Privacy Policy

Last updated: December 19, 2024

Bycoded Tecnologia Ltda. ("Basaltic", "we", "us", or "our") is committed to protecting the privacy and personal data of its users, customers, and visitors. This Privacy Policy describes how we collect, use, store, share, and protect your personal information in compliance with the Brazilian General Data Protection Law (LGPD - Law No. 13,709/2018) and other applicable rules.

1. Definitions

For the purposes of this Policy:

• Personal Data: any information relating to an identified or identifiable natural person.
• Processing: any operation carried out on personal data, such as collection, storage, use, sharing, and deletion.
• Data Subject: the natural person to whom the personal data relates.
• Controller: Basaltic, responsible for the decisions regarding the processing of personal data.
• Processor: the party that processes personal data on behalf of the controller.

2. Data We Collect

We collect the following categories of personal data:

2.1 Account Data

• Full name and username
• Email address
• Phone number
• CPF or CNPJ
• Billing address
• Company information (for business accounts)

2.2 Payment Data

• Credit card details (processed by PCI-DSS compliant partners)
• Transaction and invoice history
• Bank details for refunds

2.3 Usage Data

• IP address and approximate geolocation
• Browser type and operating system
• Pages visited and time spent
• Resources and services used
• Access logs and console activity

2.4 Support Data

• Support tickets and service history
• Call recordings (where applicable)
• Feedback and ratings

3. Purposes of Processing

We use your personal data for the following purposes:

• Service delivery: creating and managing your account, provisioning infrastructure resources, processing payments, and providing technical support.
• Communications: sending notifications about your account, service updates, security alerts and, where authorized, marketing communications.
• Security: preventing fraud, detecting suspicious activity, protecting our systems, and meeting legal obligations.
• Service improvement: analyzing usage patterns to improve features, performance, and user experience.
• Legal obligations: complying with legal, regulatory, or judicial requirements.

4. Legal Bases for Processing

Basaltic's processing of personal data is grounded in the following legal bases set out in the LGPD:

• Performance of a contract: to deliver the contracted services.
• Compliance with a legal obligation: to meet tax, accounting, and regulatory requirements.
• Legitimate interest: to prevent fraud, secure the platform, and improve the services.
• Consent: for marketing communications and the use of non-essential cookies.

5. Data Sharing

We may share your personal data with:

• Payment processors: to process financial transactions securely.
• Infrastructure providers: partners that help us deliver the services.
• Analytics tools: to understand platform usage and improve our services.
• Public authorities: when required by law, court order, or legal proceedings.
• Group companies: for administrative and support purposes.

Every third party we share data with is bound by contractual confidentiality and security obligations consistent with this policy.

6. Storage and Security

Your personal data is stored on infrastructure located in Brazil, in a datacenter with security certifications. We adopt technical and organizational measures to protect your data, including:

• Encryption of data in transit (TLS 1.3) and at rest (AES-256)
• Role-based access control (RBAC)
• Two-factor authentication (2FA)
• Continuous security monitoring
• Encrypted, redundant backups
• Immutable audit logs

7. Data Retention

We retain your personal data for as long as necessary to fulfill the purposes for which it was collected, including legal, contractual, and regulatory obligations. Account data is kept while the account remains active. After an account is closed, data is retained for up to 5 years for tax and legal purposes, or for the period set by law, and is then securely deleted.

8. Your Rights

In accordance with the LGPD, you have the following rights:

• Confirmation and access: confirm that processing exists and access your personal data.
• Correction: request correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion: of unnecessary or excessive data, or data processed in breach of the law.
• Portability: receive your data in a structured format for transfer to another provider.
• Deletion: request deletion of data processed on the basis of consent.
• Information: be told which entities we share your data with.
• Withdrawal of consent: withdraw your consent at any time.
• Objection: object to processing carried out on a basis other than consent.

To exercise your rights, contact us at privacidade@basaltic.sh or through our console.

9. Cookies and Similar Technologies

We use cookies and similar technologies to:

• Essential cookies: required for the site's basic operation and authentication.
• Preference cookies: remember your settings and preferences.
• Analytics cookies: understand how you use our services so we can improve them.

You can manage your cookie preferences through your browser settings.

10. International Transfers

Your personal data is processed and stored in Brazil. Where a transfer to other countries is necessary (for example, for technical support or integrations you request), we ensure appropriate safeguards are in place, such as standard contractual clauses or other measures provided for in the LGPD.

11. Minors

Our services are not directed at people under 18. We do not knowingly collect personal data from minors. If you are responsible for a minor and believe they have provided us with personal data, contact us so we can take the appropriate steps.

12. Changes to this Policy

We may update this Policy from time to time to reflect changes in our practices or legal requirements. Significant changes will be communicated through the console, by email, or by another suitable means. The date of the last update is always shown at the top of the document.

13. Contact and Data Protection Officer

For questions, requests, or complaints regarding this Policy or the processing of your personal data, contact our Data Protection Officer (DPO):

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) if you believe your rights have not been properly addressed.