Privacy Policy

1. Who processes your data

The controller of the data described in this Policy is KAFKA TECNOLOGIA E DESENVOLVIMENTO DE SOFTWARE LTDA ("Kafka Tech"), CNPJ 69.314.695/0001-82, with its registered office at Rua Pais Leme, 215, conjunto 1713, Pinheiros, São Paulo, SP, CEP 05424-150.

This Policy explains how we process the personal data of the people who use Kafka ("Users"), of the people who visit the website kafka.com.br and of the people who contact us. It follows Law No. 13,709/2018 (LGPD), the Brazilian General Data Protection Law, and the Marco Civil da Internet (Law No. 12,965/2014).

The data that a customer company enters in its own Workspace, such as the data of its customers, authors and suppliers, belongs to that company. In this case, the company is the controller and we are a processor, as set out in section 10 of the Terms of Service. Anyone who wants to exercise rights over this data must contact the company.

2. Data we collect

• Registration: display name, e-mail, optional profile photo, language and role in the Workspace.
• Company: legal name, CNPJ, address and logo of the company that creates the Workspace, and the data of the person responsible for payment.
• Payment: plan, billing history, card brand and last digits of the card. Stripe collects and stores the full card data.
• Access records: IP address, date, time and browser of each access.
• Usage records: the actions taken in the Workspace, kept in the audit history, and the error records.
• Acceptance records: the version of the Terms and of the Policies that you accepted, the date and time, the IP address and the browser.
• Browsing data, only with your consent: the pages you open on the website and in the app, the IP address and browser data, which Google Analytics collects. When you create your account, it keeps the campaign of your first visit and the Google Analytics identifier of your browser.
• Invitations: the e-mail of the person you invite to the Workspace, the role offered, the dates and the outcome.
• Workspace usage: counts and dates of use, such as the number of orders in the last 30 days or the date of the first authorized NF-e, without the content of the records.
• Contact and support: the messages you send us, including the support requests you write in Kafka, with the page you were on.
• Assistant: the questions you ask Kafka's assistant, the answers, the tools each answer used and the number of tokens of each answer. Only you see your conversations.

3. What we use the data for

• To create and maintain your account and to provide the contracted service. Legal basis: performance of a contract (art. 7, V, of the LGPD).
• To send the access code, invitations, billing notices and notices about changes to these documents. Legal basis: performance of a contract.
• To charge the subscription and to issue the service invoice. Legal bases: performance of a contract and compliance with a legal obligation (art. 7, II).
• To keep access records for 6 months. Legal basis: legal obligation (art. 15 of the Marco Civil da Internet).
• To keep the record of each acceptance of the Terms and the Policies, to prove what was accepted and when. Legal bases: performance of a contract and regular exercise of rights (art. 7, VI).
• To protect accounts and to prevent fraud and abuse. Legal basis: legitimate interest (art. 7, IX) and fraud prevention (art. 11, II, g).
• To improve Kafka with aggregated usage data. Legal basis: legitimate interest.
• To keep our relationship with customers in a CRM that we host ourselves: the registration, the Workspace and the company, the members, the invitations, the plan and the billing, the sign-up steps and the usage counts of each Workspace. We use this data to give support, to sell and to decide what to improve in Kafka. The data that the customer company enters in the Workspace, such as customers, products, orders and invoices, does not go to the CRM. Legal bases: performance of a contract and legitimate interest.
• To answer support requests. The request goes to our CRM and to our support mailbox, contato@kafka.com.br, with everything you write in it, including data of the customer company, such as an order number, an invoice or the name of a customer. We use this data only to answer the request. For the data of the customer company, we act as processors. Legal basis: performance of a contract.
• To answer the questions you ask the assistant, when the customer company turns it on with its own key of an artificial intelligence provider (Anthropic, OpenAI or Google, in the United States). The question, the earlier messages of the conversation, the company instructions and what the assistant reads in the Workspace go to the chosen provider to write the answer: totals such as sales, bills and consignment settlements, and the book data, such as the stock and the sales of each title and the name, short biography and dates of each contributor (authors, translators, flap copy writers and journalists), the names of the publisher, the imprint and a co-publisher as they appear on the book, and the name of each warehouse. The assistant reads only what your role allows. It never sends the name, document, e-mail, phone or address of a customer or a supplier. The customer company contracts the provider directly. For the data of the customer company, we act as processors. Legal basis: performance of a contract.
• To measure the use of the website and the app with Google Analytics and to know which campaigns the accounts, trials and first payments come from, if you consent. With your consent to Advertising, also to measure in Google Ads which Kafka ads brought the visits and the accounts. Legal basis: consent (art. 7, I). You can withdraw your consent at any time.
• To respond to authorities and to defend rights in proceedings. Legal basis: regular exercise of rights (art. 7, VI).

We do not sell personal data. We do not use your data to show you ads or to train artificial intelligence models.

4. Who we share data with

We engage these sub-processors, which process data only to provide services to us:

• Hostinger: hosting of the servers and the database, including our CRM.
• Cloudflare: storage of files, such as images and documents, and of the database backups (United States).
• Resend: sending of e-mails (United States).
• Proton: hosting of our mailboxes, contato@kafka.com.br and privacidade@kafka.com.br (Switzerland).
• Stripe: payment processing (United States and Brazil).
• Focus NFe: issuance of electronic fiscal documents, such as NF-e and NFC-e, and communication with the tax authorities (Brazil).
• OpenStreetMap Foundation: the Nominatim service, which receives the street, number, city, state and CEP of the addresses saved in Kafka by a client company that uses Lalamove and returns the latitude and longitude of each one, never a name, a phone number or a complement (United Kingdom).
• Google Fonts: typefaces loaded by the browser, which receive the IP address of whoever opens Kafka (United States).
• Google Analytics and Google Ads, from Google LLC: measurement of the use of the website and the app and, with Advertising, of our ads, only with your consent (United States).
• jsDelivr: the library of the API documentation page, loaded by the browser, which receives the IP address of whoever opens that page (global network).
• Cal.com: scheduling of calls with our team, when you choose to schedule one (United States).

We also share data:

• with the other Users of your Workspace, according to the role of each one;
• with the services that the customer company activates, such as Shopify, WooCommerce, Bling, Correios, Metabooks, Macunaíma and artificial intelligence providers, to the extent each integration requires;
• with Lalamove, when the customer company activates it for its deliveries: the pick-up and delivery address, the name and phone number of the sender and of the recipient, and the order and NF-e numbers of each delivery;
• with Rede Kafka, which receives only the catalog data that the customer company decides to send;
• with SEFAZ, which receives the data of each NF-e issued;
• with authorities, when the law or a court order requires it;
• with the successor of Kafka Tech in a corporate reorganization.

5. International transfer

Some sub-processors store data outside Brazil, mainly in the United States. These transfers follow art. 33 of the LGPD, with contractual clauses that require the sub-processor to provide a level of protection equivalent to that of Brazilian law. This also applies to Google, which receives the Google Analytics and Google Ads data only after your consent.

The OpenStreetMap Foundation receives only addresses, with no name, phone number or complement, in the United Kingdom. This transfer is necessary to quote and book the deliveries of the customer company and follows art. 33, IX, of the LGPD.

6. How long we keep data

• Account and Workspace data: while the subscription exists and for 90 more days after it ends, for export.
• Access records: 6 months.
• CRM data: the same periods as the account and Workspace data. When a member leaves a Workspace, the CRM keeps their record, marked as removed, until the account is deleted.
• Support requests: 1 year after they are sent. After that period, we delete the request from Kafka, from the CRM and from the support mailbox.
• Conversations with the assistant: the same periods as the account and Workspace data.
• Acceptance records: while the contract lasts and until the end of the limitation period.
• Billing data and invoices: 5 years, the period set by tax law.
• Data required to defend a right: until the end of the limitation period.
• Cookies: the period of each one is in the Cookie Policy.

After these periods, we delete or anonymize the data. Backups are erased in the normal rotation cycle.

7. Cookies and browser storage

The website and the app use necessary cookies, which keep your session open and store your cookie choice. The browser also stores your interface preferences, such as the theme, the language, the menu state and recent searches. On the Subscription screen, Stripe uses its own cookies to prevent payment fraud.

Only with your consent, the website kafka.com.br and the app app.kafka.com.br use Google Analytics 4 to measure use. With your consent to Advertising, Google Analytics also measures our ads in Google Ads. You can change your choice at any time. The Cookie Policy describes each cookie, what it is for and how long it lasts.

8. Security

We use encryption in transit, isolation between Workspaces in the database, passwordless access with a one-time code, role-based access control, audit records and backups. No system is completely secure. If an incident can cause relevant risk or damage, we notify the affected data subjects and the ANPD, as the law requires.

9. Your rights

The LGPD gives you the right to request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or out-of-date data;
• anonymization, blocking or deletion of data that is unnecessary or processed in breach of the law;
• portability of the data to another provider;
• information about who we share your data with;
• revocation of a consent and information about what happens if you do not give it;
• objection to processing carried out without consent, if it breaches the law;
• review of decisions made solely on the basis of automated processing.

To exercise these rights, write to privacidade@kafka.com.br. We may ask you to confirm your identity. We reply within 15 days. You can also file a complaint with the National Data Protection Authority (ANPD), at gov.br/anpd.

10. Age

Kafka is a service for businesses and is not intended for persons under 18 years of age. We do not knowingly collect data from children or adolescents. If we learn that this has happened, we delete the data.

11. Contact

The communication channel for data subjects and for the ANPD is privacidade@kafka.com.br.

12. Changes to this Policy

We may update this Policy. We give notice of relevant changes by e-mail or in Kafka before they take effect. We publish this Policy and every earlier version at kafka.com.br/en/privacy. Each version shows the day it was published, the day it takes effect and what changed.