Legal
Privacy Policy — Clonecode
Last updated: [DATA] · Version: draft-0.1
1. Controller and contacts
The controller (LGPD) / data controller (GDPR) is [NOME DA EMPRESA], CNPJ [CNPJ], [ENDEREÇO]. Privacy contact: [EMAIL DE PRIVACIDADE]. Data Protection Officer / Encarregado: [NOME E CONTATO DO ENCARREGADO/DPO]Still under legal review.
2. Data we collect
| Data | Source | Why |
|---|---|---|
| E-mail address, user ID, language | You | Login by magic link, delivery of results, account, transactional e-mails |
| Acceptance and consent records: purpose (terms or marketing), version/hash of the text shown, language, page, date/time, truncated IP | You / our systems | Proof of consent and acceptance |
| URLs you submit and the host | You | To run the job; abuse prevention |
| Job report and progress (steps, counts of files, errors) | Our systems | To show you the result and support you |
| The copy itself (mirror, kit, preview image and video) | Public pages you asked us to copy | To deliver the service; kept 14 days |
| Abuse and audit logs: IP address, requested host, action, result code, date/time | Our systems | Fraud, phishing and abuse prevention |
| Purchase and credit ledger: SKU, amount, currency, payment ID, status, credit movements | Us / payment provider | Delivering credits; tax and accounting |
| Application logs (request ID, user ID, error code, duration) | Our systems | Operation and security. No e-mail, no full URL with query, no page body |
| Basic usage events (e.g. "checkout started", "download") | Our systems | Operating and improving the product |
| Anonymous page-view analytics | Vercel Web Analytics (no cookie) | Aggregate trafficStill under legal review |
We do not receive or store payment card data; it goes to the payment provider.
Page content you ask us to copy may incidentally contain personal data of third parties that is publicly visible on that page. We only process it to deliver the copy to you and delete it after 14 days.Still under legal review
3. Why we use it and the legal basis
This section is being written with our lawyer. It will be filled in before launch.
| Purpose | Data | Legal basis (proposed) |
|---|---|---|
| Create account, login, deliver kit | E-mail, ID, language, job data | Performance of a contract (steps requested by you) |
| Run and deliver copies | URL, copy, report | Performance of a contract |
| Take payment, grant credits, handle refunds | Purchase and ledger data | Performance of a contract; legal obligation (tax) |
| Proof of terms acceptance | Consent record | Legitimate interest / legal-claims defenceStill under legal review |
| Marketing e-mails | E-mail, consent record | Consent, given by an unticked box, separate from accepting the Terms. Withdraw anytime in one click |
| Transactional e-mails (login, receipt, copy ready, expiry notice) | Performance of a contract. They contain no offers.Still under legal review | |
| Abuse, phishing and fraud prevention, security | IP, host, logs | Legitimate interestStill under legal review |
| Tax and accounting | Purchases, ledger | Legal obligation |
| Product operation and improvement | Usage events, logs | Legitimate interest |
We do not sell personal data. We do not make decisions with legal effects based solely on automated processing, except that our engine automatically refuses certain pages (e.g. pages with password fields or on our high-risk blocklist), which does not depend on your personal dataStill under legal review.
4. Marketing
We send marketing only if you tick the marketing box (unticked by default). The e-mail you give for login and delivery is not consent for marketing. Every marketing message has a one-click unsubscribe and states why you receive it. Unsubscribing from marketing does not stop transactional e-mails. A spam complaint stops marketing permanently. We keep a record of your consent (text hash, date, truncated IP). For EU users we may use double opt-inStill under legal review. Marketing e-mail will be sent from a separate sending domain.
5. Retention
| Data | Retention |
|---|---|
| Copy (zip, mirror) and preview | 14 days, then deleted from storage. Notice about 48 hours before |
| Account data (e-mail, language) | While the account exists; deletion on request (target: within 15 days)Still under legal review |
| Marketing consent records | Up to 5 years after withdrawalStill under legal review |
| Abuse/audit logs (with IP) | 180 daysStill under legal review |
| Purchases and credit ledger | About 5 years, for tax reasonsStill under legal review. On account deletion the user is anonymised and the record keptStill under legal review |
| Application logs | 30 days |
| Database backups | Hold metadata only (paths, sizes), not copy contents; kept forStill under legal review |
This section is being written with our lawyer. It will be filled in before launch.
6. Who receives your data: processors and sub-processors
Planned list, to be confirmedStill under legal review:
| Provider | Role | Data | Location |
|---|---|---|---|
| Vercel | App hosting, web analytics (no cookie) | Requests, logs, analytics | Still under legal review |
| Supabase | Database, authentication, file storage | Account, jobs, ledger, copies | Still under legal review |
| Worker server providerStill under legal review | Runs the copy jobs | URLs, copy contents (temporary) | Still under legal review |
| Cloudflare | DNS and Turnstile (bot check) | IP, request signals | Global |
| Resend | Transactional (and later marketing) e-mail | E-mail address, message content | Still under legal review |
| [PROCESSADOR DE PAGAMENTO]Still under legal review | Payments | Payment and billing data, e-mail | Still under legal review |
We may also disclose data to comply with law, court orders, or to protect rights and prevent abuse, and in a corporate transactionStill under legal review. The payment provider may act as an independent controller for its own purposes.
7. International transfers
Our providers may process data outside your country, including the United States and other places.Still under legal review
8. Cookies and similar technologies
We use the minimum necessary:
- Strictly necessary: session cookies for login (HttpOnly, Secure), a language preference cookie (about 1 year), and Cloudflare Turnstile on forms for bot protectionStill under legal review.
- Analytics: Vercel Web Analytics, cookie-free. No advertising cookies and no third-party tracking at launch.
This section is being written with our lawyer. It will be filled in before launch.
9. Your rights
Under LGPD, GDPR and similar laws, depending on where you live, you may ask to: confirm that we process your data and access it; correct it; delete or anonymise it; receive it in a portable format; object to or restrict processing; withdraw consent at any time (without affecting prior processing); get information on who we shared it with; and request review of automated decisions. You may also complain to your data protection authority (in Brazil, the ANPD; in the EU, your national authority).
To exercise rights, write to [EMAIL DE PRIVACIDADE]. We may need to verify your identity. Target response time: [PRAZO]Still under legal review. Some data must be kept by law (e.g. tax records) and cannot be deleted on request.
10. Security
We use access controls, row-level security in the database, private storage, short-lived signed download links, isolated per-job execution, filtered network egress, and logs without sensitive data. No system is perfectly secure.Still under legal review
11. Children
The Service is not directed to children under [IDADE MÍNIMA]Still under legal review. We do not knowingly collect their data.
12. Changes
We will update this policy as the Service evolves and will notify you of material changesStill under legal review. The version date is at the top.
13. Contact
[NOME DA EMPRESA] · [ENDEREÇO] · [EMAIL DE PRIVACIDADE] · DPO/Encarregado: [NOME E CONTATO DO ENCARREGADO/DPO].