions taken (for example, adding a document or recording a renewal), without the data itself. Used for support, security and service improvement, and kept for 24 months.
• Payment information received from Mercado Pago: name, email, amount, and payment or subscription status. We never receive or store your card number.
• Access logs: IP address, date and time of each sign-in, kept confidential for 6 months as required by Brazil's Internet Civil Framework (Law No. 12,965/2014, art. 15).
• At free trial sign-up and purchase, if you accept advertising cookies: IP address, browser and Meta cookie identifiers, used to report the conversion to Meta (for the trial, sent right away; for a purchase, kept for up to 30 days, until the payment is confirmed).
• Terms acceptance at purchase and free trial sign-up: date and time, terms version, IP address and browser, kept as proof of the contract together with the billing records.

How we use the data

• To provide the service you purchased: create and maintain your account, display your documents, and send expiration alerts.
• To manage the subscription and payments, including sending the welcome email and renewal reminders.
• To handle your support, cancellation, and refund requests.
• To prove the purchase and the provision of the service in the event of a payment dispute, and to prevent fraud.
• To comply with legal and regulatory obligations.
• Identify accounts with little use in order to offer onboarding help (based on usage logs, without the content of the data).

This processing is based on performance of the contract, compliance with legal obligations (including keeping access logs and tax records), legitimate interest and, for advertising cookies and conversions, your consent (art. 7 of the LGPD), which you can withdraw at any time.

Sharing and processors

We do not sell personal data. To run the service, we rely on the following providers:

• Mercado Pago: payment and subscription processing.
• Email delivery provider: delivery of alerts, reminders, and account messages.
• Hostinger: website and system hosting.
• Artificial intelligence provider (such as Anthropic, OpenAI or Google), only on plans with the AI assistant: it receives the question and the system data needed to answer it, at the time of the question. We use these providers' commercial interfaces (APIs), which, under their terms, do not use the data sent to train models. We do not store the text of questions or answers.
• Google Ads and Meta (Facebook and Instagram), only if you accept cookies on the sales page: they measure visits, free trial sign-ups and purchases that come from our ads. The free trial and the confirmed purchase may also be reported by our server to Meta, with your email turned into a code (hash, pseudonymized data), the IP address, the browser and the cookie identifiers.

These providers may store data outside Brazil. International transfers follow the cases in art. 33 of the LGPD, such as these providers' data protection contract clauses.

We may also share data when required by law or by order of a competent authority.

Cookies and browser storage

Your session is kept in a secure cookie that the browser does not let scripts read and that only works on our site. We use the browser's local storage (localStorage) to remember the chosen language and company and, on the sales page, to keep an anonymous visitor code used only in our own statistics (how many people visit, where they come from and how many start the trial or a purchase), with no third parties. Advertising cookies (Google Ads and Meta) are used only on the sales page and only if you accept them; you can change your choice in "Cookie preferences" in the sales page footer. The signed-in area of the system does not use advertising cookies.

How long we keep the data

We keep each kind of data for as long as needed:

• Account, company and documents: while the subscription is active or can be renewed. If access is suspended for non-renewal, the data stays saved so you can resume; you can request deletion at any time.
• Access logs (IP, date and time): 6 months.
• System usage logs: 24 months. Sales page statistics: 13 months.
• IP, browser and identifiers kept at purchase for Meta: 30 days. Sessions: up to 30 days without use.
• Payments, terms acceptances and billing emails: for the periods required by legal and tax obligations and for defense in disputes.

Security

We adopt technical and administrative measures to protect the data, such as encrypted connections and access control by user and by company.

If a security incident may cause relevant risk or harm to data subjects, we will notify the ANPD and the people affected, as required by regulation.

Your rights

Under the LGPD (article 18), you may request at any time:

• confirmation that your data is processed and access to it;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary data or data processed in breach of the law;
• portability of your data to another provider;
• information about the entities with which we share your data;
• withdrawal of consent, when the processing is based on it.

The company administrator can also, in the system itself, under Company settings > Company data, download a copy of all the data (portability) and request deletion of the company, with a protocol emailed right away.

To exercise these rights, write to the support email in the "Contact" section. We reply within 15 days. Requests about data that a customer company entered (for example, a responsible person who receives alerts) are forwarded to that company, which is the controller of that data. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

Contact

Questions about this policy or your data:

• Email: suporte@controladocs.com.br
• WhatsApp: +55 92 98821-0721

Changes to this policy

We may update this policy. The last updated date is shown at the top of this page.