Privacy policy

How we collect, use, and protect your personal information.

Effective date: April 15, 2026

Legal disclaimer: This document is a template provided for informational purposes only. It does not constitute legal advice. You must review and customise this policy with qualified legal counsel before deploying to production or making it available to end-users.

Introduction#

AtendePraMim ("we", "our", "us") is committed to protecting your personal data. This Privacy Policy explains what data we collect, why we collect it, how we use it, and your rights under the General Data Protection Regulation (GDPR) and related legislation.

This policy applies to all users of our web application and related services (collectively, "the Service").

Data We Collect#

We collect personal data in the following categories:

Account data#

  • Email address (used as primary identifier)
  • Display name and profile information you choose to provide
  • Account creation timestamp and last activity

Authentication material#

  • Password (stored as an Argon2id hash — the plaintext is never retained)
  • Multi-factor authentication (TOTP) secrets (AES-256-GCM encrypted at rest)
  • Magic-link tokens (hashed before storage, single-use)
  • OAuth2 social login tokens (access and refresh tokens from providers, stored encrypted)

Organisation membership#

  • Organisation name, slug, and configuration
  • Your role within each organisation (owner, admin, member)
  • Invitation records

Billing data#

  • Stripe customer ID and subscription identifiers
  • Plan and quota information
  • Invoice records (retained for tax compliance — see Data Retention)
  • We do not store payment card numbers; these are processed directly by Stripe

Support data#

  • Content of support cases and comments you submit
  • File attachments uploaded to support cases

Usage and technical data#

  • Server-side structured logs containing user ID, organisation ID, and request ID (no email or IP address in logs by default)
  • Audit log entries for security-relevant actions (login, role change, data export, etc.)

We process your personal data on the following legal bases under GDPR Art. 6:

| Purpose | Legal basis | |---|---| | Providing and operating the Service | Art. 6(1)(b) — contract necessity | | Authentication and account security | Art. 6(1)(b) — contract necessity | | Billing and subscription management | Art. 6(1)(b) — contract necessity | | Legal and tax record-keeping (invoices) | Art. 6(1)(c) — legal obligation | | Audit logging for security and fraud prevention | Art. 6(1)(f) — legitimate interests | | Optional marketing communications (if opted in) | Art. 6(1)(a) — consent |

Where we rely on consent (Art. 6(1)(a)), you may withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.

Your Rights Under GDPR#

If you are located in the European Economic Area (EEA), United Kingdom, or another jurisdiction with equivalent data protection law, you have the following rights:

  • Art. 15 — Right of access: Request a copy of the personal data we hold about you.
  • Art. 16 — Right to rectification: Ask us to correct inaccurate or incomplete data.
  • Art. 17 — Right to erasure ("right to be forgotten"): Request deletion of your data. Available via the account settings privacy dashboard, subject to retention obligations under Art. 17(3).
  • Art. 18 — Right to restriction of processing: Request that we restrict processing of your data pending a dispute.
  • Art. 20 — Right to data portability: Download a machine-readable export of your personal data via the privacy dashboard (JSON format).
  • Art. 21 — Right to object: Object to processing based on our legitimate interests (Art. 6(1)(f)). We will cease processing unless we demonstrate compelling legitimate grounds.
  • Art. 22 — Automated individual decision-making: We do not use automated decision-making or profiling that produces legal or similarly significant effects on you.

To exercise any of these rights, use the privacy controls in your account settings or contact our Data Protection Officer (see below). We will respond within 30 days.

You also have the right to lodge a complaint with your local supervisory authority (e.g., the ICO in the UK, or your national DPA in the EU).

Data Retention#

| Data type | Retention period | |---|---| | Account and profile data | Until account deletion; up to 30 days in deactivation grace period | | Audit logs | [Insert your required retention period — e.g., 2 years] | | Data exports | 7 days after generation, then automatically deleted | | Invoices and billing records | 7 years (statutory tax retention obligation) | | Support case attachments | Duration of the support case plus [X] days | | Server request logs | [Insert your log retention period — e.g., 90 days] |

International Transfers#

We may transfer personal data to service providers located outside the EEA. Where we do so, we rely on appropriate safeguards including:

  • Standard Contractual Clauses (SCCs) as adopted by the European Commission
  • Adequacy decisions issued by the European Commission for recipient countries

Our primary infrastructure providers are [insert provider names], operating in [insert regions].

Data Security#

We implement technical and organisational measures appropriate to the risks of processing:

  • Encryption at rest: AES-256-GCM for sensitive fields (TOTP secrets, OAuth2 tokens, signing keys)
  • Password hashing: Argon2id (memory-hard, GPU-resistant)
  • Transport security: TLS 1.2+ for all data in transit
  • Session security: HttpOnly, Secure, SameSite=Lax cookies; no tokens in browser storage
  • Access control: Role-based access, least-privilege, org-scoped data isolation
  • Multi-factor authentication: Available to all users via TOTP or passkeys

Despite these measures, no system is completely secure. Please notify us immediately if you become aware of any security incident.

Cookies#

We use only strictly-necessary cookies. For full details, see our Cookie Policy.

Contact and Data Protection Officer#

If you have questions about this policy or wish to exercise your rights, contact us at:

Data Protection Officer [Your company name] [Address] Email: [dpo@example.com]

Do Not Sell or Share My Personal Information

This section applies to residents of California (CCPA/CPRA) and other US states with similar consumer privacy laws.

We do not sell or share personal information as defined by the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA).

AtendePraMim is a B2B SaaS platform. We process personal information only to provide the contracted service to our customers. All processing is carried out under:

  • GDPR: Art. 6(1)(b) — contract necessity
  • CCPA/CPRA: §1798.140(e) — business purpose (providing the service you requested)

We do not:

  • Sell personal information to third parties for monetary consideration
  • Share personal information with third parties for cross-context behavioural advertising
  • Use personal information for purposes incompatible with the business purpose for which it was collected

California residents have the additional rights to know, delete, correct, and opt out of the sale/sharing of personal information. As we do not sell or share, opt-out is already your effective status. To exercise other CCPA rights, use the privacy dashboard in your account settings or contact us at [privacy@example.com].