Privacy Policy for MineAtelier

Information We Collect

We collect the following categories of information:

• Personal Information: Name, email address, phone number, and other details provided during registration or use of the application.
• Atelier Data: Information about your atelier's clients (such as name, contact details, and order history), tasks, and financial records entered into the application.
• Usage Data: Information about how you interact with the application, including features used, time spent, and preferences.
• Technical Data: IP address, device type, operating system, and unique identifiers to ensure the application’s functionality.

How We Use Your Information

We use your information for the following purposes:

• Provide and Improve the Service: Manage your tasks, clients, and finances, and personalize your experience in the application.
• Communication: Send notifications about updates, task reminders, or responses to support inquiries.
• Analytics and Improvement: Analyze usage patterns to enhance the application’s functionality and user interface.
• Legal Compliance: Comply with legal or regulatory obligations when required.

Sharing of Information

We do not share your personal information with third parties except in the following cases:

• Service Providers: Trusted partners who assist in operating the application (e.g., hosting or analytics services), under confidentiality agreements.
• Legal Obligations: When required by law or to protect our rights, safety, or property.
• With Your Consent: For other purposes, only with your explicit permission.

Data Security

We implement robust security measures, including encryption and secure authentication, to protect your information from unauthorized access, loss, or alteration. However, no system is entirely immune to risks, and we continuously work to enhance our security.

Cookie and Session Policy

MineAtelier uses only essential cookies required for the service to function. We do not use tracking or advertising cookies.

• Session Cookie: Used to keep you authenticated during use of the application. Expires when you close the browser or after a period of inactivity.
• No Tracking: We do not use third-party analytics, tracking, or advertising cookies.
• Legal Basis: Essential cookies are necessary for contract performance (Art. 7, V of the LGPD). No additional consent is required for strictly necessary cookies.

Data Subprocessors

To operate MineAtelier, we use the following subprocessors that may process personal data:

• Stripe Inc.: Payment and subscription processing. PCI DSS Level 1 certified. May process data in the USA under standard contractual clauses. See Stripe's privacy policy at stripe.com/privacy.
• Hosting Infrastructure: Servers hosting the application and storing data, under data processing agreements with security standards equivalent to ours.

LGPD Compliance (Lei 13.709/2018)

MineAtelier complies with the Brazilian General Data Protection Law:

• Legal Basis (Art. 7): We process user data based on contract performance (Art. 7, V) to provide the service, and on consent (Art. 7, I) for communications. Atelier client data you enter is processed under your responsibility as a data controller.
• Data Minimization (Art. 6, III): We collect only the data that is necessary, adequate, and relevant for the service's purpose.
• Data Subject Rights (Art. 18): We provide built-in tools for confirmation, access, correction, portability, deletion, and consent revocation.
• International Transfer (Art. 33): Data processed by Stripe (USA) is protected by standard contractual clauses approved by the competent authority.
• Security Incident Notification (Art. 48): In case of a relevant security incident, we will notify the ANPD and affected data subjects within legal deadlines.
• Data Protection Officer (Art. 41): We have appointed a Data Protection Officer reachable at mineatelier.support@proton.me.

User Responsibility for Data

As a MineAtelier user, you are responsible for:

• Data Accuracy: Ensuring all data entered into the system is accurate and up to date.
• Customer Consent: Obtaining appropriate consent from your customers before entering their personal data into the system.
• Legal Compliance: Complying with all applicable laws regarding the processing of your customers' personal data.

Your Rights (Art. 18 LGPD)

As a data subject, you have the following rights guaranteed by the LGPD:

• Confirmation and Access: Request confirmation that your data is being processed and obtain a copy of the data we hold about you.
• Correction: Correct incomplete, inaccurate, or outdated data directly in your account settings.
• Anonymization, Blocking, or Deletion: Request the anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data.
• Portability: Receive your data in a structured format. Export Service Orders, Customers, Expenses, and Seamstresses in CSV via the Import/Export Data section.
• Consent Revocation: Revoke your consent at any time, without affecting the lawfulness of processing carried out before revocation.
• Account Deletion: Request complete deletion of your account and personal data in your account settings.
• Information on Data Sharing: Request information about public and private entities with whom we share your data.

To exercise these rights, contact us at mineatelier.support@proton.me. If you do not receive a satisfactory response within 15 business days, you may file a complaint with the ANPD (Brazilian National Data Protection Authority).

Data Retention

We retain your information for the following minimum periods based on legal obligations:

• Account Data: Retained while your account is active. Upon deletion, personal data is removed within 30 days, unless legally required to be retained.
• Financial Records: Transaction history retained for up to 5 years as required by Brazilian tax law.
• Access Logs: Access records retained for 6 months as required by Art. 15 of Brazil's Marco Civil da Internet (Law 12,965/2014).
• Payment Data: Billing data retained for up to 5 years as required by the Consumer Protection Code and Central Bank regulations.

Changes to This Policy

We may update this Privacy Policy periodically. We will notify you of significant changes through the application or via email.

Data Protection Officer (DPO) — Art. 41 LGPD

As required by Art. 41 of the LGPD, we have designated a Data Protection Officer with the following responsibilities:

• Receiving and responding to complaints and communications from data subjects.
• Receiving communications from the ANPD and taking appropriate measures.
• Guiding employees on personal data protection practices.
• Acting as a communication channel between the controller, data subjects, and the ANPD.

DPO contact: mineatelier.support@proton.me

Contact

If you have questions or concerns about this policy, please contact us: