Privacy Policy

Last updated: May 26, 2026

This Policy describes how HOTFY SOLUTIONS LTDA handles the personal data collected when you use our service, in accordance with Brazil's General Data Protection Law (Law No. 13,709/2018, «LGPD»).

What data we collect

We collect only what is necessary to operate the platform:

• Identity: name, email, password (always stored as a bcrypt hash — we have no access to the original password).
• Session: IP address, basic browser fingerprint (user agent, language), and login timestamps. Used to detect suspicious access and meet audit obligations.

We do not collect browsing data for usage analytics, nor do we use third-party tracking tools.

What we use it for

• Authenticate you on the service and protect your account.
• Communicate important changes (transactional — not marketing).
• Comply with legal and tax obligations.

Legal basis

We process data based on (Art. 7 LGPD):

• Contract performance (V): identity and session data.
• Compliance with a legal obligation (II): audit logs, tax retention.
• Legitimate interest (IX): security (fraud detection, abuse prevention) — always proportional and auditable.

Cookies

We use only essential cookies, needed for you to sign in and stay securely connected:

• rtkn — keeps your session active between visits.
• gotech_picker — remembers which workspace you selected.

Because they are indispensable for the service to work, these cookies do not require your consent (LGPD Art. 7 V). We do not use analytics, advertising, or tracking cookies. If that ever changes, we will notify you and ask for your permission first.

Sharing with third parties

We do not sell your data. We share it only with providers essential to our operation:

• Cloudflare — CDN and attack protection (DDoS). Subprocessor certified for LGPD/GDPR.
• Linode — infrastructure provider (servers in the São Paulo, Brazil region). Data in transit and at rest is encrypted.
• Paddle — authorised reseller for the subscriptions. Paddle carries out the sale and the billing, and therefore receives the data needed to charge you and issue the receipt (name, email, country and payment details). It does not receive the contents of your records.

No data is shared with marketing partners.

Retention

We keep your data while your account is active. After account deletion, data is erased within 30 days, except:

• Audit logs: retained for 6 years (tax obligation).
• Backups: may persist for up to 90 days until rotated.

Your rights (LGPD Art. 18)

As the data subject, you have the right to:

• Confirmation and access to your data.
• Correction of incomplete, inaccurate, or outdated data.
• Erasure ("right to be forgotten").
• Portability — export in a structured format.
• Withdrawal of consent, at any time.
• Information about data sharing.

To exercise any right, write to our Data Protection Officer (DPO): contato@zelatus.com. We respond within 15 business days.

Security

We apply defense in depth: encryption in transit (TLS 1.3), encryption of sensitive fields at rest (AES-256-GCM), tenant isolation across all queries, immutable audit logs, and periodic credential rotation.

Changes to this policy

Material updates will be communicated by email at least 30 days in advance. The last-updated date appears at the top of this document.