Privacy policy

Draft. This page is a draft for review, not the final legal text (open question OQ-2). Highlighted items in brackets are placeholders: values not yet filled in, or clauses a lawyer must review.

Who is responsible

The controller for the personal data described here is 50.302.917 ARTHUR BALBOA DE MEDEIROS MARTINS, CNPJ [confirm: 50.302.917/0001-19 (check digits computed from the CNPJ base, not read from a register)], Rua Walter Duarte Pereira, 1524, 59082-470 Natal/RN, Brazil. Contact: [contact email, e.g. a probatumapp.com address].

[LAWYER: we are established outside the EU and offer the service to EU businesses (GDPR art. 3(2)). Confirm whether an EU representative under GDPR art. 27 must be appointed and named here, and whether the Brazilian LGPD also requires naming a data protection officer (encarregado).]

What we process and why

Order details. When you pay, Stripe, our payment processor, collects your business name, email address, billing address, VAT number and card details. We never see your card details. We receive your email address, business name, billing address, VAT number and the order reference. We use them to send your upload link and your report, and to issue the invoice.
Campaign parameters. When you click Buy, the utm_source, utm_medium and utm_campaign values from the page address are passed to the checkout, so we can tell which advert led to an order. They are stored with the order and are not stored in your browser.
Your firmware, the optional kernel configuration and your note, which you upload for the analysis you ordered.
Page views, measured with Vercel Web Analytics, which does not use cookies.

Our server logs record the order reference, the type of event and its outcome. They do not contain your name, your email address or the contents of your files.

[LAWYER: confirm the legal bases. Proposed: performance of the contract (GDPR art. 6(1)(b)) for order, upload and delivery; legal obligation (art. 6(1)(c)) for invoice records; legitimate interest (art. 6(1)(f)) for campaign attribution and cookieless page-view measurement. Add the matching LGPD bases (art. 7).]

Personal data inside your firmware

A firmware image can contain personal data, such as default credentials, configuration or logs. We only analyse the image to produce your report. We do not run it, and we do not use its contents for anything else. You are responsible for making sure you may share the image with us.

[LAWYER: decide whether we act as a processor for personal data inside customer firmware. If we do, we need a data processing agreement (GDPR art. 28) with each customer, for example as an annex to the terms.]

Who else processes data

Stripe (payment processing, fraud prevention and invoices). [LAWYER: confirm which Stripe entity contracts with a Brazilian account and its role for card and fraud data (Stripe acts as an independent controller for some of it)]
Vercel Inc. (USA): website hosting, private file storage and page-view measurement
Neon (database hosting): order records
Mailgun Technologies, Inc. (USA): transactional email (order, upload and download links)

[LAWYER: list the hosting region of each processor and the transfer safeguards for data leaving the EU (EU-US Data Privacy Framework certification or standard contractual clauses). Also cover the transfer to the controller in Brazil: check whether an EU adequacy decision for Brazil is in force, and otherwise use standard contractual clauses.]

How long we keep it

The cloud copy of your firmware and configuration is deleted when we copy it to our analysis machine.
Our working copy and the delivered files are deleted 30 days after delivery. If your order is refunded, they are deleted straight away and at the latest within 24 hours.
What we keep afterwards: the order record, the file hashes, the sign-off record and the list of delivered files. These contain hashes and metadata only, never your files. We keep them so we can confirm later what we delivered.
Invoice and order records are kept for [LAWYER/ACCOUNTANT: the retention period required by Brazilian tax law (usually 5 years) and by any EU rules that apply].

Your rights

You have the right to access, correct and delete your personal data, to restrict or object to its processing, and to data portability. To use them, email [contact email, e.g. a probatumapp.com address]. You may also complain to the data protection authority of the EU country where you live or work, or to the Brazilian authority (ANPD).

[LAWYER: check that this list of rights and authorities is complete for GDPR arts. 13 and 15–22 and for LGPD art. 18, and add the time limit for our answers.]