Privacy Policy

1. Information Collection and Legal Bases

To deliver our services in compliance with the Brazilian General Data Protection Law (LGPD) and global privacy standards (such as GDPR), we process only the data strictly necessary for contract execution, legal obligations and legitimate interests.

1.1 Registration and Access Information

When you create an account, we collect your name, email address and securely hashed credentials for authentication, account management and essential service communications.

1.2 User Content and Attachments

We store the tasks, notes, flows and attachments you upload to the platform. Attachments (up to 5 MB on the Free plan and up to 50 MB on the Pro plan) are stored in secure cloud infrastructure with logical Workspace isolation and time-limited signed URLs. This content belongs exclusively to you, and Tareflo does not access, monetize or analyze it for other purposes, except when requested by you for customer support or required by court order.

1.3 Access Logs and Technical Metadata

In compliance with applicable laws, we collect and maintain connection records, IP addresses, access timestamps and device types strictly for security auditing, fraud prevention and platform integrity.

2. Secure Payment Processing (Stripe)

We use Stripe, Inc. as our third-party payment processor for subscriptions and billing.

Tareflo does not store, process or have access to your full credit card details. All financial transactions and payment data are operated directly by Stripe in an isolated, certified environment.

Stripe is certified as a PCI Level 1 Service Provider (PCI-DSS Level 1), the highest level of security certification in the payments industry.

3. Cookies, Measurement and Advertising

We use essential cookies to keep you signed in and to protect your session. Without them sign-in does not work, which is why they are not optional: they are what holds up access to your account.

To understand how the site is used and where visits come from, we use Google Analytics 4. It writes its own cookies in your browser, with names starting in “_ga”, and sends Google browsing data such as pages visited, time on page, device type and traffic source.

We also advertise Tareflo on Google Ads. Once you accept, the same Google tag starts recording which ad brought your visit and whether it led to a sign-up, and Google may use these cookies to show our ads on other sites you visit. None of this happens before you accept, and declining does not limit any part of the product.

We do not combine this data with the content of your account: your tasks, notes, flows and documents are never sent to Google. What travels is browsing data tied to the cookie identifier, used to measure audience and ad performance - not to build a profile of you inside Tareflo.

Google Analytics and Google Ads are operated by Google LLC, and this processing may involve an international transfer of data, under Chapter V of the Brazilian data protection law (LGPD).

You can block or delete cookies in your browser settings, install the official Google Analytics opt-out add-on, and turn off ad personalization in your Google Account settings. Clearing this site's data in your browser also clears your answer to the cookie notice, and it will ask again on your next visit. Blocking measurement and advertising cookies does not affect your use of Tareflo; blocking the essential ones prevents sign-in.

4. How We Use Your Information

Collected information is used for the following exclusive purposes:

• Provide, operate, maintain and improve Tareflo features;
• Notify you about platform updates, security alerts and invoices;
• Deliver customer support requested by you;
• Monitor system stability, technical performance and security against abuse or attacks;
• Process subscription payments and billing cycles via Stripe.

Privacy Commitment: Tareflo does not sell, rent or share your personal data or Workspace content with data brokers or advertising companies under any circumstances.

5. Security, Segregation and Data Retention

We enforce strict technical and organizational controls to protect data against unauthorized access, destruction or leakage, including AES-256 encryption at rest, TLS 1.3 in transit and role-based access control (RBAC).

We retain your personal and workspace data only for as long as your account remains active or as required by statutory, tax and regulatory retention rules. Upon account deletion, data is permanently erased or irreversibly anonymized from active databases.

6. Your Rights as a Data Subject (LGPD / GDPR)

You have the right to confirm the existence of data processing, access your data, rectify inaccuracies, request data portability, anonymization and permanent erasure of your personal data.

The controller of your personal data under the Brazilian General Data Protection Law (LGPD) is Valente Tecnologia da Informação LTDA, CNPJ 66.476.181/0001-35, headquartered in Ribeirão Preto, São Paulo.

To exercise any of your rights, request permanent account and data deletion, or contact our Data Protection Officer (DPO), please reach out through our Help Center or official support channels.