Privacy Policy

This Policy describes how IOTBRAS collects, uses, stores and protects personal data within the Birdtask platform, in accordance with the Brazilian General Data Protection Law (Law No. 13.709/2018 — LGPD).

By using the platform, you acknowledge that you have read and understood this Policy. If you have any questions, contact us by email at hello@birdtask.com.

CLAUSE 1 — IDENTIFICATION OF THE PROCESSING AGENT

This Privacy Policy applies to the Birdtask platform, provided by IOTBRAS LICENCIAMENTO DE SOFTWARE LTDA, registered under CNPJ No. 27.788.008/0001-10, with its registered office at Rua Salto Veloso, No. 192, Letra Y, Bairro Iririú, Joinville/SC, postal code 89.227-160, Brazil.

Contact for privacy and data protection matters: hello@birdtask.com.

CLAUSE 2 — ROLES UNDER THE LGPD

For the registration data of customers, administrators and platform users, IOTBRAS acts as the controller, determining the purposes and means of processing required for registration, contracting, support, billing, security and Birdtask operations.

For data entered by customers in their boards and tasks — such as the names of collaborators, guests and clients, descriptions and comments — IOTBRAS normally acts as a processor, processing that data according to the customer’s instructions. The customer remains responsible for the legal basis, transparency and responding to data subjects.

CLAUSE 3 — PERSONAL DATA PROCESSED

We may process identification and contact data, such as name, email, company, CNPJ, CPF when necessary, address, login details, profile photo, access profile and usage preferences. When a user chooses to sign in with Google, we receive only the name, email and profile image associated with the account from the provider.

We may also process operational data, such as boards, tasks, statuses, priorities, deadlines, comments, invitations and sharing permissions, notifications, change history, charges, subscription status, access logs, IP address, browser, device, and date and time of use.

The platform may receive sensitive data when customers or their users enter it in free-text fields, descriptions, notes or comments. Customers must avoid entering unnecessary sensitive data and ensure an appropriate legal basis when such processing is essential.

CLAUSE 4 — PURPOSES OF PROCESSING

We process data to create and manage accounts, provide boards and tasks, enable collaboration and invitations, synchronize work across devices, process payments, provide support, send service-related notifications, prevent fraud, maintain security, comply with legal obligations and improve the platform.

Data may also be used for commercial communications about Birdtask, provided that the rights to object and unsubscribe are respected where applicable.

CLAUSE 5 — LEGAL BASES

Depending on the context, processing may be based on performance of a contract, preliminary procedures related to a contract, compliance with a legal or regulatory obligation, regular exercise of rights, legitimate interest, fraud prevention, credit protection or consent.

When customers use the platform to process third-party data, such as that of collaborators and guests, they are responsible for informing data subjects of the applicable legal basis and fulfilling the corresponding obligations toward them.

CLAUSE 6 — DATA SHARING

We may share data with providers required to operate the platform, including hosting, databases, payment processing (Stripe), email and notification delivery, Google authentication, support, log analysis, security, accounting, legal advice and administrative tools.

Board content is shared with the people invited by the customer and according to the permissions set by that customer.

We may also share data to comply with a court order, a request from a competent authority or a legal obligation, to defend rights, investigate fraud or a security incident, or protect the platform and its users.

We do not sell personal data.

CLAUSE 7 — INFORMATION SECURITY

We adopt reasonable technical and administrative measures to protect data against unauthorized access, loss, alteration, improper disclosure or destruction, taking into account the nature of the data, the risks involved and the scale of the operation.

No system is completely immune to failures. Users must protect their passwords, limit administrative access and invitations, keep devices secure and immediately report any suspected misuse.

CLAUSE 8 — RETENTION AND DELETION

Data will be retained for as long as necessary to fulfill the purposes described in this Policy, perform contracts, preserve operational history, meet legal obligations, prevent fraud, resolve disputes and exercise rights.

After the relationship ends, data may be deleted, anonymized or retained with restricted access where there is a legal obligation, a legitimate basis or a need to defend IOTBRAS, the customer or third parties.

CLAUSE 9 — DATA SUBJECT RIGHTS

Under the LGPD, data subjects may request confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, review of automated decisions, withdrawal of consent and objection where applicable.

When a request involves data controlled by a customer — for example, content on a third party’s board — we may refer the request to the relevant controller or act according to their instructions.

CLAUSE 10 — COOKIES AND SIMILAR TECHNOLOGIES

The platform may use cookies, local storage, session identifiers and similar technologies for authentication, security, system operation, preferences, usage measurement and experience improvements, as described in the consent banner displayed on the site.

Blocking essential cookies may prevent login, navigation or the correct use of features.

CLAUSE 11 — INTERNATIONAL TRANSFERS

Some technology providers may store or process data in other countries. In such cases, we seek to use providers that adopt measures consistent with data protection and information security.

By using the platform, users acknowledge that operating online services may involve distributed infrastructure and global providers.

CLAUSE 12 — MINORS

The platform is not directed specifically at children. When minors’ data is necessary to organize tasks or projects, customers must obtain authorization from legal guardians and comply with applicable law.

IOTBRAS may remove or block data when it identifies processing that is incompatible with this Policy or the law.

CLAUSE 13 — SECURITY INCIDENTS

In the event of a security incident posing a significant risk to data subjects, reasonable containment, analysis, remediation and communication measures will be taken, as required by applicable law and the Brazilian National Data Protection Authority.

Customers must cooperate by providing necessary information when an incident involves data under their responsibility.

CLAUSE 14 — CHANGES TO THIS POLICY

This Policy may be updated to reflect legal, technical, commercial or operational changes. The current version will be published on this page.

Significant changes may be communicated through channels available on the platform, where reasonable.

CLAUSE 15 — CONTACT

Questions, requests or complaints about privacy may be sent to hello@birdtask.com.

Handling a request may require identity verification and minimum information to locate the related account or board.

IOTBRAS LICENCIAMENTO DE SOFTWARE LTDA — CNPJ 27.788.008/0001-10 — Rua Salto Veloso, 192, Letra Y, Bairro Iririú, Joinville/SC, postal code 89.227-160, Brazil.