Privacy Policy

Registration Information: Name, email, password (encrypted), organization name.

Usage Data: Pages visited, features used, session duration.

CRM Data: Contacts, deals, pipelines and other information you enter into the system.

Payment Information: Processed exclusively by Mercado Pago. We do not store credit card data.

• Provide the Service: Manage your account, process payments, send notifications.
• Improve the Product: Analyze aggregate usage to identify improvements and bugs.
• Communication: Send transactional emails (account confirmation, invoices) and marketing (with opt-out).
• Security: Detect and prevent fraud, abuse and attacks.

We never sell your data to third parties.

Each organization's data is completely isolated. Users of Organization A can never view or access data from Organization B.

All database queries include a filter by organizationId to ensure absolute isolation.

• Encryption: Passwords with bcrypt, data in transit via HTTPS/TLS.
• Authentication: JWT tokens with expiration, HttpOnly and SameSite cookies.
• Database: PostgreSQL hosted on secure servers with daily backups.
• Monitoring: Access logs and error monitoring via Sentry.

Essential Cookies: Required for authentication and system operation.

Google Analytics: We use GA4 for aggregated usage analysis (anonymized).

You can disable non-essential cookies in your browser settings.

We share data only with:

• Mercado Pago: For payment processing (PCI-DSS compliant).
• Resend: For transactional and marketing emails.
• Vercel: Application hosting (SOC 2 Type II certified).
• Sentry: Error monitoring (anonymized data).

All partners sign DPAs (Data Processing Agreements) in compliance with LGPD.

Under the General Data Protection Law (LGPD), you have the right to:

• Access: Request a copy of all your data.
• Correction: Update incorrect data.
• Deletion: Delete your account and all associated data.
• Portability: Export your data in a readable format.
• Revocation: Withdraw consent for marketing at any time.

To exercise your rights, send an email to: privacidade@roilabs.com.br

Active Account: We retain your data while your account is active.

After Cancellation: Data is retained for 90 days for recovery, then permanently deleted.

Access Logs: Retained for 1 year for security purposes.

We may update this policy periodically. Significant changes will be communicated by email with 30 days' notice.

We recommend reviewing this page regularly.

For privacy questions, contact us:

• Email: privacidade@roilabs.com.br
• Company: ROI Labs
• Data Protection Officer (DPO): privacidade@roilabs.com.br