Privacy Policy

This Privacy Policy describes how Bitcode21 Desenvolvimento de Software LTDA ("we", "us", or "our") collects, uses, and protects your personal data when you use the TaskPulse monitoring service ("Service"). We are committed to protecting your privacy and complying with the Lei Geral de Proteção de Dados (LGPD - Law 13.709/2018) and other applicable data protection laws.

1. Data Controller

The data controller responsible for your personal data is:

2. Data We Collect

2.1 Account Data

When you register for an account, we collect:

• Email address (used for login and notifications)
• Password (stored in hashed format)
• Notification email address (optional, for receiving alerts)
• Telegram chat ID (optional, for Telegram notifications)

2.2 Monitor Data

When you create and use monitors, we collect:

• Monitor configurations (name, type, interval, tolerance)
• Ping history (timestamps, duration, status)
• Signal payloads (JSON data you send to signal monitors)
• Monitor status and alert history

2.3 Usage Data

We automatically collect:

• API request logs (timestamps, endpoints accessed)
• IP addresses (for security and rate limiting)
• Browser type and version (for compatibility)
• Device information (for responsive design)

2.4 Payment Data

Payment processing is handled by Paddle, our third-party payment processor. We only store:

• Subscription status (active, canceled, etc.)
• Paddle customer ID and subscription ID
• Plan tier and billing cycle dates

We do NOT store credit card numbers, bank account details, or other sensitive payment information.

3. Purpose of Processing

We process your personal data for the following purposes:

• Service Provision: To provide, maintain, and improve the TaskPulse monitoring service
• Account Management: To create and manage your user account
• Notifications: To send alerts about your monitors via email or Telegram
• Billing: To process payments and manage subscriptions
• Security: To detect and prevent fraud, abuse, and security threats
• Communication: To respond to your inquiries and provide customer support
• Legal Compliance: To comply with applicable laws and regulations
• Service Improvement: To analyze usage patterns and improve our service

4. Legal Basis for Processing (LGPD)

Under the Lei Geral de Proteção de Dados (LGPD), we process your data based on:

• Contract Execution (Art. 7, V): Processing necessary to fulfill our contractual obligations to you when providing the Service
• Legitimate Interest (Art. 7, IX): Processing for security, fraud prevention, service improvement, and analytics, balanced against your rights
• Legal Obligation (Art. 7, II): Processing required to comply with Brazilian laws and regulations
• Consent (Art. 7, I): For optional features such as marketing communications, which you can withdraw at any time

5. Your Rights Under LGPD

As a data subject, you have the following rights:

• Right of Access: Request confirmation of processing and access to your data
• Right to Correction: Request correction of incomplete or inaccurate data
• Right to Anonymization, Blocking, or Deletion: Request deletion of unnecessary or excessive data
• Right to Data Portability: Request transfer of your data to another service provider
• Right to Information: Be informed about third parties with whom we share your data
• Right to Revoke Consent: Withdraw consent at any time for consent-based processing
• Right to Object: Object to processing that violates LGPD
• Right to Review Automated Decisions: Request human review of decisions made solely by automated means

To exercise any of these rights, please contact us at support@taskpulse.co. We will respond to your request within 15 days as required by LGPD.

6. Data Retention

6.1 Monitor Logs and Signals

Ping history and signal events are retained according to your subscription plan:

• Free Plan: 1 day retention
• Pro Plan: 7 days retention
• Business Plan: 30 days retention

6.2 Account Data

We retain your account data for as long as your account is active. After account deletion, we may retain certain data for a reasonable period to comply with legal obligations, resolve disputes, and enforce our agreements.

6.3 Billing Records

Billing and transaction records are retained for the period required by Brazilian tax and commercial laws (typically 5-10 years).

7. Data Sharing with Third Parties

We share your data with the following categories of third parties:

7.1 Service Providers

• Paddle: Payment processing and subscription management. Paddle acts as the Merchant of Record and processes your payment information according to their privacy policy.
• Amazon Web Services (AWS SES): Email delivery for account notifications and alerts.
• Telegram: Delivery of notification messages to users who opt-in to Telegram alerts.

7.2 Legal Requirements

We may disclose your data when required by law, court order, or governmental authority, or when necessary to protect our rights, safety, or property.

7.3 Business Transfers

In the event of a merger, acquisition, or sale of assets, your data may be transferred to the acquiring entity. We will notify you of any such change.

8. Cookies and Local Storage

8.1 Essential Storage

We use browser local storage to store:

• Authentication Tokens: JWT access and refresh tokens for secure session management
• User Preferences: Theme settings (light/dark mode)

8.2 No Third-Party Tracking

We do NOT use third-party tracking cookies, advertising cookies, or analytics services that track your behavior across other websites. Your activity on TaskPulse is not shared with advertisers or data brokers.

9. International Data Transfers

Your data may be processed in countries outside of Brazil, including the United States and European Union, where our service providers operate. When we transfer data internationally, we ensure appropriate safeguards are in place as required by LGPD, including:

• Transfers to countries with adequate data protection laws
• Contractual clauses ensuring data protection
• Compliance with international standards and certifications

10. Security Measures

We implement appropriate technical and organizational measures to protect your data:

• Encryption: All data transmitted over HTTPS/TLS encryption
• Password Security: Passwords are hashed using industry-standard algorithms
• JWT Authentication: Secure token-based authentication with short expiration times
• Rate Limiting: Protection against brute-force and DDoS attacks
• Access Controls: Limited access to personal data on a need-to-know basis
• Security Headers: Implementation of security headers to prevent common web vulnerabilities
• Regular Updates: Continuous security monitoring and updates

11. Children's Privacy

The Service is not intended for use by individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have collected data from a child, we will take steps to delete such information promptly.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or applicable laws. We will notify you of material changes by:

• Posting the updated policy on this page with a new "Last updated" date
• Sending an email notification for significant changes
• Displaying a notice in the Service dashboard

Your continued use of the Service after changes become effective constitutes acceptance of the revised policy.

13. Contact Us

If you have questions about this Privacy Policy, want to exercise your data rights, or have concerns about how we handle your personal data, please contact us:

You also have the right to file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD), Brazil's data protection authority.