Privacy Policy

Data processing on this platform is carried out by Stratta Comércio e Serviços Ltda (trade name Stratta), registered under CNPJ (Brazilian corporate taxpayer ID) no. 61.513.148/0001-14, headquartered in Lagoa da Confusão/TO, Brazil. For any privacy matter or request based on the LGPD (Brazil's General Data Protection Law), contact us at contato@stratta.app.

Important (controller vs. processor). When you enter data about your OWN customers into the platform (names, phone numbers, addresses), you are the controller of that data and Stratta acts only as a processor, handling it according to your instructions. This policy covers how Stratta handles the data of the people who use the platform; for your customers' data, the legal basis and the relationship with them are your responsibility (see the Terms of Use, section 5).

When you use Plataforma Stratta, we collect:

• Registration: email, name, password (stored as a hash), optional phone number
• Company data: CNPJ/CPF (Brazilian taxpayer IDs), legal name, address, PIX key (Brazil's instant payment system; only if you fill it in so it appears on quotes)
• Content you create: products, quotes, orders, registered customers, filaments, printers
• Payment: when you subscribe to a plan, CPF/CNPJ and the data needed, processed by our billing partner (we do not store card numbers)
• Usage: access logs, IP address, browser, main actions (for debugging and improvement)
• Integrations: access tokens (OAuth) for the marketplace accounts you connect (Mercado Livre, Shopee)
• WhatsApp (optional): messages exchanged with the agent and the list of authorized numbers (text kept for 90 days, media for 15 days)

• Operating the platform (calculator, quotes, syncing between devices) · performance of the contract;
• Processing payments for paid plans · performance of the contract;
• Sending transactional emails (password recovery, receipts, alerts) · performance of the contract;
• Improving the product through aggregated usage analysis · legitimate interest;
• Handling support requests and complying with legal obligations.

We do not use your product, quote or customer data to train third-party AI. The content you put in Plataforma Stratta is yours.

We use the subprocessors below to operate the service, each for the stated purpose and under a data protection contract:

• Supabase · database, authentication and storage (USA, with encryption at rest)
• Vercel · hosting and delivery of the application (USA)
• Asaas · billing for paid plans (PIX, boleto (Brazilian bank slip), card) · only when you subscribe
• Resend · sending of transactional emails (receives the destination email)
• Google (Gemini) · AI for the Analyzer and the agent · receives only the text you send for analysis
• Groq · transcription of audio messages received by the WhatsApp agent
• Evolution API / Meta (WhatsApp) · connecting the agent to WhatsApp · only if you enable the integration
• Mercado Livre / Shopee · when you connect the integration, to sync listings and orders

We do not sell, rent or trade your data with anyone outside this operational list. Some of these providers are located outside Brazil (USA); the international transfer takes place with the safeguards provided for in the LGPD.

We use essential cookies (login session, active organization) and preference cookies (light/dark theme, sidebar). We do not use advertising tracking cookies.

You can, at any time:

• Access your data (everything is visible in the app);
• Export a complete JSON backup (menu Config → Dados, "Settings → Data");
• Correct data (records, company, account);
• Delete your account (request it by email at contato@stratta.app · we process it within 30 days);
• Revoke integrations (Marketplace → Desconectar, "Disconnect").

Data travels over HTTPS and is stored in a database with encryption at rest on the infrastructure (Supabase/AWS). Passwords are stored as a hash. The access tokens for marketplace integrations are additionally encrypted at the application level (AES-256-GCM), with the key kept outside the database. Isolation between organizations is enforced by database access policies (RLS), so that each account sees only its own data. Administrative access is restricted and audited. No system is 100% unbreachable, but we adopt technical and organizational measures proportionate to the risk.

• Active account: we keep your data for as long as you use the service;
• Deleted account: deletion within 30 days · export your JSON backup (Config → Dados) before requesting it, because afterwards there is no way to recover it;
• Database backup: automatic daily Supabase snapshot, kept for 7 days · used only for recovery in case of an incident on our side, not to restore an individual deleted account;
• WhatsApp messages: text 90 days, media 15 days (automatic cleanup);
• Access logs: 90 days.

Data subject to a legal retention obligation (e.g. tax records) is kept for the period required by law.

Plataforma Stratta is not intended for people under 18 and we do not knowingly process data of minors. If we identify a minor's account, it will be closed.

Updates to this policy will be announced by email or in the app 15 days in advance. The date at the top always reflects the latest revision.

Questions about privacy, LGPD requests or complaints: contato@stratta.app. You may also contact the ANPD (Brazil's National Data Protection Authority) if you prefer an independent channel.

This English version is informational. This policy was written in Portuguese, and the Portuguese version is the one that governs. In case of any divergence or inconsistency between the two versions, the Portuguese version prevails.