Privacy Policy

1. Who processes your data

The controller of the data described in this Policy is KAFKA TECNOLOGIA E DESENVOLVIMENTO DE SOFTWARE LTDA ("Kafka Tech"), CNPJ 69.314.695/0001-82, with its registered office at Rua Pais Leme, 215, conjunto 1713, Pinheiros, São Paulo, SP, CEP 05424-150.

This Policy explains how we process the personal data of the people who use Kafka ("Users"), of the people who visit the website kafka.com.br and of the people who contact us. It follows Law No. 13,709/2018 (LGPD), the Brazilian General Data Protection Law, and the Marco Civil da Internet (Law No. 12,965/2014).

The data that a customer company enters in its own Workspace, such as the data of its customers, authors and suppliers, belongs to that company. In this case, the company is the controller and we are a processor, as set out in section 10 of the Terms of Service. Anyone who wants to exercise rights over this data must contact the company.

2. Data we collect

• Registration: display name, e-mail, optional profile photo, language and role in the Workspace.
• Company: legal name, CNPJ, address and logo of the company that creates the Workspace, and the data of the person responsible for payment.
• Payment: plan, billing history, card brand and last digits of the card. Stripe collects and stores the full card data.
• Access records: IP address, date, time and browser of each access.
• Usage records: the actions taken in the Workspace, kept in the audit history, and the error records.
• Acceptance records: the version of the Terms and of the Policies that you accepted, the date and time, the IP address and the browser.
• Browsing data, only with your consent: the pages you open on the website and in the app, the IP address and browser data, which Google Analytics collects.
• Contact: the messages you send us.

3. What we use the data for

• To create and maintain your account and to provide the contracted service. Legal basis: performance of a contract (art. 7, V, of the LGPD).
• To send the access code, invitations, billing notices and notices about changes to these documents. Legal basis: performance of a contract.
• To charge the subscription and to issue the service invoice. Legal bases: performance of a contract and compliance with a legal obligation (art. 7, II).
• To keep access records for 6 months. Legal basis: legal obligation (art. 15 of the Marco Civil da Internet).
• To keep the record of each acceptance of the Terms and the Policies, to prove what was accepted and when. Legal bases: performance of a contract and regular exercise of rights (art. 7, VI).
• To protect accounts and to prevent fraud and abuse. Legal basis: legitimate interest (art. 7, IX) and fraud prevention (art. 11, II, g).
• To improve Kafka with aggregated usage data. Legal basis: legitimate interest.
• To measure the use of the website and the app with Google Analytics, if you consent. Legal basis: consent (art. 7, I). You can withdraw your consent at any time.
• To respond to authorities and to defend rights in proceedings. Legal basis: regular exercise of rights (art. 7, VI).

We do not sell personal data. We do not use your data for advertising or to train artificial intelligence models.

4. Who we share data with

We engage these sub-processors, which process data only to provide services to us:

• Hostinger: hosting of the servers and the database.
• Cloudflare: storage of files, such as images and documents, and of the database backups (United States).
• Resend: sending of e-mails (United States).
• Stripe: payment processing (United States and Brazil).
• Focus NFe: issuance of NF-e and communication with SEFAZ (Brazil).
• Google Fonts: typefaces loaded by the browser, which receive the IP address of whoever opens Kafka (United States).
• Google Analytics, from Google LLC: measurement of the use of the website and the app, only with your consent (United States).
• jsDelivr: the library of the API documentation page, loaded by the browser, which receives the IP address of whoever opens that page (global network).
• Cal.com: scheduling of calls with our team, when you choose to schedule one (United States).

We also share data:

• with the other Users of your Workspace, according to the role of each one;
• with the services that the customer company activates, such as Shopify, WooCommerce, Bling, Correios, Metabooks, Macunaíma and artificial intelligence providers, to the extent each integration requires;
• with Rede Kafka, which receives only the catalog data that the customer company decides to send;
• with SEFAZ, which receives the data of each NF-e issued;
• with authorities, when the law or a court order requires it;
• with the successor of Kafka Tech in a corporate reorganization.

5. International transfer

Some sub-processors store data outside Brazil, mainly in the United States. These transfers follow art. 33 of the LGPD, with contractual clauses that require the sub-processor to provide a level of protection equivalent to that of Brazilian law. This also applies to Google, which receives the Google Analytics data only after your consent.

6. How long we keep data

• Account and Workspace data: while the subscription exists and for 90 more days after it ends, for export.
• Access records: 6 months.
• Acceptance records: while the contract lasts and until the end of the limitation period.
• Billing data and invoices: 5 years, the period set by tax law.
• Data required to defend a right: until the end of the limitation period.
• Cookies: the period of each one is in the Cookie Policy.

After these periods, we delete or anonymize the data. Backups are erased in the normal rotation cycle.

7. Cookies and browser storage

The website and the app use necessary cookies, which keep your session open and store your cookie choice. The browser also stores your interface preferences, such as the theme, the language, the menu state and recent searches. On the Subscription screen, Stripe uses its own cookies to prevent payment fraud.

Only with your consent, the website kafka.com.br and the app app.kafka.com.br use Google Analytics 4 to measure use. You can change your choice at any time. We do not use advertising cookies. The Cookie Policy describes each cookie, what it is for and how long it lasts.

8. Security

We use encryption in transit, isolation between Workspaces in the database, passwordless access with a one-time code, role-based access control, audit records and backups. No system is completely secure. If an incident can cause relevant risk or damage, we notify the affected data subjects and the ANPD, as the law requires.

9. Your rights

The LGPD gives you the right to request:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or out-of-date data;
• anonymization, blocking or deletion of data that is unnecessary or processed in breach of the law;
• portability of the data to another provider;
• information about who we share your data with;
• revocation of a consent and information about what happens if you do not give it;
• objection to processing carried out without consent, if it breaches the law;
• review of decisions made solely on the basis of automated processing.

To exercise these rights, write to privacidade@kafka.com.br. We may ask you to confirm your identity. We reply within 15 days. You can also file a complaint with the National Data Protection Authority (ANPD), at gov.br/anpd.

10. Age

Kafka is a service for businesses and is not intended for persons under 18 years of age. We do not knowingly collect data from children or adolescents. If we learn that this has happened, we delete the data.

11. Contact

The communication channel for data subjects and for the ANPD is privacidade@kafka.com.br.

12. Changes to this Policy

We may update this Policy. We give notice of relevant changes by e-mail or in Kafka before they take effect. We publish this Policy and every earlier version at kafka.com.br/en/privacy. Each version shows the day it was published, the day it takes effect and what changed.