Privacy Policy

This Privacy Policy explains how NOVAC STACK LTDA ("Novac Stack", "we", "us", or "our") processes personal data when you use Foundry (the "Service"), available at https://novacstack.com.

We are the data controller under Article 4(7) of the EU General Data Protection Regulation 2016/679 ("GDPR") and the controlador under Article 5, VI of the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, "LGPD"). For purposes of the California Consumer Privacy Act, as amended by the CPRA (collectively, "CCPA"), we are the business that determines the purposes and means of processing your personal information.

Our registered address is Brazil (registration no. CNPJ 40.942.532/0001-62). You can write to us at privacidade@novacstack.com.

Our Data Protection Officer (GDPR Art. 37) and Encarregado (LGPD Art. 41) can be reached at dpo@novacstack.com.

We collect the following categories of personal data:

2.1 Information you provide

• Account data: name, email address, password (hashed), profile photo, locale, time zone.
• Communications: messages you send to our support team and survey responses.
• Billing data: for paid plans, billing address and tax identifiers. Payment-card details are handled directly by our payment processor — we never see them.
• Content: data you submit to the Service in the course of using it.

2.2 Information we collect automatically

• Device and log data: IP address, browser type, operating system, referring URLs, pages viewed, and timestamps.
• Usage analytics: aggregated and pseudonymized metrics on feature use, collected only with your consent where required.
• Cookies and similar technologies: see §06.

2.3 Information we receive from third parties

If you sign in through a third-party identity provider (e.g. Google, Microsoft, Apple, Auth0), we receive the profile fields you authorize that provider to share with us.

2.4 Sensitive personal information

We do not intentionally collect sensitive personal information as defined under CCPA §1798.140(ae) or special categories of personal data under GDPR Art. 9 / LGPD Art. 11 (e.g. health data, government IDs, precise geolocation, biometric data). If you provide such information voluntarily, you may withdraw it at any time from the privacy controls in your account.

We process personal data for the purposes set out below. For each purpose we identify our legal basis under GDPR Art. 6 and LGPD Art. 7 (and, where applicable, Art. 11 for sensitive data).

• Provide and operate the Service — performance of a contract (GDPR Art. 6(1)(b)) / execution of a contract (LGPD Art. 7, V).
• Authenticate users and secure the Service — legitimate interest in fraud prevention and security (GDPR Art. 6(1)(f)) / legitimate interest (LGPD Art. 7, IX).
• Improve and develop the Service — consent for non-essential analytics (GDPR Art. 6(1)(a) / LGPD Art. 7, I); legitimate interest for aggregated, non-identifying improvements.
• Send transactional communications — performance of a contract.
• Send marketing communications — your explicit prior consent (GDPR Art. 6(1)(a) / LGPD Art. 7, I). You may withdraw consent at any time without affecting prior processing.
• Comply with legal obligations — compliance with applicable law (GDPR Art. 6(1)(c) / LGPD Art. 7, II).
• Defend our legal rights — establishment, exercise, or defense of legal claims (GDPR Art. 9(2)(f) where applicable / LGPD Art. 7, VI).

We do not engage in solely automated decision-making that produces legal or similarly significant effects about you within the meaning of GDPR Art. 22 / LGPD Art. 20.

We share personal data only as described below:

• Sub-processors: vendors who help us run the Service (hosting, email delivery, customer support, analytics, payments). Each sub-processor is bound by a written data-processing agreement that meets GDPR Art. 28 and LGPD Art. 39.
• Within your organization: if you use the Service through an organization, your administrators can access account and usage data.
• Legal obligations: we may disclose personal data in response to a valid legal request, to enforce our Terms, or to protect rights, property, or safety.
• Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to your continued rights under this Policy and applicable law.

Sale or sharing of personal information under CCPA. We do not sell personal information for money and we do not share personal information for cross-context behavioral advertising in the past 12 months. If this ever changes, we will update this section and provide a clear "Do Not Sell or Share My Personal Information" link, as required by Cal. Civ. Code §1798.135.

We operate globally. When we transfer personal data out of the European Economic Area, the United Kingdom, or Switzerland, we rely on the European Commission's Standard Contractual Clauses(Commission Implementing Decision (EU) 2021/914) and, where required, supplementary measures (encryption in transit and at rest, access controls, transparency reporting).

When we transfer personal data out of Brazil, we rely on the international-transfer mechanisms set out in Article 33 of the LGPD, including standard contractual clauses approved by the ANPD where available.

We use cookies and similar technologies to keep you signed in, remember preferences, secure the Service, and — with your consent — measure usage. You can manage non-essential cookies from the consent banner and from your account's privacy settings at any time.

We retain personal data only for as long as necessary for the purpose for which it was collected, including to comply with legal, accounting, or reporting obligations.

• Account data: for the lifetime of your account, plus up to 30 days after deletion to complete the erasure workflow.
• Billing records: as required by tax and accounting law (typically 5–10 years).
• Server logs: up to 90 days.
• Backups: until rotated out of our backup schedule (no longer than 35 days from deletion).

We implement technical and organizational measures appropriate to the risk (GDPR Art. 32 / LGPD Art. 46), including encryption in transit (TLS 1.2+) and at rest, role-based access controls, audit logging, regular penetration testing, and security training for staff. No method of transmission or storage is 100% secure; we will notify you and the relevant supervisory authority of a personal-data breach within the time limits set by law (GDPR Art. 33–34 / LGPD Art. 48).

You can exercise the rights below at any time from your account's privacy settings or by emailing privacidade@novacstack.com. We will respond within the time limits set by applicable law and will not charge you a fee for ordinary requests.

9.1 If you are in the European Economic Area, the United Kingdom, or Switzerland (GDPR)

I. Access (Art. 15)

Confirm whether we process your data and obtain a copy.

II. Rectification (Art. 16)

Correct inaccurate or incomplete data.

III. Erasure (Art. 17)

Request deletion of your data — the "right to be forgotten".

IV. Restriction (Art. 18)

Restrict processing in specific circumstances.

V. Data portability (Art. 20)

Receive your data in a structured, machine-readable format.

VI. Object (Art. 21)

Object to processing based on legitimate interests, including profiling.

VII. Withdraw consent (Art. 7(3))

Withdraw consent at any time, without affecting prior processing.

VIII. Lodge a complaint

Complain to your local supervisory authority. The list of EU/EEA authorities is available at edpb.europa.eu.

9.2 If you are in Brazil (LGPD Art. 18)

I. Confirmação da existência de tratamento

Confirmar se realizamos o tratamento dos seus dados pessoais.

II. Acesso aos dados

Obter cópia dos dados pessoais que mantemos sobre você.

III. Correção de dados incompletos, inexatos ou desatualizados

Atualizar ou corrigir informações que estejam incorretas.

IV. Anonimização, bloqueio ou eliminação

Solicitar para dados desnecessários, excessivos ou tratados em desconformidade com a LGPD.

V. Portabilidade

Receber seus dados a outro fornecedor de serviço ou produto.

VI. Eliminação de dados tratados com consentimento

Solicitar a eliminação dos dados pessoais tratados com o seu consentimento.

VII. Informação sobre compartilhamento

Saber com quais entidades públicas e privadas o controlador realizou uso compartilhado de dados.

VIII. Informação sobre não fornecer consentimento

Conhecer a possibilidade de não fornecer consentimento e suas consequências.

IX. Revogação do consentimento

Revogar o consentimento a qualquer tempo, nos termos do Art. 8º, §5º.

X. Oposição

Opor-se ao tratamento realizado com fundamento em outra hipótese legal, em caso de descumprimento da LGPD.

Você também pode apresentar reclamação à Autoridade Nacional de Proteção de Dados (ANPD) pelo site gov.br/anpd.

9.3 If you are a California resident (CCPA / CPRA)

I. Right to know

What personal information we collect, use, disclose, and (where applicable) sell or share.

II. Right to delete

Personal information we collected from you, subject to legal exceptions.

III. Right to correct

Inaccurate personal information we maintain about you.

IV. Right to opt out

Of the sale or sharing of personal information for cross-context behavioral advertising.

V. Right to limit sensitive PI

Restrict the use and disclosure of sensitive personal information.

VI. Right to non-discrimination

You will not face discriminatory treatment for exercising your rights.

You can submit requests at privacidade@novacstack.com. We will verify your identity before fulfilling the request. You may designate an authorized agent in accordance with Cal. Civ. Code §1798.135.

9.4 If you are in other US states with comprehensive privacy laws

Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with applicable privacy laws have analogous rights to access, correct, delete, and opt out of targeted advertising, sale of personal data, and certain profiling. Use the contact above to exercise them.

The Service is not directed to children under 13 (or under 16 in the EU/EEA, or under 18 in Brazil for services without specific safeguards under LGPD Art. 14). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, contact us at privacidade@novacstack.com and we will take steps to delete it.

We may update this Policy from time to time. Material changes will be notified through the Service or by email at least 30 days before they take effect, except for changes required by law that take effect immediately. The "Last updated" date at the top of this page tells you when this Policy was last revised.

You can contact our privacy team at privacidade@novacstack.com or by writing to Brazil.

Data Protection Officer / Encarregado: dpo@novacstack.com.

For our terms of use, see our Terms of Use.