Privacy Policy
Legal texts version: v0-provisorio
This policy explains which personal data CarbonLink processes, why, and what your rights are, in line with Brazil's LGPD (Law 13,709/2018).
1. Who is the controller
TODO(owner): legal name, tax ID and address of the data controller.
2. Data we process
Account: name, email, usage profile, language and time zone. Passwords are never stored in plain text: we only keep a hash.
Organization and business: organization name, members and roles, properties (name, location, area), projects and documents you upload.
Restricted data (for example the property's CAR and registry number) is kept in a separate area, encrypted, with restricted and audited access.
Technical records: IP address and browser in security, consent and audit events.
At this stage we do not collect national tax IDs (CPF/CNPJ).
3. What we use it for (purposes and legal bases)
The table below is read directly from the platform's purposes register.
| Purpose | Legal basis | Consent | Retention |
|---|---|---|---|
| Account creation and management | Contract performance | No | To be defined |
| Security and fraud prevention | Legitimate interest | No | To be defined |
| Record keeping required by law | Legal obligation | No | To be defined |
| Commercial contact from the web form | Consent | Yes | To be defined |
| Marketing communications | Consent | Yes | To be defined |
| Usage analytics cookies | Consent | Yes | To be defined |
5. How long we keep it
Each type of data will have a defined retention period. The periods have not been defined yet (see “to be defined” in the table). When the law requires record keeping, data is anonymized instead of deleted.
6. Security
Organization-level access control in the database itself, two-step verification for sensitive profiles, encryption of restricted data, an immutable audit trail and files in private storage with temporary links.
7. Your rights (LGPD, art. 18)
You may request confirmation of processing, access, correction, anonymization or deletion, portability, information about sharing and withdrawal of consent.
The “My data” screen, where you will be able to export your data and open these requests, is still under construction. Until then, contact the data protection officer using the details below.
8. Data protection officer (DPO)
TODO(dono): The data protection officer's contact has not been configured yet.
10. Changes
This policy may change. The current version is recorded with your acceptances and consents.