Privacy Policy

Last updated: October 10, 2026

Bycoded Tecnologia Ltda. ("Basaltic", "we", "us", or "our") processes personal data to operate its website and cloud services. This Privacy Policy describes the data we collect, how it is used, stored and shared, the controls available, and how to exercise your rights under the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018).

1. Definitions

For the purposes of this Policy:

• Personal Data: any information relating to an identified or identifiable natural person.
• Processing: any operation carried out on personal data, such as collection, storage, use, sharing, and deletion.
• Data Subject: the natural person to whom the personal data relates.
• Controller: the party that decides why and how personal data is processed. Basaltic acts as controller for account administration, billing, security and support.
• Processor: the party that processes personal data on behalf of the controller.

When you use the Services to store or process personal data under your control, you determine the purposes of that processing. Basaltic processes that Customer Content to provide the requested services. This differs from the account, billing and security records described in this Policy.

2. Data We Collect

We collect the following categories of personal data:

2.1 Account Data

• Name, email address and verification status
• Phone number and verification status when you add or verify a number
• Profile photo and Google account identifier when you choose Google sign-in
• Organization and account membership, roles, language and time zone preferences
• Billing name, CPF or CNPJ, address and fiscal information you provide
• Authentication records, password hashes and information needed for the authentication methods you enable

2.2 Payment Data

• Card details entered through Stripe’s payment interface; Basaltic keeps provider references and limited card metadata, such as brand, last four digits and expiry, rather than full card numbers or security codes
• Card-authentication results and records of your automatic-billing authorization
• Usage charges, invoices, credits, payments, refunds, disputes and fiscal documents

2.3 Usage Data

• IP address and browser/device information sent with requests
• Sign-in, session and security events
• Resource identifiers, configuration, operations and metered usage
• Platform access and audit records
• Website interaction data when analytics is configured, as described in section 9

2.4 Support Data

• Contact name and email, ticket subject, department, messages and service history
• Information and attachments you provide through support email, including technical details or logs
• Quota requests, staff responses and internal case notes

2.5 Limited compliance evidence

We keep a separate, restricted history of platform access and security events, account and contact changes, billing identity (including CPF/CNPJ and verification status), cloud IP allocation/attachment changes, and limited payment and service-delivery records. This helps attribute an address or event to an account, investigate abuse, answer valid requests and establish transaction facts. It does not establish who personally performed an act. This processing does not collect guest content, passwords, private keys, packet contents, or the websites visited from your instances.

2.6 Customer Content

We process the files, objects, secrets, messages, logs, traces and other content you submit to the services you use. That content may contain personal data. Its storage, access and deletion depend on the service and your configuration, including retention, snapshots, object versions and legal holds. The limited compliance evidence in section 2.5 is a separate record, not a copy of all Customer Content.

2.7 Console assistant

When you use the console assistant, we store your conversation, selected organization/account/region, relevant resource results and action decisions. Messages, context and tool results needed to answer your request are sent to OpenAI; documentation searches may also be sent to our documentation service. The integration filters common credential fields from tool results, but text you enter may still contain personal or confidential data. Do not include passwords, private keys or information unnecessary for your request.

3. Purposes of Processing

We use your personal data for the following purposes:

• Service delivery: creating and managing your account, provisioning infrastructure resources, processing payments, and providing technical support.
• Communications: sending account and billing messages, verification codes, service notifications, security alerts and support responses.
• Security: preventing fraud, detecting suspicious activity, protecting our systems, and meeting legal obligations.
• Service improvement: using operational records and, when configured, website analytics to understand service usage and troubleshoot problems.
• Legal obligations: complying with legal, regulatory, or judicial requirements.

4. Legal Bases for Processing

Basaltic's processing of personal data is grounded in the following legal bases set out in the LGPD:

• Performance of a contract: to deliver the contracted services.
• Compliance with a legal obligation: to meet tax, accounting, and regulatory requirements.
• Legitimate interest: to prevent fraud, secure the platform, and improve the services.
• Consent: where we request consent for a specific purpose; it may be withdrawn through our privacy contact.
• Exercise of rights: handling payment disputes and establishing facts in legal or administrative proceedings.

5. Data Sharing

We may share your personal data with:

• Payments — Stripe: payment and card-authentication information, billing contacts, transaction references and relevant dispute evidence are processed by Stripe and the financial institutions involved.
• Sign-in and abuse prevention — Google: Google sign-in exchanges profile and authentication information when you choose it. reCAPTCHA processes browser interaction and verification information in protected authentication flows.
• Phone verification — Twilio: your phone number and verification request are sent to Twilio Verify. Delivery uses the configured channel, such as WhatsApp or SMS, and its messaging or telecommunications providers.
• Console assistant — OpenAI: the conversation context and relevant tool results are processed to generate responses when you use the assistant. Documentation queries may also reach our documentation service.
• Email and support: account notifications and support messages are delivered through our email service and the mail providers of their recipients. Support notifications also reach our staff mailbox.
• Infrastructure and analytics: hosting and network providers process data needed to operate their services. When enabled on the website, Google Tag Manager loads the configured analytics integrations, as described in section 9.
• Fiscal and public authorities: billing identity and transaction information are submitted to the Municipality of São Paulo for fiscal document issuance. Other disclosures are assessed against the applicable legal request.

Organization support tickets and their public messages are visible to members with the required organization permissions. External email tickets are not automatically linked to an organization merely because an email address matches.

Access to the compliance history described in section 2.5 requires specifically authorized staff and additional authentication. Searches, reveals, preservation actions, report generation, downloads and disclosures are audited. Disclosure to authorities is assessed against the authenticated instrument and its permitted subjects, fields and dates; access/connection logs require the applicable judicial authority, while legally authorized cadastral requests are restricted to permitted identification/address fields.

6. Storage and Security

The current compute and storage region is São Paulo, Brazil. Account, payment, communications and integration data also follow the processing flows in sections 5 and 10. Security controls include:

• TLS for public API connections
• Password hashing and IAM permissions scoped to organizations, accounts and roles
• Optional multi-factor authentication for customer sign-in
• Server-side AES256 encryption for object storage when enabled for the bucket or requested for an upload; enabling a bucket default applies to subsequent writes
• Encryption for Secrets and supported KMS integrations, including Telemetry
• Encrypted compliance evidence, restricted staff access with additional authentication, and recorded access and disclosure actions

Encryption capabilities and configuration vary by service. These controls do not mean that every volume, object, backup or customer application is encrypted at rest by default. Customers configure resource permissions, supported encryption settings and application-level protections.

7. Data Retention

Deleting a cloud resource, closing a support ticket and requesting deletion of personal data are different actions. Account and organization deletion follow their resource-lifecycle requirements and do not automatically erase billing records, support history or separately retained compliance evidence.

Support tickets retain their contact details, conversations and copied attachments after closure or deletion of a linked identity. They currently have no fixed automatic expiry. For inbound support email, the raw-message spool normally expires after 90 days and at least 14 days after publication to the processing queue; unpublished messages remain pending. This spool expiry does not delete the copy in the ticket. Contact us to request review or deletion of retained personal data.

We retain assistant conversations unless you delete them; closing the panel or archiving a conversation does not delete its content. Conversation deletion removes its messages, model context and action payloads from the operational store. Minimal approval audit records and usage counters remain separate. Our requests disable storage of Responses API objects at OpenAI; this is not a promise of zero provider retention or immediate removal from backups.

Operational account data follows the active service and deletion process. The separate compliance history has category-specific limits measured from each event or observation: platform access, 6 calendar months; IP allocation and ownership, 12 calendar months; historical account/contact identity, 12 calendar months; failed authentication and credential-security events, 90 days; service-delivery evidence, 12 calendar months; limited payment/fiscal provenance, 60 calendar months; and compliance access/disclosure audit records, 12 calendar months. Fiscal originals have their own applicable obligations. These periods are not a blanket five-year retention of all account data.

A documented, scoped preservation requirement may extend the necessary records beyond their baseline until the requirement expires or is released. Preservation alone does not permit disclosure. Reports and their evidence snapshots normally expire within 30 days and may become unavailable sooner when source evidence expires; an explicit preservation requirement can cover them. A minimal report register is kept for one year. Necessary case and authority records are kept for one year after closure or the request deadline, subject to applicable preservation. Expired, unheld compliance records and indexes are deleted. Restricted backups follow their recovery lifecycle; restored data is reconciled with current retention and preservation decisions before access resumes.

8. Your Rights

You may exercise the following rights under the LGPD, subject to its applicable conditions and exceptions:

• Confirmation and access: confirm that processing exists and access your personal data.
• Correction: request correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion: of unnecessary or excessive data, or data processed in breach of the law.
• Portability: request portability to another supplier under the applicable regulations, respecting commercial and industrial secrets.
• Deletion: request deletion of consent-based data, subject to legally permitted retention.
• Information: be told which entities we share your data with.
• Withdrawal of consent: withdraw your consent at any time.
• Objection: object to processing based on an exemption from consent when it does not comply with the LGPD.

To exercise your rights, write to privacidade@basaltic.sh or open a support ticket in the console. These requests are reviewed by staff; resource deletion is not a substitute for a personal-data request.

We verify the requester and any authority to represent another person or organization, limit the response to that subject, and explain applicable retention exceptions. A correction records the new facts without silently rewriting historical evidence. Requests to delete live resources and requests concerning independently retained legal evidence are assessed separately.

9. Cookies and Similar Technologies

The website and console use browser cookies and local or session storage for these functions:

• Authentication and security: session continuity, sign-in flows and abuse prevention, including reCAPTCHA on protected authentication pages.
• Preferences and navigation: remembering language, selected organization/account/region and interface state.
• Configured website analytics: Cookie preferences are shared between basaltic.sh and console.basaltic.sh through a first-party cookie, valid for up to 180 days. In “Cookie preferences”, you can accept, reject or separately choose visit analytics and conversion measurement. Google Analytics loads only on the public website, after you allow visit analytics. Essential language, authentication and security cookies do not depend on this choice. You can withdraw permission at any time; withdrawal clears known cookies for the disabled purpose and reloads the page when needed to stop code already loaded. Changes to purposes or the policy may require a new choice.
• Optional ad measurement in the console: With your permission for conversion measurement, Google Ads loads on the public website and the console’s signup and organization-activation pages. It uses click identifiers, first-party attribution cookies and a random conversion identifier to associate ads with completed activation. Only allowed campaign parameters are forwarded to signup; we do not include names, email addresses, phone numbers, payment details or resource details in conversion events. We do not enable personalized ads or Google Analytics in the console. Your website choice also applies in the console, without a second request. Withdrawal clears known attribution identifiers in this browser. Measurement does not load on resource pages or URLs containing authentication parameters. Google may process the data outside Brazil and use it according to its measurement and advertising policies. If your browser prevents saving the preference, use its settings to clear or block site data.

You can block or clear cookies and site storage in your browser. Blocking essential storage or third-party authentication checks may prevent sign-in or other features from working. Using the website does not by itself constitute consent for every optional processing purpose.

10. International Transfers

Provisioning compute or storage in São Paulo does not confine all personal-data processing to Brazil. Stripe payments, Google sign-in and reCAPTCHA, Twilio verification, OpenAI assistant requests, configured analytics and email delivery involve external providers and may process data outside Brazil. The data and purpose depend on the feature you use, as described in section 5.

Provider processing locations, retention and contractual arrangements vary by service. Contact privacidade@basaltic.sh for information about the recipients and international processing relevant to your use. Applicable LGPD requirements continue to apply; this Policy does not represent that every integration uses a Brazil-only configuration or a particular contractual transfer mechanism.

11. Minors

Our services are not directed at people under 18. We do not knowingly collect personal data from minors. If you are responsible for a minor and believe they have provided us with personal data, contact us so we can take the appropriate steps.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. Significant changes will be communicated through the console, by email, or by another suitable means. The date of the last update is always shown at the top of the document.

13. Privacy Contact

For questions, requests or complaints about this Policy or your personal data, contact Basaltic’s privacy team:

You may also submit a complaint to the Brazilian National Data Protection Agency (ANPD) if you believe your rights have not been addressed.