Skip to content
Request a proposal
Privacy

Privacy, terms and LGPD, no fine print.

How Prototic handles personal data and the rules for using the site, in plain language: what we collect, why, for how long and how you exercise your rights.How we handle personal data and the site's terms of use, in plain language.

Version 1.014 min read

Document 01

Privacy Policy

13 sections7 min read

In brief
  • We collect only what you send us through the site — briefs, tickets, contact requests — plus technical browsing data.
  • We use it to reply, prepare proposals, serve clients, comply with the law and keep the site secure. We don't sell data.
  • In clients' systems and hosting, the client decides about the data. We follow their instructions.
  • You can request access, correction or deletion at any time: see LGPD and your rights.
13 sections

1.1Who we are

Prototic is a technology company headquartered in Goiânia, Goiás, Brazil. We build SaaS platforms, management and operations systems, apps and AI-powered automations, and we offer managed hosting and digital certificates.

For the data processed on this site and in our relationship with you, Prototic is the controller: it decides why and how the data is used.

1.2Who this policy applies to

It applies to:

  • site visitors;
  • anyone who sends a brief or requests a proposal;
  • clients and their representatives, including in support;
  • anyone who buys or renews a digital certificate with us;
  • suppliers and partners we exchange contact details with.

It does not cover the data our clients store in the systems and hosting we provide. In those cases, each client is the controller and has its own policy; Prototic acts as a processor (section 1.5).

1.3What data we collect

We collect the minimum necessary for each purpose. Here it is, by source:

SourceData
Brief and proposal requestName, job title, company, industry, email, WhatsApp or phone, preferred channel and project details: type, goal, features, timeline, company size, planned budget (if provided) and the description you write.
Quick brief (“Request a proposal” tab)What you need, your name, company and job title, and at least one channel: WhatsApp, phone or email.
Direct contactWhat you tell us over WhatsApp, phone or email, and your contact details.
Clients and contractsRepresentatives' details (name, job title, email and phone), billing and invoicing data, and support history.
Digital certificateIdentification data required by ICP-Brasil, including biometrics: see section 1.6.
Browsing the siteIP address, date and time of access, pages viewed, browser and device type, and cookies (section 1.7).
Bot verification (Cloudflare Turnstile)When you submit a form, Cloudflare Turnstile checks technical signals from your browser and device to confirm you're a person, with no visual challenge.
We don't ask for sensitive data through the site. Please don't include health data, personal documents or passwords in your brief, tickets or attachments.

1.4How we use data and on what legal basis

Every use of data needs a legal basis under the LGPD. These are ours:

PurposeLegal basis (LGPD)
Reply to your brief, understand the project and send a proposalPreliminary steps toward a contract, at your request (art. 7, V), or legitimate interest when you speak for a company (art. 7, IX)
Provide the contracted services, offer support and log ticketsPerformance of a contract (art. 7, V) and legitimate interest (art. 7, IX)
Issue invoices, collect payments and keep accounting recordsCompliance with a legal or regulatory obligation (art. 7, II)
Issue digital certificates under ICP-Brasil rulesLegal or regulatory obligation (art. 7, II); for biometrics, art. 11, II, “a”
Keep the site access logsLegal obligation: Marco Civil da Internet (Law No. 12,965/2014, art. 15)
Keep the site secure (such as bot verification on forms), prevent fraud and measure usage in aggregateLegitimate interest (art. 7, IX), always weighed against your rights
Send Prototic news and content, if you askConsent (art. 7, I), which you can withdraw at any time
Defend rights in judicial, administrative or arbitration proceedingsRegular exercise of rights (art. 7, VI)

We don't sell or rent personal data. Briefs are not subject to automated decisions: our technical team reads them.

1.5Data in client systems and hosting

When we build, maintain or host a system for a client, the data flowing through it belongs to the client's operation. In that role, Prototic is a processor: it processes the data only according to the client's instructions and the contract, with the agreed security measures.

  • we don't use this data for our own purposes;
  • we access only what's needed to develop, provide support, back up and keep the environment running;
  • when an AI automation uses third-party services, this is agreed with the client, in the project and in the contract;
  • when the contract ends, the data is returned or deleted, as the contract provides.

If you use a system belonging to one of our clients and want to exercise your rights, contact that company first. We help the client respond.

1.6Digital certificates (ICP-Brasil)

Issuing the e-CPF and the e-CNPJ follows the rules of ICP-Brasil, set by the National Institute of Information Technology (ITI). To confirm the identity of the person requesting the certificate, these rules require:

  • identification data and an official photo ID;
  • a CPF check and, for the e-CNPJ, the data and documents of the company and of its representative;
  • biometric capture: a photo of your face and, when possible, fingerprints, in person or by videoconference;
  • a recording of the session, when issuance is by videoconference.

Biometric data is sensitive personal data. It is processed only to meet the identification obligation (LGPD, art. 11, II, “a”) and kept for the minimum period set by the rules of ICP-Brasil, currently 7 years.

Issuance is carried out with a partner Certificate Authority, which is also a controller of this data.

1.7Cookies

Cookies are small files your browser stores to remember information from one page to the next.

TypePurposeCan I turn it off?
NecessaryMake the site work and keep it secure, such as remembering form choices and blocking abuse.No: the site needs them to work properly.
Audience measurementKnow, in aggregate, which pages are viewed most. We use Cloudflare Web Analytics, which doesn't set cookies or identify you.There's no cookie to turn off.
AdvertisingNot used.—

You can delete or block cookies in your browser settings. The site currently uses no optional cookies. If it ever does, they will only be enabled after you consent.

1.8Who we share data with

Only when necessary, and only with parties that also have a duty to protect the data:

  • infrastructure providers: cloud, hosting, email and customer service tools — Cloudflare (site hosting, the requests database, audience measurement and bot verification) and Resend (sending the emails from the forms);
  • our partner Certificate Authority, when issuing certificates;
  • accounting and payment providers, for invoicing and billing;
  • public authorities, when required by law or a court order.

Anyone who processes data on our behalf signs a contract with confidentiality and security obligations.

When you submit a form, your answers go by email to the sales team (via Resend) and a copy is stored in Cloudflare's database (Cloudflare D1), accessible only to Prototic. You also receive a confirmation email.

Our forms use Cloudflare Turnstile to block bots. The technical data it collects is processed by Cloudflare under the Turnstile Privacy Addendum (opens in a new tab).

1.9International transfers

Some of the cloud and email services we use may store data outside Brazil. When that happens, we follow the LGPD (arts. 33–36) and ANPD regulations: we rely on countries with a recognized level of protection or on contracts that include the standard clauses approved by the ANPD.

Cloudflare and Resend are U.S. companies; Resend sends the emails from its São Paulo region.

1.10How long we keep data

DataPeriod
Brief that didn't lead to a contractUp to 24 months after the last contact, or sooner if you request deletion.
Clients and contractsDuring the contract and, afterward, for the legal periods: tax, accounting and defense of rights.
Support tickets and attachmentsDuring the contract and up to 12 months after.
Site access logs6 months (Marco Civil da Internet, art. 15).
IP code used to limit submissions (a hash, never the IP)48 hours.
Digital certificate, including biometricsMinimum period under ICP-Brasil rules: currently 7 years.
Managed hosting backups7 days, rotated daily.

Once the period ends, the data is deleted or anonymized.

1.11How we protect data

  • encrypted connection (HTTPS) across the site;
  • need-to-know access, with individual logins;
  • passwords and keys kept in a vault, never in spreadsheets or messages;
  • backups, monitoring and access logging;
  • bot verification (Cloudflare Turnstile) and a per-IP submission limit on forms;
  • confidentiality commitments from our team and suppliers.

No system is invulnerable. If an incident occurs that may pose significant risk or harm, we notify the ANPD and the affected people (section 3.5).

1.12Children and teenagers

Prototic's site and services are aimed at businesses and professionals. We don't knowingly collect data from children or adolescents. If this happens by mistake, we delete the data as soon as we find out.

1.13Changes to this policy

We may update this policy when the law, our services or the site change. The date of the current version is shown at the top of the page, and important changes are communicated to clients by email.

Document 02

Terms of Use

9 sections4 min read

In brief
  • The site presents Prototic and takes proposal requests.
  • Sending a brief creates no contract: services, prices and timelines apply only in the signed contract.
  • The content and brand belong to Prototic. Use the site in line with the rules below.
9 sections

2.1Acceptance

These terms govern the use of the Prototic site. By browsing or submitting information through the site, you agree to them and to the Privacy Policy. If you don't agree, don't use the site.

If you use the site on behalf of a company, you declare that you can represent it.

2.2What the site offers

The site presents the company, its services — SaaS platforms, management and operations systems, apps, AI automations, managed hosting and digital certificates — and its contact channels.

The information is general and may change without notice. Examples, screens, scenarios and people shown on the site are illustrative.

2.3Briefs, proposals and contracts

  • a brief is a contact request, not an engagement, and does not bind either party;
  • our technical team reviews the request and, if it makes sense, sends a written proposal with scope, timeline and price;
  • we don't guarantee a response time or that every request will be accepted;
  • services, timelines, service levels (such as availability and backup) and responsibilities apply as defined in the signed contract, which prevails over the site;
  • you're responsible for the accuracy of the information you send.

2.4Acceptable use

When using the site, you agree not to:

  • submit false information or information in someone else's name without authorization;
  • attempt to access areas, systems or data without permission, or test the site's security without written authorization;
  • send viruses, malicious code or a volume of traffic that disrupts operation;
  • copy the site in bulk (data scraping) or use it to send spam;
  • post or send content that is illegal, offensive or infringes third-party rights.

We may block access for anyone who breaks these rules, without prejudice to any legal measures.

2.5Intellectual property

The Prototic brand, logo, text, images, videos, layout and code of the site belong to Prototic or are used with permission. You may read, share links and quote excerpts with attribution. Copying, modifying, selling or using the brand requires written authorization.

In contracted projects, ownership of the code and data follows what the contract says.

2.6Third-party links and services

The site may link to third-party services, such as WhatsApp, maps and social media. They have their own terms and policies, and Prototic is not responsible for their content or practices.

2.7Availability and liability

We work to keep the site online and accurate, but it may undergo maintenance, failures or outages. To the extent permitted by law, Prototic is not liable for damages caused by the use of the site's general information, by the site's unavailability or by acts of third parties.

Service levels for contracted products, such as hosting availability, apply as set out in the contract. Nothing in these terms limits rights guaranteed by Brazil's Consumer Protection Code, where it applies.

2.8Changes to these terms

We may update these terms at any time. The version in effect is the one published on this page, with the date at the top.

2.9Governing law and venue

These terms are governed by the laws of Brazil. The courts of the district of Goiânia (Goiás) are the chosen venue, subject to the consumer's right to sue in the courts of their domicile.

Document 03

LGPD and your rights

7 sections3 min read

In brief
  • Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) gives you rights over your personal data.
  • To exercise any of them, contact our DPO (section 3.3). It's free.
  • We reply right away in simplified form, or within 15 days with the full statement.
  • If you're not satisfied, you can take the matter to the ANPD.
7 sections

3.1Your rights as a data subject

Confirmation and accessFind out whether we process your data and get a copy.art. 18, I and II
CorrectionCorrect incomplete, inaccurate or outdated data.art. 18, III
Anonymization, blocking or deletionOf unnecessary or excessive data, or data processed unlawfully.art. 18, IV
PortabilityTake your data to another provider, in accordance with ANPD regulations.art. 18, V
DeletionDelete data processed based on your consent, except when the law requires it to be kept.art. 18, VI
Information about sharingFind out who we share your data with.art. 18, VII
ConsentKnow what happens if you don't consent, and withdraw consent whenever you want.art. 18, VIII and IX
ObjectionObject to processing done without consent that breaks the law.art. 18, § 2
Review of automated decisionsAsk for a review of fully automated decisions that affect your interests.art. 20
Petition the ANPDTake your complaint to Brazil's National Data Protection Authority.art. 18, § 1

3.2How to make a request

  1. Send your requestWrite to our DPO with the subject “LGPD Rights” and say which right you want to exercise.
  2. We confirm it's youWe may ask for a detail or document so your data doesn't go to someone else.
  3. We respondConfirmation that we process your data comes right away, in simplified form. The full statement, within 15 days (art. 19).
  4. If we can't fulfill itFor example, when the law requires us to keep the data, we explain why in writing.

Requests are free of charge.

3.3Data protection officer (DPO)

The DPO (“encarregado” under the LGPD) receives requests from data subjects and communications from the ANPD, and advises the team on data protection.

3.4Controller or processor: who's responsible

Prototic decidesController
  • the site and its forms;
  • briefs, proposals and contacts;
  • clients, contracts and billing;
  • digital certificates, together with the partner Certificate Authority.
The client decidesProcessor
  • data within the systems we build or maintain;
  • data in managed hosting;
  • automations and integrations built for the client.

3.5Security incidents

If a security incident occurs that may pose significant risk or harm to data subjects, Prototic notifies the ANPD and the affected people within the regulatory deadline (CD/ANPD Resolution No. 15/2024), stating what happened, which data was affected, the risks and the measures taken.

When an incident affects data of a client for whom we act as processor, we notify the client without delay so they can meet their obligations.

3.6National Data Protection Authority

The ANPD oversees compliance with the LGPD. If we don't resolve your request, you can file a petition with the ANPD through its official channels at gov.br/anpd.

3.7Glossary

Personal data
Information that identifies or can identify a person.
Sensitive personal data
Racial or ethnic origin, religious belief, political opinion, membership in a trade union or a religious, philosophical or political organization, data on health or sex life, genetic or biometric data.
Data subject
The person the data is about.
Controller
The party that decides on data processing.
Processor
The party that processes data for the controller.
DPO
The channel between the controller, data subjects and the ANPD.
Processing
Any operation on data: collecting, using, storing, sharing, deleting.
Anonymization
A technique that prevents linking data to a person.
PrivacyData protection officer

Questions about your data?

Contact our data protection officer. Requests for access, correction or deletion are free of charge and answered right away in simplified form, or within 15 days with a full statement.Access, correction and deletion requests are free. Simplified answer right away, or a full statement within 15 days.

Something else? Talk to our team.Go to Contact