Privacy

DRAFT — Under legal review. This text is pending Guilherme's legal review. It is published while that review is open, and it may change. It is not legal advice. A placeholder in square brackets is for counsel to complete before this notice comes down.

Who we are

[LAWYER: legal name of the contracting entity] ("Nozzara", "we") provides software for 3D-printing businesses in the United States and Brazil. The postal address is [LAWYER: postal address]. The privacy contact, which is also the channel for the encarregado, is on the facts panel of this page. This draft does not name an encarregado and does not publish a CPF.

This policy is the notice at collection for account data. It is written for the California Consumer Privacy Act, as amended by the CPRA (Civil Code sections 1798.100 to 1798.199), and for Brazil's Lei Geral de Proteção de Dados, Law 13.709/2018 (LGPD). [LAWYER: confirm whether Nozzara meets the CCPA "business" thresholds in Civil Code section 1798.140. If it does not, keep this text as a voluntary commitment or shorten it. Other US state privacy laws may also apply. List the states you want named. This draft does not claim a threshold is met.]

Roles

Nozzara is the controller of account data: the user, billing, and the audit log. "Controller" is the LGPD word. Under the CCPA we are the business that decides why and how that account data is processed.

Nozzara is the processor of the personal data a business account stores about its own customers and other people. The business is the controller of that data. The DPA describes the processor role. In CCPA terms, for that customer data we act as a service provider, not as the business that sells it.

The facts panel repeats the role, the legal bases, the retention rule, and the privacy contact from the product constants.

Notice at collection

We tell you, at or before the point you submit the sign-up form, the categories below, the purposes, that we do not sell or share them, and how long we keep them. The sign-up page links here. We will not collect a new category, or use a category for a purpose that is incompatible with this notice, without a new notice (Civil Code section 1798.100).

We collect the following. For each category, the sale or share answer is no.

• Identifiers: name, email address, business name, account identifier, and the Stripe customer identifier. Purpose: create and run the account, authenticate you, and bill a paid plan. Retention: for the life of the account and then for [LAWYER: years] where tax, billing, or a dispute requires the record.
• Customer records: the business profile you enter (legal name, tax identifier, address, phone, email) and the customer, supplier, and partner records you choose to enter (names, contact details, addresses, tax identifiers, orders, quotes). Purpose: provide the service you configure. Retention: until you delete the record or the account is later closed, and longer only for the legal holds in the retention section. We do not delete these on downgrade, at the end of a trial, or on suspension.
• Commercial information: plan, subscription status, invoices, and the orders and quotes you record. Purpose: provide the service and keep the billing record. Retention: the commercial record of your subscription is kept for [LAWYER: years] after the period it relates to.
• Internet or electronic activity: the essential session cookie, the language cookie if you save a language, and a hash of the client address used to rate-limit public forms. Purpose: keep you signed in, remember the language, and limit abuse. Retention: the session cookie lasts about 12 hours after sign-in. The language cookie lasts until you change it or clear it. The hash is kept for the rate-limit window and the related security record.
• Professional information: your role in the account. Purpose: apply permissions. Retention: for the life of the user on the account.
• Sensitive personal information: the account password, stored only as a scrypt hash, and payment card data, which Stripe collects and which we do not store. Purpose: authenticate you, and take payment. Retention: the hash is replaced when you change the password and removed when the user record is later removed. Card data follows Stripe's retention, not ours.
• Inferences: we do not create profiles for advertising. We do not draw inferences about your preferences in order to advertise to you.

We do not knowingly collect precise geolocation, biometrics, health information, racial or ethnic origin, religious belief, union membership, sex life, or the contents of your mail, email, or text messages. A file you upload is your content. Do not upload those categories unless you have a lawful basis and, where we are the processor, an instruction that allows it.

Sources: you, the people you invite, the records you type or upload, Stripe (payment status, not the full card number), and the browser (the cookies and the hashed address described above).

Sensitive personal information

We use the password hash only to authenticate the account, and we use Stripe only to take the subscription payment and to prevent fraud on that payment. We do not use sensitive personal information to infer characteristics about you, and we do not sell or share it.

Because those uses are the service and security uses described in Civil Code section 1798.121, this draft does not offer a separate "Limit the Use of My Sensitive Personal Information" link. [LAWYER: confirm that no use falls outside the section 1798.121 exceptions. If one does, add that link.]

Sale and share

We do not sell personal information for money or for other valuable consideration. We do not share it for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months. We do not knowingly sell or share the personal information of anyone under 16.

A disclosure to a service provider or processor, under a contract that forbids a sale or a secondary use, is not a sale and is not a share. The subprocessors are Hostinger, Stripe, and [LAWYER: legal name of the transactional email provider].

You can still send a Do Not Sell or Share request. The page is Do Not Sell or Share My Personal Information. The form emails the privacy contact. This draft does not store the message and does not write the body to a log. [LAWYER: when a request record exists, say that the request is stored, and delete this sentence.]

We do not offer a financial incentive for personal information, so there is no notice of financial incentive.

If a browser sends an opt-out preference signal, there is no sale or share for that signal to stop. If we ever sell or share, we will treat a valid signal as an opt-out (California Code of Regulations, title 11, section 7025). [LAWYER: confirm.]

Service providers

These providers process personal data for us. Each is limited to the purpose stated. [LAWYER: confirm the contract with each one meets LGPD Articles 39 and 46 and, for account data, CCPA service-provider terms in Civil Code section 1798.100(d).]

• Hostinger hosts the application and the database. Its privacy notice is at https://www.hostinger.com/legal/privacy-policy. The processing location is [LAWYER: country or region of the Hostinger servers]. We do not put a database account number in this policy.
• Stripe processes subscription payments, including the card and, on an annual plan billed in Brazilian reais, the boleto. Its privacy notice is at https://stripe.com/privacy and its data processing terms are at https://stripe.com/legal/dpa.
• [LAWYER: legal name of the transactional email provider] sends account email: verification, password reset, billing notices, and privacy requests. Its country is [LAWYER: country of the email provider]. The product sends that mail through the SMTP service we configure. This draft does not guess the provider's name.

We do not authorize these providers to use the data for their own marketing.

Legal bases under the LGPD

The facts panel lists the bases for account data. In short:

• Contract (Article 7, V): to open the account and provide the subscription you asked for. Accepting the terms is a contract. It is not a consent checkbox for every later use.
• Legitimate interest (Article 7, IX): to keep the service secure, to rate-limit abuse, and to use the essential session cookie. [LAWYER: file the legitimate-interest assessment. The interest is security of the accounts. The data is a session identifier and a hash of the address. The person can sign out.]
• Legal obligation (Article 7, II): where tax, accounting, or a regulator requires the record.
• Consent (Article 7, I, and Article 8) is not the basis for the account, the subscription, or the essential cookie. We would ask for consent only for an optional purpose. This product has no analytics cookie and no marketing cookie, so there is no optional purpose today.

For sensitive data under LGPD Article 11, we do not intend to process LGPD sensitive data (racial or ethnic origin, religious belief, political opinion, union membership, genetic or biometric data, health, or sex life) as controller. A tax identifier and a password hash are personal data. They are not sensitive data under Article 5, II. [LAWYER: confirm.]

For customer data you store, you choose the legal basis. We follow your instructions. The DPA says so.

International transfers

The service is used in the United States and Brazil. Hosting, payments, and email may be processed in another country. [LAWYER: name each country.]

Under the LGPD, an international transfer is allowed only in the cases in Article 33. The mechanism this draft is written for is the standard contractual clauses approved by the ANPD in Resolution CD/ANPD No. 19 of 23 August 2024, used in full and without changing the clause text. Where a transfer is also required to perform the contract with the data subject, Article 33, V, may apply. Article 7 bases are not, by themselves, a transfer mechanism.

[LAWYER: attach the ANPD clauses, or name another Article 33 ground, for each transfer. Do not publish this policy while the ground is still a placeholder. The 12-month adaptation period in that resolution has ended.]

A transfer of account data to the United States is a transfer from Brazil when the account, or the person, is in Brazil. We do not rely on an adequacy decision. [LAWYER: confirm the ANPD has not issued one that covers these providers.]

Retention

We keep personal information only as long as the purpose in the notice, or a legal hold, requires. We do not keep it longer than reasonably necessary for that purpose (Civil Code section 1798.100; LGPD Article 6, III, and Article 15).

• Account profile and user records: life of the account, then [LAWYER: years].
• Billing and tax records: [LAWYER: years after the year they relate to].
• Audit log: life of the account, then [LAWYER: years]. The log does not contain passwords, secrets, or raw IP addresses.
• Session cookie: about 12 hours. Language cookie: until you change or clear it.
• Email verification token: 24 hours, stored only as a hash. Password-reset token: 30 minutes, stored only as a hash.
• Account export link: about 24 hours.
• Do Not Sell or Share message: not stored in the app in this draft. It is emailed to the privacy contact.
• Backups: [LAWYER: backup retention period]. A backup is not a live account.
• Customer data you store: kept while the account exists. Downgrade, the end of a trial, and suspension do not delete it. Older history may become read-only when a plan limit says so. It is not deleted.

When a deletion request is later carried out, we will also tell the subprocessors to delete, except where a legal hold applies. This draft does not carry out deletion. See the privacy-rights page.

Your rights

If a US state privacy law applies to you, you may ask to know, to correct, to delete, and to opt out of sale or sharing, and you may not be discriminated against for asking. The CCPA timing we will follow is 45 days, with one extension of another 45 days if we tell you why (Civil Code section 1798.130).

Under the LGPD Articles 18 and 19 you may ask for confirmation, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about sharing, information about the possibility of refusing consent, and deletion of data processed on consent. A simplified confirmation is due promptly. A complete declaration is due within 15 days. A small-business agent may use 15 days for the simplified form as well (ANPD Resolution CD/ANPD No. 2 of 27 January 2022, Article 15). [LAWYER: say whether you claim the small-agent treatment.]

How to ask, how an authorized agent asks, and what this draft actually does, are on the privacy-rights page. Access for an account administrator reuses the account export. Correction of the signed-in profile is done in Settings. Deletion is not carried out by this draft.

We will not discriminate against you for exercising a privacy right. We do not charge a different price, or provide a different service, because you asked.

Children

The service is for businesses. It is not directed at children, and we do not knowingly create an account for anyone under 18. If you believe a child gave us personal data, email the privacy contact.

Cookies

The Cookies page lists the cookies the app already uses. These legal pages do not set a cookie. There is no analytics cookie and no marketing cookie.

Security incidents

We protect personal data with access controls appropriate to the risk (LGPD Article 46). If a security incident may create a relevant risk or damage, the controller notifies the ANPD and the affected person as Article 48 requires. Where we are only the processor, we notify the customer who is the controller. [LAWYER: set the hour count. The draft in the DPA is without undue delay and, where feasible, within 72 hours after we confirm an incident affecting that customer's data.]

Changes

We will post a new version on this page and change the version string. A material change gets an email to the account before it applies. [LAWYER: number of days.]

Contact, the encarregado, and the ANPD

The privacy contact on this page is the public channel. The encarregado (data protection officer) is [LAWYER: name of the encarregado, or state that Resolution CD/ANPD No. 2/2022 waives the appointment for a small agent and that this email is the Article 41 channel]. Identity and address of the encarregado: [LAWYER: as Article 41 requires, if an encarregado is appointed].

The National Data Protection Authority (ANPD) is the Brazilian authority: https://www.gov.br/anpd. You may complain to the ANPD. If a US state law gives you a regulator, you may complain to that regulator as well. [LAWYER: name the state attorney general or agency you want listed.]