S2BR
Log in

Privacy Policy

⚠️ Draft — not legal advice. This is a structured starting point generated for development. Have it reviewed by a qualified privacy professional and fill in the bracketed placeholders ([…]) before relying on it in production. It is written to be compatible with the EU/UK GDPR and Brazil's LGPD, but your obligations depend on your final data practices.

Last updated: [Month DD, YYYY]

This Privacy Policy explains how [S2BR legal entity name] ("S2BR", "we", "us") collects, uses, and protects your personal data when you use the S2BR platform (the "Service"). For terms of use, see our Terms of Service.

1. Who is responsible

S2BR is the controller of your personal data. You can reach us, or our data protection contact, at [privacy@example.com].

2. Data we collect

  • Account data — your name, email address, and password (stored only as a secure hash).
  • Profile data — optional information you add, such as your avatar and timezone.
  • Security data — authentication factors (two-factor settings, passkeys), and sign-in events including IP address, approximate location, device or browser, and timestamps.
  • Usage data — how you interact with the Service, for reliability and improvement.
  • Cookies — strictly necessary cookies to keep you signed in and secure (see §11).

We do not sell your personal data.

3. How we use your data

  • to create and operate your account and provide the Service;
  • to authenticate you and keep your account secure (including fraud and abuse prevention);
  • to communicate with you about your account and important changes;
  • to comply with legal obligations; and
  • to improve the reliability and quality of the Service.

4. Legal bases (GDPR)

We rely on: performance of a contract (to provide the Service you request); legitimate interests (to secure and improve the Service, balanced against your rights); consent (where we ask for it, e.g. optional features — you may withdraw it at any time); and legal obligation (where the law requires us to process data).

5. Sharing and processors

We share data only with service providers ("processors") acting on our instructions — for example cloud hosting and storage, transactional email, and bot/abuse protection. They are bound by contract to protect your data and use it only to provide their service to us. We may also disclose data where required by law.

6. International transfers

Where data is transferred outside your region, we use appropriate safeguards (such as Standard Contractual Clauses) as required by applicable law.

7. Data retention

We keep personal data only as long as needed to provide the Service and meet legal requirements. When you delete your account, we delete or irreversibly anonymize your personal data, except where we must retain limited records to comply with the law.

8. Your rights

Subject to applicable law (GDPR / LGPD), you may have the right to access, correct, delete, export (portability), restrict, or object to the processing of your personal data, and to withdraw consent. To exercise these rights, contact [privacy@example.com]. You also have the right to lodge a complaint with your local data protection authority.

9. Security

We protect your data with measures including encryption in transit, hashed passwords, short-lived signed sessions, and support for two-factor authentication and passkeys. No system is perfectly secure, but we work to protect your data and will notify you of a breach where the law requires.

10. Children

The Service is not directed to children under the age described in our Terms of Service. We do not knowingly collect data from them. If you believe a child has provided us data, contact us and we will delete it.

11. Cookies

We use only cookies that are strictly necessary to sign you in and keep the Service secure. We do not use advertising cookies. If we add analytics or optional cookies in the future, we will ask for your consent first.

12. Changes to this policy

We may update this Policy. When we make material changes we will update the "Last updated" date and, where appropriate, notify you.

13. Contact

Questions or requests about your privacy? Contact [privacy@example.com] or [postal address].