Legal

PRODMUS Build Privacy Policy

Version of October 13, 2026 · 2026-10-13

This Policy explains which personal data PRODMUS Build processes, why, with whom it is shared and what your rights are. It follows Brazil's General Data Protection Law (LGPD, Law 13.709/2018) and, for people in the European Union, the General Data Protection Regulation (GDPR). The company responsible is [PRODMUS LEGAL NAME], CNPJ [CNPJ], located at [ADDRESS] ("PRODMUS").

1. Two different roles

• PRODMUS is the controller of the data of people who visit the website, sign up, subscribe and use the system (name, e-mail, phone, billing and access data).
• The customer company is the controller of the data it enters in the system about third parties — its clients, employees, suppliers, people in site photos. For that data, PRODMUS is the processor: we process it only to provide the service and following the customer company's instructions. The rules for that processing are in the Data Processing Agreement. Requests about that data should go to the company that entered it; we help it answer them.

2. What data we process

• Trial sign-up: company name, your name, e-mail and, if you wish, WhatsApp number; the browser's language, country and currency; the IP address and the date and time you accepted these documents.
• System users: name, e-mail, phone, access profile, preferences (language, text size). Passwords are stored only as a cryptographic hash, which cannot be read back; the same goes for the two-step verification secret.
• Usage and security: sign-in records and a log of everything created, changed or deleted, with the person, the time and the network address (audit trail); technical error logs.
• Subscription and billing: company details for invoicing, plan, amounts, currency, payment status.
• Content entered by the customer company: projects, budgets, contracts, clients, suppliers, staff, documents, photos, site logs, requests to the AI assistant and the assistant's WhatsApp conversations.
• Browser storage: the system and the website store in your browser the session token and your chosen language, theme and currency. We do not use advertising cookies or third-party trackers.

3. Why we use it and on what legal basis

• Providing the service (creating the system, giving access, running each module, sending access and password e-mails): performance of the contract.
• Billing and tax obligations: performance of the contract and compliance with legal obligations.
• Security, fraud prevention and audit: legitimate interest and the exercise of legal rights.
• Support and service notices (end of trial, plan limits, changes to these documents): performance of the contract and legitimate interest.
• Improving the product with aggregated usage figures: legitimate interest. We do not use customer companies' content for this without permission.

We do not sell personal data and do not use it for advertising.

4. Who we share it with

Only with providers needed for the service to work, under contract and with the minimum data:

• Hosting: [HOSTING PROVIDER], where the system, databases, photos and backups are kept.
• Anthropic (United States): processes requests to the AI assistant and photos sent for analysis. Under Anthropic's commercial terms, this data is not used to train its models.
• Meta / WhatsApp Business (United States): delivers the assistant's WhatsApp messages, only when the customer company turns that module on.
• Google (United States): syncs the calendar with Google Calendar, only when the customer company connects its account.
• E-mail delivery: the e-mail service that delivers access, password and notice e-mails.
• Authorities, when required by law or court order.

Google user data. When the company connects Google Calendar, PRODMUS Build asks only for the Google account's e-mail address (to show which account is connected) and access to the calendars created by PRODMUS Build itself in that account — it does not read other calendars, contacts or e-mail. We use that access only to create, update and delete, in that calendar, the events of the system's calendar. We do not use Google data for advertising or to train AI models, do not sell it, do not transfer it to third parties (except to comply with the law or protect the security of the service), and no one at PRODMUS reads it except with the company's permission, for security or when required by law. PRODMUS Build's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. The connection can be removed at any time in the system settings or at myaccount.google.com/permissions.

5. International transfers

Some of these providers are outside Brazil (mainly in the United States). These transfers are made with the safeguards provided for in the LGPD (art. 33) and the GDPR, such as data protection contractual clauses.

6. How long we keep it

• While the subscription is active, data is kept so the service works.
• Trial companies that never got past the first sign-in and hold no data are deleted automatically 30 days after the trial ends.
• After cancellation, data stays stored for export until the company requests permanent deletion, which is done within 30 days.
• Backups are daily and rotate (currently the 14 most recent are kept): deleted data leaves them within that period.
• The audit trail is kept for 5 years and the assistant's WhatsApp conversations for 1 year; after that, the system deletes them on its own.
• Billing and tax data are kept for the period the law requires, even after deletion.

7. How we protect it

Encrypted connections (HTTPS), passwords stored only as cryptographic hashes, two-step verification, per-person and per-project permissions, expiring sessions, an audit trail that cannot be erased from inside the system, each company's data kept apart from the others' and daily backups. If a security incident may cause significant risk, we notify the affected companies and Brazil's Data Protection Authority (ANPD), as the law requires.

8. Your rights

You may request: confirmation that we process your data; access to it; correction; anonymization, blocking or deletion of unnecessary data; portability; information about whom we share it with; withdrawal of consent, where consent is the legal basis; and review of automated decisions. People in the European Union may also object to processing and complain to their country's data protection authority.

For data controlled by PRODMUS, write to [PRIVACY E-MAIL]. For data entered by a customer company (for example, if you are a client of a builder that uses PRODMUS Build), contact that company — the system has tools for it to export or anonymize your data. We reply within 15 days.

9. How to request deletion of your data

• If you are a customer company: the administrator requests permanent deletion by e-mail to [PRIVACY E-MAIL], from the e-mail address registered as administrator. The data can be exported first. Deletion is done within 30 days, and we confirm it by e-mail.
• If you talked to the assistant on WhatsApp, use the client portal or were entered by a builder: ask the builder — the system has a tool for it to anonymize your data. If you prefer, write to [PRIVACY E-MAIL] with your name, the WhatsApp number or e-mail you used and the builder's name; we forward the request to it and confirm when it is done.
• If you only signed up for the trial: write to the same address from the e-mail you used to sign up; we delete it within 30 days.

Only data the law requires us to keep (for example, tax records) remains, for the period it requires. Data leaves the backups within their rotation cycle.

10. Data protection officer

Data protection officer (DPO): [DPO NAME] — [PRIVACY E-MAIL].

11. Minors

PRODMUS Build is a business service and is not intended for people under 18.

12. Changes to this Policy

We may update this Policy. Material changes are announced in advance, and the company administrator accepts the new version at the first sign-in after it. The date of the version in force is at the top of this page.