Privacy & Data Protection Policy
Fantasy Name: DAYLU TECH PLATAFORMA DIGITAL
CNPJ: 00.000.000/0001-00 (Exemplo / A definir no lançamento)
* Platform in testing phase without binding active partnership until official launch.
1. Commitment to your Privacy
DAYLU TECH values security, privacy and transparency in the processing of data all its users (Consumer Customers and Partner Companies/Providers). This Privacy Policy describes how we process your personal data in accordance with General Personal Data Protection Law (LGPD - Federal Law nº 13,709/2018), Marco Civil da Internet (Law nº 12,965/2014) and the guidelines international security and privacy standards of Google Play.
2. Personal Data Collected and Purposes
We only collect the data strictly necessary to enable the platform’s functionalities and the connection commercial:
- Basic Registration Data: Full name, email address, WhatsApp phone number and document (CPF for clients or CNPJ/CPF for independent contractors). Purpose: Account authentication, security, prevention against fake profiles and essential communication.
- Location Data (Precise or Approximate Geolocation): Collected through your explicit consent at the time of search or scheduling. Purpose: Present providers and services closest and enable the calculation of travel in home care.
- Photos and Media (Image Upload): Images sent for profile, service portfolio, before/after photos or attached to the quote chat. Purpose: Profile customization, verification execution and service.
- Transaction Data and History: Records of scheduled services, agreed amounts, status execution and terms consent records. Purpose: Legal compliance, auditing and execution of tripartite contract.
DAYLU TECH NEVER requests, collects or stores credit/debit card numbers, expiration dates or codes (CVV) of Consumer Customers, since the contracting and payment for services are carried out directly between the Customer and the Partner Company. The partner gateway Asaas Gestão Financeira Instituição de Pagamento S.A. (institution regulated by the Central Bank with international banking certification PCI-DSS Level 1) is used in a restricted and exclusive manner for the secure processing of the Corporate Invoice issued against Partner Companies (monthly fees for management software and appointment fees).
3. Secure Infrastructure, Session Isolation and RLS (Supabase)
Registration data, authentication and audit logs are stored in the cloud with end-to-end encryption cutting-edge Supabase infrastructure under strict cybersecurity guidelines:
- RLS Policies (`DEFAULT DENY`): All tables operate under Row Level Security restrictive, ensuring that users and companies only and exclusively access their own data properly authenticated.
- Strict Separation of Sessions and Profiles: The applications DayLu Customers, DayLu Companies and DayLu Admin operate under isolated credential scopes, preventing overlapping tokens or improper cross-access.
4. Restricted Data Sharing and Protective Masking (T - 48h)
DAYLU TECH DOES NOT sell, rent or commercialize your personal data to third parties or advertisers. Sharing occurs exclusively under the following conditions:
- Between Customer and the Selected Company with Initial Masking: To preserve the privacy and protect against premature or invasive approaches, direct contact details (phone/WhatsApp and full address) remain masked and protected by the platform, being released automatically only 48 hours in advance of the service (`T - 48h`) or upon mutually confirmed early unlocking in the app.
- With Core Infrastructure Providers: Cloud Database Provider encrypted (Supabase) and corporate payment gateway regulated by the Central Bank (Asaas).
- To Comply with a Judicial or Legal Order: When expressly requested by competent judicial or police authority under Brazilian law.
5. Your Rights as a Data Subject (Art. 18 of LGPD)
You have full control over your personal data. At any time, you can exercise the following rights in a simple and free way:
- Confirm the existence of processing of your data;
- Access or update your registration data directly through the profile menu in the application;
- Request correction of incomplete, inaccurate or outdated data;
- Request definitive deletion of your account and removal of your data;
- Revoke previously granted consent.
6. Request for Account Deletion and Legal Custody of Logs
To request the permanent deletion of your account and stored personal data, you can use any one of the channels:
- By Application (Instant): Access the application ➔ Profile ➔ Settings Security ➔ Delete My Account;
- From the Official Website: Access our Deletion Request page Data;
- By Email: Send a request to __DAYLU_TAG_0002__privacidade@daylutech.com with the subject "Account Deletion LGPD".
Account deletion results in permanent deactivation of access and anonymization of identification data direct staff. However, in strict compliance with legal, regulatory, tax and regular exercise of rights in possible judicial, administrative or arbitration proceedings, the DAYLU TECH keeps connection records (IPs, date and time), immutable audit, financial transaction history and consent records for the statute of limitations applicable law.
7. Data Supervisor (DPO) Service Channel
If you have any questions, requests or exercises of rights relating to privacy and data protection, please contact Contact our Data Protection Officer (DPO):
DPO Contact Email: __DAYLU_TAG_0002__privacidade@daylutech.com
Controller: [COMPANY NAME OF YOUR COMPANY - TO BE DEFINED AT LAUNCH] (DAYLU TECH PLATFORM
DIGITAL)
CNPJ: 00.000.000/0001-00 (Example / To be defined at launch)
Foro: District of the Capital of the State of Rio de Janeiro - RJ.