Privacy Policy

1 Responsible organization and scope

This Policy explains how REDDES TECNOLOGIA LTDA, Brazilian CNPJ 22.345.703/0001-94, processes personal data in connection with Pilot. Address: Rodovia DF-250, Km 2,5, QD 03, Conj. 06, Casa 02, Região dos Lagos, Brasília/DF, CEP 73255-904, Brasil. For privacy, individual rights, closure, and deletion, contact contato@reddes.com.br. This contact does not appoint a particular person as data protection officer.

REDDES acts as controller where it determines processing purposes and means, such as account and relationship administration. When processing data for a customer controller under documented instructions, it acts as processor within that activity. Roles depend on the actual processing.

2 Personal data involved

Depending on the account, plan, and features used, Pilot processes these data categories:

• Account and communications: name, email, authentication and account security data, organization, members, preferences, and content sent to support.

• Subscription and payment: customer and transaction identifiers, plan, currency, amounts, taxes, billing status and dates, and payment references. The Paddle flow may receive buyer, address, company, and transaction event data. Payment takes place through the provider’s checkout.

• Operation and security: sessions, access and audit records, events, logs, metrics, and resource availability. These records may contain identifiers and personal information.

• Integrations and content: repositories, files, databases, configurations, logs, and credentials needed for authorized deployment, administration, and backup operations. Content may include customer or third-party personal data.

Do not provide other people’s personal data without a legitimate basis and authorization appropriate to the context. Children’s and adolescents’ data, sensitive data, and regulated workloads require specific assessment.

• In the marketing-site contact form: name, email, message, and anti-spam verification data sent to the contact service. Form and authentication flows may use session and security technologies.

3 Purposes and legal bases

Each processing purpose must have an appropriate legal basis. Where necessary to enter into and perform the contract, account and subscription data may be processed to administer access, provide contracted features, and handle contract-related requests. Legal obligations may require fiscal records, responses to authorities, or retention of particular information.

Fraud prevention, security, and protection of rights require documented necessity, proportionality, and an appropriate legal basis. Legitimate interests, where applicable, require assessment of individuals’ rights and reasonable expectations. The establishment, exercise, or defense of legal claims may support the use of information in proceedings and disputes.

Where consent is the appropriate basis, it will be specific, informed, and withdrawable; using Pilot does not constitute blanket consent to all processing.

Where data is essential to a feature, the consequences of not supplying it must be explained at the appropriate point. Customer content will not be used for advertising or AI training on the basis of a general license in these Terms.

4 Sharing and service providers

Pilot uses Hetzner for hosting, KingHost for email, AWS S3 for managed backups, GitHub for repositories, Let’s Encrypt for certificates, Paddle and Asaas for billing, Country.is for country identification, and Google Analytics for optional marketing-site metrics. Sharing must be limited to the necessary purpose and data. Each provider’s role depends on the activity and agreement; not all are presumed to be REDDES processors.

Paddle and Asaas have their own responsibilities for their respective activities. Paddle is merchant of record for sales it processes, not for Asaas purchases. Paddle notice: https://www.paddle.com/legal/privacy. Asaas notice: https://central.ajuda.asaas.com/hc/pt-br/articles/32098003163035-Pol%C3%ADtica-de-Privacidade.

Google information: https://policies.google.com/privacy and https://support.google.com/analytics/answer/6004245. Data may also be shared to comply with legal obligations or valid orders or exercise rights, subject to applicable limits. Additional information may be requested through the privacy contact.

5 International transfers

The identified S3 backups use AWS us-east-1 in the United States. Hetzner, KingHost, Google, and other providers may involve access or processing in other countries. The countries for the main infrastructure, email, and other flows have not yet been fully confirmed.

For the other providers and processing activities described in this Policy, REDDES has not yet fully confirmed the countries of processing and the applicable legal mechanisms. Information about these processing activities may be requested at contato@reddes.com.br.

6 Retention account closure and deletion

Audit, billing, subscription, and payment event records have no automatic expiration and may remain stored after cancellation. You may request information or deletion through the privacy contact. Your request will be answered in accordance with applicable rights, explaining any legal or technical reasons that may prevent immediate fulfillment, without displacing mandatory rights.

Metrics and availability have a seven-day pruning routine. Customer backups use a configurable count of 1 to 90 copies, default 7 copies, not days. These settings do not establish one retention period for all data.

To request account closure or deletion of personal data, email contato@reddes.com.br. These requests are not processed automatically. Canceling renewal does not close your account or delete its data.

Requests must be handled under applicable rights and legal requirements. Responses must consider affected records, technical limits, and legally required retention without displacing mandatory rights. Data in customer-controlled infrastructure differs from REDDES-held data; closure does not, by itself, authorize deletion of that infrastructure.

7 Security and incidents

REDDES uses access controls and cryptographic protection for certain credentials, secrets, and billing data. This does not mean all data is encrypted or that security is absolute. Controls must be appropriate to the processing and risks involved.

Incidents involving personal data will be assessed and handled under applicable law. Notifications to the ANPD, affected individuals, and customer controllers must meet the legally required conditions and deadlines in each case, not an undefined contractual substitute.

8 Individual rights

Subject to applicable legal conditions, you may request confirmation of processing, access, correction, information about sharing, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability where regulated and applicable, deletion of consent-based data in legally permitted circumstances, withdrawal of consent, and information about the option not to consent and its consequences.

You may also object to processing without consent where it violates the law and seek review of decisions based solely on automated processing that affect your interests, where such decisions occur.

Send requests to contato@reddes.com.br. We may request only information needed to verify identity and protect data from unauthorized access. Rights may be exercised without charge as provided by law, and responses will meet applicable legal requirements. Requests concerning data processed on a customer controller’s instructions will be directed and supported according to each party’s role. You may complain to the competent authority, including the ANPD in Brazil.

9 Cookies and similar technologies

In the Pilot application, the authentication session is configured for 120 minutes. The currency preference is stored in localStorage without automatic expiration, and country information in sessionStorage is configured to remain valid for six hours. The browser queries Country.is, which receives the connection’s IP address; Pilot retains the country and its validity. These browser and session settings do not define general server-side data retention.

On the marketing site, the pilot.locale language preference is stored in localStorage without automatic expiration. The accept-or-refuse metrics choice is stored in pilot-site-metrics-consent-v1 for 180 days. Google Analytics and Google Tag load only after metrics are accepted. The _ga and _ga_B68JVS9E5K analytics cookies are configured for 180 days. This does not state a retention period on Google’s servers.

Metrics include page views and clicks on predefined calls to action. The code normalizes URLs without query parameters and does not send form fields in these events. Google Signals and ad personalization are disabled; that does not mean identifiers are absent. Collection depends on configuration and each provider’s responsibilities.

You can refuse metrics or withdraw your choice through the “Privacidade e cookies” control (privacy and cookies). Withdrawal removes analytics cookies and reloads the page without the tag. Using the site is not blanket consent. Forms and authenticated areas may use necessary session and security technologies.

10 Updates and international scope

Material changes will be communicated through available relationship channels. Changes in purpose or legal basis must be assessed before implementation and do not retroactively validate unlawful processing.

Pilot may serve customers outside Brazil, but applicable law depends on the activity, individual, and market. Translating this Policy into English does not amount to a universal declaration of compliance with the GDPR, UK legislation, or other local laws.