Privacy notice

KATOSCOPE · version 1 · in force from its publication

This notice explains which personal data KATOSCOPE processes when you request access, sign in and use the system, why, for how long, with whom, and how to exercise your rights (Brazilian General Data Protection Law, LGPD, Law 13.709/2018).

Who is the controller

Controller: Katoscope. Privacy contact: contact@katoscope.com.

Data protection officer (art. 41): Katoscope is a small-scale processing agent (startup; ANPD Resolution CD/ANPD No. 2/2022) and has not appointed an officer; the channel for privacy matters is contact@katoscope.com.

What data we process

• Account and access-request data: name, e-mail, login, role and, if you provide them, phone, job title, organisation, website and the request message. For those who sign in with login and password, the password is stored only as a hash (never the password text).
• Access records: IP address and the date and time of each access.
• System use: the routes accessed (the path only, not the content of the responses), screen usage events, session start and end, and the browser (summarised identification).
• Paid queries and credits: the point, cell or area searched and the products chosen, kept for billing, your history and issuing the report for the same area; the account's credits and debits.
• Approximate location: country and city estimated from the IP — never coordinates.
• Cookies: only the strictly necessary session cookies that keep you signed in (Google sign-in or password); no advertising or tracking cookies.

Why we use it and the legal basis

Processing	Purpose	Legal basis
Access records (IP, date and time)	Mandatory retention of application access records	Compliance with a legal obligation — LGPD art. 7, II, and the Brazilian Internet Civil Framework (Law 12.965/2014), art. 15
Paid queries, credits and debits	Providing the contracted service: billing, keeping the history and issuing the report	Performance of a contract — LGPD art. 7, V
System use, screen events, browser and approximate location	Security, service management and audit	Legitimate interest — LGPD art. 7, IX, and art. 10
Account and access-request data (including the password hash) and session cookies	Creating and keeping your account and access	Performance of a contract — LGPD art. 7, V

How long we keep it

• Access records with IP: 6 months (the period in the Internet Civil Framework, art. 15). After that, the IP is deleted.
• Your account's usage history, without IP (routes, times and sessions): deleted together with the IP, at 6 months.
• Paid queries, credits and debits: while the account exists and for 5 years after it is closed.
• Account data: 6 months after the account is closed.

Who we share it with

Only with processors the service needs: the server hosting provider (DigitalOcean), Google (when you sign in with a Google account) and Brevo (system e-mails). We do not sell personal data.

International transfer

To provide the service, data is processed outside Brazil: server hosting and system e-mail delivery in Europe (DigitalOcean, Brevo) and Google sign-in in the United States. The legal mechanism for this transfer (LGPD art. 33) is under review and will be stated here.

Your rights

You may ask for confirmation of processing, access, correction, anonymisation, blocking or deletion of unnecessary data, portability and information about who we share it with (LGPD art. 18), through the contact above. We reply within 15 days (LGPD art. 19, II). You may object to processing based on legitimate interest; objections are assessed case by case. You may also complain to the Brazilian Data Protection Authority (ANPD). Data the law requires us to keep (such as access records) is only deleted at the end of the legal period.

How we protect it

Encrypted connection (HTTPS), password stored only as a hash, access to the records restricted to administrators, IP masked by default on management screens, and an audit trail of who views and exports the records.

← back to KATOSCOPE