Privacy policy
Preliminary version, under legal review. This text is a draft based on the LGPD (Lei 13.709/2018, Brazil’s General Data Protection Law) and the Marco Civil da Internet (Lei 12.965/2014, Brazil’s Internet Civil Framework). The fields between
{{ }}will be filled in before publication. This translation is provided for convenience; the Portuguese version prevails in case of any discrepancy.
This policy explains what data Heartscale collects when you request a diagnostic, what it is used for, who it is shared with, how long it is kept and how you exercise your rights. It is governed by Brazilian law.
1. Who handles your data
Heartscale is a brand of {{RAZAO_SOCIAL_IF}} (“IF Soluções”), CNPJ {{CNPJ_IF}}, headquartered at {{ENDERECO_IF}}. IF Soluções is the controller of the data on this site and in the diagnostic request.
Data subject channel and data protection officer: {{NOME_ENCARREGADO}}, by email at {{EMAIL_ENCARREGADO}}.
2. What data we collect
In the request form, you provide:
- name;
- email;
- WhatsApp number;
- link to the app;
- platform the app was built on;
- the services you selected;
- your statement that you own the app or are authorized to approve the diagnostic;
- your acceptance of this policy.
Along with the request, the site automatically records:
- the campaign parameters in the address (
utm_source,utm_medium,utm_campaignand otherutm_*), if any; - the page you came from (referrer);
- the first page you opened on the site and the request page;
- the date and time of submission.
To remember the first page of your visit until you submit the request, the site keeps that information in your browser’s session storage (sessionStorage). It disappears when you close the tab and only leaves your browser if you submit the request.
Through hosting: like any website, the server logs the IP address, date and time of each access and the browser used.
What we do not collect: this site does not use cookies, has no audience analytics tool and has no advertising pixel.
3. What we use it for and on what legal basis
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Respond to the request, run the triage and send the summary, the payment link and the terms | Form data | Preliminary procedures to a contract, at your request (art. 7, V) |
| Confirm that the app is yours before any work | Form data and app link | Preliminary procedures to a contract (art. 7, V) and regular exercise of rights (art. 7, VI) |
| Know which channel brought you, to decide where to promote Heartscale | Request origin | Legitimate interest (art. 7, IX) |
| Keep access logs for the period required by law | IP, date and time | Compliance with a legal obligation (art. 7, II; Marco Civil, art. 15) |
We do not use your data for third-party advertising and we do not sell it.
4. AI triage of the request
Your request goes through a triage performed by artificial intelligence. The AI reads what you wrote in the form and prepares a short summary with the type of app, what usually comes up in apps like it, the likely services, the price range and the price of the diagnostic.
- The AI uses only what you wrote. It does not open the app, query the domain or read the repository.
- The summary is an estimate, not a finding. No work on the app begins without payment, the accepted terms and proof that the app is yours.
- The AI provider is {{PROVEDOR_IA}}, which processes the data in {{PAIS_PROVEDOR_IA}}. We only use providers whose terms prohibit using the submitted content to train models.
- If you disagree with the summary, you can ask a person at IF to review it (LGPD, art. 20), through the channel in section 1.
5. Who we share it with
We share data only with the services that make our support work, each receiving the minimum necessary:
| Service | What it receives | Purpose | Where it processes |
|---|---|---|---|
| Hosting for the site and the request system ({{PROVEDOR_HOSPEDAGEM}}) | Request data and access logs | Store the request and serve the site | {{PAIS_HOSPEDAGEM}} |
| AI provider ({{PROVEDOR_IA}}) | Form data | Request triage (section 4) | {{PAIS_PROVEDOR_IA}} |
| Email ({{PROVEDOR_EMAIL}}) | Name, email and message content | Send the summary, the terms and replies | {{PAIS_PROVEDOR_EMAIL}} |
| WhatsApp Business Platform, by Meta (official API) | Name, number and message content | Support via WhatsApp, if you prefer | Outside Brazil |
| Payment institution ({{PSP_PIX}}) | Name and amount | Diagnostic payment link (Pix in Brazil) | {{PAIS_PSP}} |
We may also share data when a law or an order from an authority requires it.
6. International transfer
Some of these services process data outside Brazil. In those cases, the transfer follows arts. 33 to 36 of the LGPD, with the safeguards set out in the regulations of the ANPD (Brazil’s National Data Protection Authority). {{MECANISMO_TRANSFERENCIA}}
7. How long we keep it
| Data | Period |
|---|---|
| Request that did not become a diagnostic | {{PRAZO_GUARDA_PEDIDO}} after the last contact, then deleted |
| Request that became a diagnostic or a contract | For the period set in the authorization terms: the accepted terms, the proof of ownership and the report for up to {{PRAZO_GUARDA_CLIENTE}}, without code and without credentials |
| Access logs (IP, date and time) | 6 months (Marco Civil, art. 15) |
8. Your app’s data during the diagnostic
Your app users’ data does not pass through this site. During the diagnostic, processing follows the authorization terms: you are the controller of that data, IF does not download or export the database, examples in the report use fictitious or masked data, and copies of the code and access credentials are deleted at the end of the work.
9. Your rights
Under the LGPD (art. 18), you may request at any time:
- confirmation that we process your data and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of data that is unnecessary or processed in breach of the law;
- data portability;
- information about who we share it with;
- review by a person of the summary prepared by the AI (section 4);
- objection to processing based on legitimate interest.
Send your request to {{EMAIL_ENCARREGADO}}. We reply within {{PRAZO_RESPOSTA}}. You may also file a complaint with the National Data Protection Authority (ANPD).
10. Security
The site uses HTTPS. Requests are stored on a server with access restricted to the support team. Passwords, verification codes and secret keys should never be sent by email or WhatsApp: access to the app is granted by invitation on the platform itself. If there is an incident with relevant risk or harm to your data, we notify you and the ANPD, as the law requires.
11. Children and adolescents
The service is for businesses and adults who own an app. We do not knowingly collect data from anyone under 18.
12. Changes to this policy
When this policy changes, the date at the top changes with it. If the change is relevant to someone who has already submitted a request, we notify them by email.
Questions: {{EMAIL_ENCARREGADO}}. See also the terms of use and the contact page.