Legal
Privacy Policy
This privacy policy explains which personal data is processed when using Arratel and SaaS products based on it.
1. Controller
The controller responsible for data processing is Ricardo Valente de Matos.
For privacy-related questions, contact contact@arratel.dev.
2. Data We Process
When the website is accessed, technical access data is processed where required for delivery, security, and operation of the application.
The currently included PDF interface is a demo. As long as no real upload feature is implemented, this demo does not upload or store files.
3. Purposes and Legal Bases
We process data to provide the application, secure the service, and communicate with users.
Legal bases include contract performance and pre-contractual measures under Art. 6(1)(b) GDPR, legal obligations under Art. 6(1)(c) GDPR, and legitimate interests under Art. 6(1)(f) GDPR, especially secure and reliable operation.
4. Cookies and Local Storage
The application uses a locale cookie to store the selected language.
These cookies are required for login, protected areas, and language handling. Tracking or marketing cookies are not implemented in the current codebase.
5. Recipients and External Service Providers
Personal data may be transferred to technical service providers used for hosting, security, and operation of the currently active features.
Vercel Inc.: hosting, application delivery, security, and technical logs (United States and other locations depending on the deployment).
Where data is transferred to third countries, we rely on appropriate safeguards such as EU Standard Contractual Clauses or comparable protection mechanisms where required.
6. Retention
Technical access data is stored only as long as required for operation, security, and error analysis.
7. Data Subject Rights
Subject to the GDPR, you have rights of access, rectification, erasure, restriction of processing, data portability, and objection.
Where processing is based on consent, you may withdraw that consent at any time with effect for the future.
You also have the right to lodge a complaint with a competent data protection supervisory authority.
8. No Automated Decision-Making
The current application does not use automated decision-making, including profiling, that produces legal effects.