Privacy Policy

1. Data We Collect

Depending on how you use Auditaz, we may process:

• your email address;
• AWS resource data and identifiers required for analyses and reports;
• payment and subscription identifiers provided by Stripe;
• IP addresses and technical access logs;
• a hash of your IP address used to prevent abuse of the free scan.

Auditaz does not request or store your AWS login credentials or full payment card details.

We do not seek to collect sensitive personal data.

2. How We Use Your Data

We use this data to:

• create and maintain your account;
• analyze authorized AWS infrastructure;
• generate reports and monitoring results;
• process payments and subscriptions;
• send service-related communications;
• keep Auditaz secure and prevent fraud or abuse;
• comply with legal obligations.

Data necessary to provide the service and generate reports is processed primarily for performance of the contract.

Financial and tax records may be processed to comply with legal obligations.

Technical and security data may be processed for security and the prevention of fraud and abuse, including on the basis of legitimate interests, where applicable.

We do not sell your personal data or use it for third-party advertising.

3. Service Providers

We use service providers necessary to operate Auditaz, primarily:

• Amazon Web Services (AWS) — hosting, database infrastructure, backups, logs, and transactional email delivery.
• Stripe — payments, billing, and subscriptions.

These providers may process data necessary to provide their respective services.

4. International Data Transfers

Some data processed by Auditaz is processed outside Brazil.

Our primary infrastructure uses the AWS us-east-1 region in the United States for application hosting, databases, backups, and technical logs.

Stripe may also process payment and subscription data outside Brazil.

These transfers are made to enable the operation, storage, security, continuity, and billing of Auditaz and remain subject to applicable data protection requirements.

You may request additional information about our international data transfers by contacting suporte@auditaz.com.

5. How Long We Keep Your Data

In general:

• free reports are retained for up to 30 days;
• access logs are retained for up to 30 days;
• paid reports are retained while your account exists;
• financial and tax records are retained for the period required by law.

Data may be retained for additional periods when necessary to comply with legal obligations or to establish, exercise, or defend legal claims.

6. Cookies and Local Storage

We only use mechanisms necessary for Auditaz to operate and remember basic preferences, including:

• session — authentication;
• scan_pending — temporary information about an ongoing scan, retained for up to 24 hours;
• lang — your language preference;
• report_view — your report display preference.

We do not use cookies for third-party behavioral advertising.

7. Your Rights

You may request access to, correction or deletion of your personal data, information about its processing, and exercise other rights provided under Brazil's General Data Protection Law (Lei Geral de Proteção de Dados — LGPD).

You can access and export the data associated with your account using the export feature available on your account page and request deletion of your account using the deletion feature available in the same area.

Some data may be retained after a deletion request when its retention is required or permitted by law.

For other requests related to your personal data, contact suporte@auditaz.com.

You also have the right to submit a petition to Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados — ANPD) as provided by applicable law.

8. Security

We use technical and organizational measures designed to protect the data processed by Auditaz, including secure connections, data minimization, read-only AWS access, and restricted permissions.

No internet-connected service can guarantee absolute security.

9. Changes and Contact

We may update this Policy when Auditaz, our service providers, or applicable laws change.

Material changes may be communicated through Auditaz or to the email address associated with your account.

This Policy may be translated into other languages. In the event of any inconsistency, the Brazilian Portuguese version will prevail, subject to any mandatory rights applicable to the user.