Privacy Policy

1. Who we are

Harpia Lab, Curitiba/PR, Brazil, CNPJ [PENDING: CNPJ]. Privacy contact: [PENDING: privacy email].

We are the controller of the website data, the Control accounts and the usage data described here. The data a firm enters into Control about its own clients belongs to the firm: in that case the firm is the controller and we process that data on its behalf (as processor), only to provide the service.

2. Who this applies to

• Visitors to the websites.
• Control users: whoever creates an account and the invited team.
• Clients of the firms who open a quote through its link or sign in to the portal.

3. What data we process and why

3.1 Account and use of the service (Control users)

Name, email, organization, role on the team and, if you turn it on, the second login factor. Also what you enter: clients, quotes, files and payments. We use it to provide the contracted service (LGPD, art. 7, V) and to send the service’s own emails (invitations, quote and installment notices).

3.2 Data about the firms’ clients

Name, email and what the firm records about the quote and the payments, plus the client’s decision (acceptance or rejection) and the items chosen. We process it as processor, following the firm’s instructions; the firm defines the legal basis and answers the client about that data.

3.3 Technical access records

IP address, date and time, browser and the action taken, for security and to investigate abuse (legitimate interest, art. 7, IX). Kept for up to 30 days.

3.4 Contact form (harpialab.com)

Name, email and the message you write, to reply to you and talk about a possible project (art. 7, V, preliminary procedures to a contract). They stay in our mailbox while the conversation is useful.

3.5 Usage data (Google Analytics)

To understand how the websites and Control are used and to improve the product, we record:

• pages viewed and actions (for example, "quote created" or "link copied");
• device type, browser, language and approximate location (city and country);
• where the visit came from (referring site and campaign);
• a random identifier stored in a cookie in your browser;
• in Control, while you are signed in: the internal identifier of your account and of the organization, your role on the team, and the organization’s plan and line of business.

We do not record names, emails, phone numbers, documents, client names, quote contents or amounts, or what you type.

Legal basis:

• Websites, client portal and quote link: consent (art. 7, I). Nothing is collected before you click "Accept" in the cookie notice. You can change your choice at any time under "Cookie preferences" in the websites’ footer, or under Security → Privacy in the portal.
• Control, while you are signed in (and sign-up, sign-in and initial setup): legitimate interest in improving the product you use (art. 7, IX). You can turn it off under Security → Privacy ("Send usage data from this browser"). If you declined cookies on one of our websites, that choice also applies in Control.

Usage data is not used for advertising: Google’s advertising and demographics features are turned off.

4. Cookies and browser storage

5. Who we share it with

We do not sell data. We use providers that process data on our behalf:

• Google Cloud and Firebase: hosting for Control, database, files and sign-in. Control data stays in São Paulo; the sign-in service may process data outside Brazil.
• Google Analytics: usage data (section 3.5).
• Resend: sending the service’s emails.
• Vercel: hosting for the harpialab.com website.

We may also share data when the law or an authority requires it.

6. International transfers

Some of these providers process data outside Brazil, mainly in the United States (Google Analytics, sign-in, Resend, Vercel). These transfers follow art. 33 of the LGPD, under the data protection contractual clauses the providers offer.

7. How long we keep it

• Account and service data: while the account exists. After a deletion request, backup copies that still hold that data expire within 7 days.
• Technical access records: up to 30 days.
• Usage data: 14 months in Google Analytics; a copy for analysis (Google Cloud, São Paulo region) for up to 24 months.

8. Your rights

Under the LGPD (art. 18), you can ask for: confirmation that we process your data, access, correction, anonymization or deletion of what is unnecessary, portability, information about who we share it with, withdrawal of consent, and objection to processing based on legitimate interest.

To ask, write to [PENDING: privacy email] from your account’s email address. We confirm the request is yours before acting and reply within 15 days. If you are a client of a firm that uses Control, talk to the firm first; we help it handle the request.

You can also file a complaint with Brazil’s National Data Protection Authority (ANPD).

9. Data protection officer

As a small-scale processing agent, Harpia Lab is exempt from appointing a data protection officer (ANPD Board Resolution No. 2/2022, art. 11). The channel for any privacy matter is the email in section 1.

10. Security

We use encryption in transit and at rest, permission-based access, two-step verification and daily backups. No system is infallible; if an incident happens that may cause relevant risk or harm, we notify you and the ANPD.

11. Changes to this policy

When the policy changes, we update the date at the top and let you know on the websites or in Control if the change is relevant.