Privacy Policy
1. Controller
Applicati Tecnologia Ltda. Data protection officer contact: suporte@applicati.com.br.
2. Data we collect
- From the order: email, name, CPF or CNPJ, domain to be tested.
- Avançado tier: source code uploaded by the client.
- Payment: processed by Mercado Pago; Applicati does not store card data.
- Execution: technical logs and evidence from the tests (requests, responses, payloads).
- Free test: email, the domain you entered, IP address and date/time of consent (with the version of the text accepted), the findings and the score. If the background analysis finds evidence, we keep that technical evidence.
- Contact form: name, email, domain (optional) and the message you write. The message is emailed to our team and is not kept in our database.
- Abuse protection (free test, order, contact and sign-in): IP address, the email in normalized form (without variations such as “+tag”) and the registrable domain, used to limit repeated use and to apply the one-free-test-per-domain rule. The captcha result (Cloudflare Turnstile) is checked when you submit.
3. Legal basis
Performance of a contract (art. 7, V, LGPD) for order and execution data; consent for non-essential communications and for the free test (including the deeper background analysis and emailing you its result). You can unsubscribe from any email in one click. Contact form: consent. Abuse protection and captcha: legitimate interest (art. 7, IX, LGPD), to keep the services secure and prevent fraud and automated use.
4. Sharing
Only with strictly necessary processors: Clicksign (electronic signature), Mercado Pago (payment), Cloudflare (Turnstile captcha: when the form loads, Cloudflare receives technical data about your connection and browser, such as the IP address, to tell people from robots; Cloudflare may process that data outside Brazil) and the test execution infrastructure. We do not sell personal data.
5. Retention
Final report: 5 years. Raw logs and evidence: 90 days after delivery. Avançado-tier source code: discarded per the intake flow policy, not subject to the 90-day term. Free test: email, domain and the consent record are kept to prove authorization; the technical evidence from the background analysis is deleted 90 days after it is found. Contact form messages: kept in the team's mailbox for as long as needed to reply and to prove the service.
6. Data subject rights
Confirmation of processing, access, correction, anonymization, portability and deletion, under the LGPD, via the officer contact above.
7. Cookies
The site does not use its own cookies. Authentication is magic-link based, with the token carried in the URL rather than a session cookie. There is no advertising or marketing tracking. The Cloudflare captcha (Turnstile), loaded on the forms, may use strictly necessary browser storage for the security check.