Privacy policy

Effective from [to be defined: VIGENCIA].

This policy explains which personal data Termik processes, for what purposes and what your rights are, under the Brazilian General Data Protection Law (Law No. 13,709/2018, LGPD).

1. Who the controller is

[to be defined: RAZAO_SOCIAL], CNPJ [to be defined: CNPJ], headquartered at [to be defined: ENDERECO].

Data protection officer (DPO): [to be defined: ENCARREGADO], at [to be defined: EMAIL_ENCARREGADO].

2. What never leaves your computer

Termik is built so that the data of your work never reaches us. It stays only on your computer, encrypted with a key derived from your master password (Argon2id and XChaCha20-Poly1305):

• server addresses, usernames, passwords and private keys;
• database and S3 storage connections;
• commands, snippets, scripts and query history;
• the password vault and the master password itself (which is not stored anywhere).

We have no way to read, recover or hand over this data to anyone.

3. What data we process

Data	Where it comes from	Why
E-mail	Purchase, invitation, free trial, portal sign-in	Link keys and licenses, send verification codes, activation notices and service communications
Computer identifier	Generated by the Application	Limit each seat to one computer and each free trial to one computer. We only receive a hash (SHA-256 with a fixed product value); the original system identifier never leaves the computer
Computer name, operating system and Application version	Application	Show you and your team which computers are activated
Activation and last renewal dates	Application	License validity, offline grace period and change limit
IP address and browser (user agent)	Application, portal and website	Security, abuse prevention (attempt limits) and access logs
Action log (audit)	Services	Security, support and evidence of what happened to a license
Billing data	Purchase	Invoicing and tax documents (through the payment provider, once automatic billing exists)
Messages to support	You	Handle your request

We do not use your data for advertising and we do not sell it. If we ever offer usage telemetry, it will be optional and will never include data about your servers or commands.

4. Legal bases

• Performance of a contract (art. 7, V): issue and verify licenses, activate computers, send codes and notices, provide support.
• Legitimate interest (art. 7, IX): security of the Services, prevention of fraud and of abuse of the free trial and the license, auditing. You may object (section 8).
• Compliance with a legal obligation (art. 7, II): tax obligations and access logs required by the Brazilian Internet Civil Framework (Law No. 12,965/2014).
• Consent (art. 7, I): only for optional features, such as any future telemetry.

5. Who we share data with

Only with processors needed to provide the Services, under contract and confidentiality obligations:

• Hosting of servers and databases: [to be defined: HOSPEDAGEM];
• E-mail delivery: [to be defined: PROVEDOR_EMAIL];
• Distribution of installers and updates: GitHub (downloads come directly from its servers, which receive your IP);
• Payment provider, once automatic billing exists;
• Authorities, when required by law or court order.

Some of these providers may process data outside Brazil. In that case, the transfer follows art. 33 of the LGPD, with contractual clauses and appropriate safeguards.

6. How long we keep data

• Account and license data: while the contract is in force and for up to 5 years afterwards, to meet legal obligations and allow the exercise of rights.
• Ended or expired sessions: deleted about 30 days later.
• Verification codes: deleted about 7 days after they expire. Codes are stored only as hashes.
• Access logs (IP, date and time): at least 6 months, as required by the Internet Civil Framework.
• Audit records: up to 5 years.

7. Security

We use encrypted connections (HTTPS), store activation keys and codes only as hashes, encrypt authentication secrets, offer optional two-step verification on the portal (mandatory for our staff), limit attempts and log every administrative action. No measure is infallible: if an incident occurs that may create a relevant risk, we will notify you and the ANPD.

8. Your rights

Under the LGPD (art. 18), you may request: confirmation of processing; access; correction; anonymization, blocking or deletion of unnecessary data; portability; deletion of data processed with consent; information about sharing; and withdrawal of consent. You may also object to processing based on legitimate interest.

To exercise these rights, write to [to be defined: EMAIL_ENCARREGADO] from your account's e-mail. We reply within 15 days. Some data must be kept by law even after a deletion request. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

9. Cookies

• Website: uses no tracking cookies and no third-party analytics tools.
• Portal: uses only strictly necessary cookies to keep your session (with the HttpOnly, Secure and SameSite protections), which do not require consent.

10. Children and teenagers

The Services are intended for professionals and are not directed at people under 18.

11. Changes

We may update this policy. Material changes will be announced by e-mail. The current version is always on this page.

12. Contact

DPO: [to be defined: ENCARREGADO] · [to be defined: EMAIL_ENCARREGADO] · [to be defined: RAZAO_SOCIAL], [to be defined: ENDERECO].