Privacy Policy

1. Introduction

Zenifra Serviços Tecnologia LTDA (CNPJ 61.191.529/0001-24) offers a platform for people and companies to publish and manage applications, with a focus on security, performance, and reliability.

We respect your privacy and are committed to protecting the personal and technical information provided while using our services. This Policy explains how we collect, use, store, and protect that information.

2. Information collected

3. Use of information

We use the collected information to:

• Provide and operate our services.
• Allow access to development and production environments.
• Manage accounts, billing, and technical support.
• Improve the user experience through usage analysis.
• Meet legal and regulatory obligations.
• Prevent fraud and protect system security.

3.1 Legal bases by purpose

• Performance of a contract: registration, authentication, project creation, databases, domains, deployments, logs, metrics, environment variables, and platform operation.
• Legal or regulatory obligation: tax data, CPF/CNPJ, address, financial records, chargebacks, anti-money-laundering measures, and legal orders.
• Legitimate interest: security, fraud prevention, authentication history, IP, device, browser, auditing, product improvement, aggregate measurement of site traffic and performance, and feedback response.
• Consent: marketing communications, newsletters, and measurement or advertising cookies enabled on the public site.

3.2 Platform-specific technical data

To operate the platform, we also process integration tokens, API keys, network settings, domains, DNS records, build logs, resource usage, AI models used, consumption, spending, environment variables, and secrets sent by the user to run projects.

4. Sharing of information

4.1 Third parties

We do not share personal or technical data with third parties except in the following situations:

• With service providers acting on Zenifra’s behalf, such as technical support and security.
• When required by law or court order.
• In a merger, acquisition, or asset sale, when data could be transferred as part of the business.
• With payment processors, to process payments.

4.2 Anonymous and aggregated data

We may share statistical and aggregated data with partners for market analysis and product improvement.

4.3 Categories of processors

We may share personal and technical data with processors required to provide the services, such as infrastructure and hosting, payment processing, transactional email, monitoring, DNS, abuse protection, code repositories, deployment automation, AI models, databases, cache, and storage.

4.4 International data transfers

Part of the processing is carried out by processors located outside Brazil. For example, the content of requests sent to AI features is processed by model providers located in the United States, Singapore, and Brazil, and payment and email delivery services may process data abroad. These transfers take place when necessary for the performance of the contract with you or related procedures, under art. 33 of the LGPD, and are limited to what each purpose requires.

4.5 AI features

When you use the AI API, the content of your requests and of the responses is forwarded to third-party model providers to generate the response. The providers used by Zenifra do not use this content to train models. Zenifra does not store the content of requests or responses: it records only usage metadata, such as the model used, volume consumed, cost, duration, and status, to operate the service and bill for it. Avoid sending personal or sensitive data for which you do not have a legal basis: you are responsible for the content you send, as set out in the Terms of Use.

5. Storage and security

5.1 Data location and retention

Platform and project data is stored in infrastructure managed by Zenifra and located in Brazil, and platform logs stay only in that infrastructure. Some operations are carried out by processors abroad, as described in section 4.4. We retain data for the period necessary for this Policy’s purposes, unless a different legal obligation applies.

Network events and detailed metrics may be retained for short periods. Registration, billing, and transaction data is kept while the account is active and for 5 (five) years after it is closed, to comply with legal and regulatory obligations, to exercise rights, and to prevent fraud; after that, it is deleted or anonymized. Deleted data may remain in backups for a limited cycle until secure replacement.

5.2 Security measures

We adopt technical and organizational measures in accordance with LGPD and market best practices:

• Encryption of data at rest and in transit.
• Access controls based on the least-privilege principle.
• Mandatory two-step verification on every account login, by an emailed code or an authenticator app.
• Continuous monitoring and anomaly detection for hosted projects.
• Periodic security audits of Zenifra internal services and infrastructure.
• Ongoing training of the internal team in data protection.
• A security-incident response plan.
• Notification of affected data subjects and the ANPD about incidents that may cause relevant risk or harm, as required by the LGPD.

6. Your rights (LGPD)

In accordance with LGPD, you have the following rights:

You may also file a petition with the National Data Protection Authority (ANPD) about the processing of your data.

7. Cookies and tracking technologies

Our site may use cookies and similar technologies to:

• Improve the user experience.
• Perform traffic analysis.
• Measure site traffic and performance in aggregate, without cookies (Cloudflare Web Analytics).
• Provide relevant ads, when applicable.

You may choose to disable cookies in your browser, although this may affect proper site operation.