Privacy policy

1. Controller

Tavlabs Tecnologia Ltda, company number (CNPJ) 68.304.529/0001-32, Rua Madri, 191 · Jardim Europa · Sete Lagoas/MG · 35701-265 · Brazil. Data protection contact: juridico@tavlabs.com.br.

When you use our products to process data about your own customers, you are the controller of that data and Tavlabs acts as processor, following your instructions.

2. Data we process

• Account: name, email, password (stored only as a hash), company and phone where provided.
• Billing: legal name, tax number, billing address and payment history. Card details are handled directly by the payment provider and never reach our servers.
• Usage: access logs, IP address, browser and significant actions in the application, used for security, audit and support.
• Customer content: the files, text and records you create or upload while using the product.

3. Purposes and legal bases

• Performance of contract: creating and running your account, delivering the contracted features and providing support.
• Legal obligation: invoicing and retention of tax and access records required by law.
• Legitimate interest: platform security, fraud prevention and product improvement, using the minimum data necessary.
• Consent: marketing communications, which you can withdraw at any time without affecting the contracted service.

4. Who we share with

We do not sell personal data and do not share it for third-party advertising. We share only with suppliers that perform part of the service on our behalf, under contract and confidentiality obligations:

• Vercel — Application hosting.
• Supabase — Database and file storage.
• Asaas — Payment processing in Brazil.
• Paddle — Merchant of record and international payments.
• Anthropic e OpenAI — Text generation in AI features, when triggered by the user.

We may also disclose data to comply with a court order or legal obligation, notifying the data subject whenever the law allows.

5. International transfers

Some of these suppliers operate outside Brazil. Such transfers rely on the safeguards provided for in the LGPD, through contractual clauses and protection commitments equivalent to those required by Brazilian law.

6. AI features

Some products offer AI text generation. Content submitted through those features is processed by the AI provider solely to produce the requested output. We do not use customer content to train models, ours or third parties'.

7. Retention

Account data and content are kept while the subscription is active and for up to 30 days after termination, to allow export and recovery. Tax records are kept for five years and application access logs for six months, as required by Brazilian law.

8. Security

Encryption in transit, per-tenant data isolation in the database, least-privilege role-based access, optional two-factor authentication and an audit trail of sensitive actions. In the event of a security incident with material risk, we notify affected data subjects and the Brazilian data protection authority within the legal deadlines.

9. Your rights

You may request confirmation and access, correction, anonymisation or deletion, portability, information about sharing, and withdrawal of consent. Write to juridico@tavlabs.com.br; we respond within 15 days.

10. Cookies

This website uses only cookies necessary for it to work — session and preferences. There is no advertising tracking or visitor profiling. In the applications, session cookies keep you signed in.

11. Changes

If this policy changes materially, we notify customers by email and update the date at the top of this page. Previous versions are available on request at juridico@tavlabs.com.br.

Related: terms of service and acceptable use policy.