Privacy Policy
This Policy separates the data Zofiti controls from Customer Personal Data processed only to operate Sinalio for a Customer.
Effective September 3, 20261. Scope and contacts
This Policy explains how ZOFITI SOLUCOES LTDA, CNPJ 61.548.431/0001-81, handles personal data through the Sinalio public site, accounts and service. Zofiti's fiscal address is Rua Bahia, 5800, apartment 304, block S, Salto Weissbach, Blumenau, Santa Catarina, Brazil, ZIP 89032-001, without public customer service.
Email to joao.muller@zofiti.com.br is the official channel for privacy requests. João Vitor Müller is Zofiti's data protection contact and person in charge under the Brazilian LGPD. Zofiti aims to provide an initial response within seven calendar days after the latest message needed to understand the request. This target does not extend or restart a mandatory legal deadline, which is counted as required by applicable law, and the initial response is not necessarily completion of the request.
2. Zofiti's roles
Zofiti is a controller for account identity, commercial relationship, billing records, security, support, website operation and consent preferences because it determines why and how these data are used.
Zofiti acts as a processor or operator for announcements, feedback and contextual data a Customer sends through its product. In that role, the Customer has primary responsibility for deciding what data enters Sinalio, the purpose and lawful basis, accuracy, notices, retention instructions and access by its members. Zofiti is responsible for the infrastructure and processing operations under its control and follows the Customer's documented instructions through the contract and DPA. End users should normally contact the Customer whose product collected their feedback; Zofiti will assist that Customer.
3. Data we handle
| Context | Data |
|---|---|
| Account and identity | Name, email, profile image, identity-provider identifier, authentication events, account preferences such as language, IANA time zone and sidebar state, and a minimal history of workspace destinations with visit counts used for personal navigation suggestions. |
| Workspace and commerce | Workspace membership, role, plan, status, invoice and checkout identifiers, amount, currency and tax records. Zofiti does not receive full card details. |
| Customer Content | Announcements, feedback type and message, normalized page URL, environment, widget version, timestamp and optional external user reference. Attachments are included only when that capability is enabled and used. |
| Service operations | IP address, access logs, device and browser information, security events, error diagnostics and configuration changes. |
| Support | Email address, message and files or context voluntarily provided to resolve a request. |
| Public website | Consent preference and, only after optional consent, restricted Google Analytics events from the public site. |
4. Data Sinalio is not designed to capture
The widget is not designed to automatically capture page DOM, keystrokes, session replay, screenshots, browser cookies, local storage, console logs or network traffic. Sinalio does not receive identity-provider passwords or full payment-card credentials. Customers must not place sensitive or unnecessary personal data in free-text fields.
5. Purposes and legal bases
| Purpose | Main basis |
|---|---|
| Create accounts, authenticate and provide contracted workspaces | Contract performance and pre-contract steps. |
| Charge subscriptions and keep invoices | Contract performance and compliance with tax and accounting law. |
| Secure the service, prevent abuse and exercise legal claims | Legitimate interests, legal obligations and exercise of rights, with necessity and balancing safeguards. |
| Answer support and privacy requests | Contract performance, legal obligations or legitimate interests, depending on the request. |
| Measure the public site with Analytics | Consent, which may be refused or withdrawn at any time. |
| Process end-user feedback for a Customer | The Customer's documented instructions and lawful basis; Zofiti does not choose that basis. |
6. Cookies and similar technologies
Tag Manager and Analytics are both absent before consent and are not used in checkout, authentication, the control plane or the widget. Use at any time to accept, refuse or withdraw optional measurement.
7. Providers and sharing
Zofiti shares data only as necessary to provide the service, comply with law, protect rights or complete a corporate transaction with appropriate confidentiality. Current providers include:
- Magalu Cloud, São Paulo region
br-se1, for application, database, file storage, logs and error monitoring; - Google and Microsoft for user-selected identity authentication;
- Stripe for hosted checkout, payment and billing records;
- Google Workspace for the public support and privacy mailbox;
- Google Tag Manager and Google Analytics for governed public-site measurement only after consent.
Zofiti does not sell personal data and does not share it for cross-context behavioral advertising.
8. Locations and international transfers
Core Sinalio hosting is in São Paulo, Brazil. Identity, payment, support and optional analytics providers may process data in other countries under their global infrastructure. When a transfer is subject to the LGPD, GDPR or another applicable law, Zofiti uses an available legal mechanism, contractual safeguards and security measures, including ANPD standard contractual clauses or European Commission Standard Contractual Clauses where required.
9. Retention
| Data | Normal retention |
|---|---|
| Active Customer Content | For the workspace term and up to 30 days after termination for recovery or export. |
| Personal navigation history | Workspace destination identifiers and visit counts for 30 days, or until the account holder clears them. |
| Encrypted backups | Expire within up to 90 days after deletion from active systems. |
| Application access logs | Six months, unless a longer period is legally ordered. |
| Account profile after closure | Up to 30 days, except records required for legal claims or obligations. |
| Invoice, tax and contract records | At least five years or the applicable statutory period. |
| Support communications | Up to two years after the request closes, unless needed for a dispute. |
| Google Analytics events | Two months, when consented. |
| Consent preference | Up to 12 months, then the site requests a new choice. |
Data may be deleted earlier when requested and legally permitted, or retained longer when necessary for a legal obligation, fraud investigation or exercise of rights.
10. Security
Zofiti uses access controls, least privilege, encryption in transit, encrypted storage where supported, tenant boundaries, validation at public interfaces, logging, backups, dependency maintenance and incident procedures appropriate to the service. No service is risk-free. Customers must keep provider accounts secure, restrict workspace permissions and avoid submitting unnecessary data.
11. Your privacy rights
Depending on applicable law, a person may request confirmation, access, correction, deletion, anonymization, restriction, portability, information about sharing, objection, review of automated decisions, withdrawal of consent or freedom from discriminatory treatment for exercising a right. Zofiti does not make a solely automated decision with legal or similarly significant effect through the described alpha service.
Send a request to joao.muller@zofiti.com.br. Zofiti may verify identity and scope before responding. For Customer Personal Data, Zofiti will forward or support the request through the Customer that controls the data. A person may also complain to the ANPD, a competent European supervisory authority or a relevant United States state authority when applicable.
12. Children and sensitive data
Sinalio is a business service and is not directed to children. Customers must not intentionally use it to collect children's data or sensitive categories unless a separate written agreement and lawful safeguards apply. If Zofiti learns that prohibited data was submitted, it may restrict processing and work with the Customer to delete it.
13. Changes to this Policy
Zofiti may update this Policy as the service, providers or law changes. The effective date remains visible at the top. Material changes will be communicated through the site, service or account contact as appropriate.