Privacy Policy

Controller and data protection officer

The data controller is VERTRA CLOUD LTDA, registered under CNPJ no. 69.320.419/0001-27, headquartered at Rua Barbosa de Freitas, 1741, Sala 04, Aldeota, Fortaleza, CE, CEP 60170-021, Brazil, operating under the trade name "Vertra Cloud". The data protection officer (DPO) is Francisco Endrey da Mata Araujo, and the channel for any privacy matter is [email protected].

Related documents: Terms of Use · Acceptable Use Policy

1. Roles: when we are the controller and when we are the processor

For your account data — registration, authentication, payment, access logs, dashboard usage, and support — Vertra is the controller and this Policy applies in full.

For the content you host — code, files, databases, environment variables, logs of your applications — and for the personal data of third parties that your applications process, you are the controller. Vertra acts as processor: it executes, stores, and transmits that content only to provide the service, in accordance with your technical instructions, and does not use it for any other purpose. The LGPD obligations toward those data subjects (legal basis, transparency, responding to rights, incident notification) are yours; Section 11 covers this in detail.

2. Data we collect

Registration and authentication: name, email, language, avatar, and your account identifier at the login provider you choose (Discord, GitHub, or Google). If you connect GitHub for deployment, we store the installation identifier and the tokens needed to read the repositories you authorized.

Payment and billing: amount, date, status, and identifiers of each order and transaction. Card and Pix payments are processed by Stripe. The card number, expiry date, and security code (CVV) are typed into a field provided by Stripe and tokenized in your browser: they never pass through Vertra's servers and are never stored by us. For a saved card we keep only the brand, the last 4 digits, and the expiry date, to show your cards and automatic renewal. The billing details you enter under Billing — name, address, phone and, if you choose, CPF or CNPJ — are stored by Stripe, not in Vertra's databases. Older orders paid by Pix through Mercado Pago keep the confirmation data it returned (such as the payer's name).

Invoice: for every paid order we issue a Brazilian electronic service invoice (NFS-e). If your billing details include a CPF or CNPJ, the invoice is issued in your name, with that document and the account email; with a billing address outside Brazil, it is issued with your name, country, and email, without a document; otherwise, without identifying the customer. Vertra's record of the invoice keeps its number, status, the customer's name, and the masked document.

Platform usage: account activity logs (creation, deployment, start, stop, and deletion of projects, configuration changes, who did what in a workspace), usage metrics for your resources (CPU, memory, storage, network), and anonymized product events, without email, name, URL, domain, or content. For traffic to your hosted applications we record only the method, status, duration and size of each request — no path, no IP and no content. When platform protection pauses an application, we record the reason, traffic direction, time and length of the pause.

Technical and security data: IP address, browser user agent, access date and time, session identifiers, and API request logs. These are necessary to authenticate, prevent fraud and abuse, and comply with the Brazilian Civil Rights Framework for the Internet (Marco Civil). For requests made with your API key we keep the method, route, path, IP, user agent, status, duration and size and, on some routes, a redacted excerpt of the request and response body of up to 4 KB.

Support: the content of the messages you send us by email, through the dashboard, or through Discord.

Browsing the website: with your consent (cookie banner), analytics data (PostHog), with session recording only on the public pages, and conversion measurement for our ads (Google Analytics). These services load only on the public pages of the site and on login, sign-up, and checkout; the dashboard and the admin area load neither PostHog nor Google Analytics, and the site does not send your account identifier to them. See Section 8.

Sign-up origin: when you open a Vertra promotional link (/r/… addresses), we count the click in aggregate per hour, without storing your IP, browser or any data about you, and we set a cookie in your browser with the link name. If you create an account, we associate it with the link you came from, so we can measure which promotional channels bring sign-ups and purchases. If you already have an account and come back through one of these links, we record the link and the date on your account, to measure purchases made in the following 30 days. See section 8.

We do not collect sensitive data (racial origin, religious belief, political opinion, health, biometrics, etc.) and we do not ask you to send us any. If your applications process third parties' sensitive data, that responsibility is yours as controller.

3. Purposes and legal bases

Performance of the contract (art. 7, V): creating and authenticating your account, running and monitoring your projects, processing payments, providing support, and sending operational communications (expiration, crashes, cleanup notices). These notices are part of the service and cannot be turned off.

Compliance with a legal obligation (art. 7, II): retaining access logs for the period required by the Marco Civil da Internet, issuing invoices and keeping tax and payment records, and complying with orders from authorities.

Legitimate interest (art. 7, IX): platform security, fraud and abuse detection, protection of the shared network, prevention of duplicate accounts, aggregated usage measurement to improve the product, knowing which promotional link brought sign-ups and purchases, identifying subscribers in the official Discord community, defense in legal proceedings, and sending promotional emails (offers, launches, and tips) about Vertra Cloud itself to account holders. We do this with the minimum data necessary (name and email, in the case of promotional emails), and you may object at any time: through the "Unsubscribe" link in every promotional email, the "Promotional emails" option in your account settings, or the official channel. Unsubscribing does not affect the service or account notices.

Regular exercise of rights (art. 7, VI): retaining data necessary for defense in administrative, judicial, or arbitration disputes.

Consent (art. 7, I): analytics (PostHog) and ad conversion measurement (Google Analytics and Google Ads) on the public pages and on login, sign-up, and checkout, and session recording on the public pages. Consent may be withdrawn at any time, without affecting the service.

4. Who we share data with

We do not sell or rent personal data. We share it only with processors that need it for the service to work, under contract and limited to that purpose:

Stripe (Stripe Brasil, Stripe Payments Europe in Ireland, and Stripe, Inc. in the USA) — card and Pix payment processing, storage of cards and billing details, automatic renewal charges, and fraud prevention. It receives your name, email, billing details, transaction data, and technical device signals, and also processes this data as an independent controller to meet its own legal and fraud-prevention obligations, under its privacy policy. Focus NFe (Brazil) — invoice issuing; it receives the amount, the service description and, when present, the customer's name, CPF or CNPJ, country, and email. Issued invoices are sent to the City of Fortaleza, as required by law. Mercado Pago (Brazil) — older orders paid by Pix only. Network and storage provider (USA) — DNS, CDN, edge protection, and storage of snapshots and Blob Storage files. Server infrastructure providers (USA) — where containers and databases run. PostHog (USA) — analytics on the public pages and on login, sign-up, and checkout, and session recording on the public pages, only with your consent. Google (USA) — Google Analytics and Google Ads, to measure conversions from our ads, only with your consent; receives cookie identifiers, visited pages (only the public ones and those of login, sign-up, and checkout, with cleaned-up addresses), events such as sign-up, and technical browser data. Discord, GitHub, and Google — authentication and, in GitHub's case, reading of authorized repositories. If you signed in with Discord and are in the official community server, Discord also receives your plan's name, shown as a role visible to the server's members. Email delivery provider — sending account notices and promotional emails; it receives your name, email, and the message content.

We may also share data when required by law, court order, or a request from a competent authority; to protect the rights, safety, and property of Vertra and third parties; and, in the event of a corporate reorganization or succession of the provider (including the incorporation of Vertra's legal entity), with the successor, which will be bound by this Policy.

The list of processors may change; the version in effect is always the one on this page.

5. International transfer

Part of the infrastructure and the processors listed in Section 4 are located outside Brazil, mainly in the United States. This means that your account data and the content of your projects may be stored or processed there.

Card and Pix payments and billing details are processed by Stripe in Brazil, Ireland, and the United States, under the same safeguards. Invoice issuing stays in Brazil.

These transfers rely on Article 33 of the LGPD. Those needed to provide the service you contracted are based on the performance of the contract (Article 33, IX, combined with Article 7, V), which includes the hosting, network, storage and email delivery infrastructure; with processors that offer them, such as the payment processor, the transfer also relies on the standard contractual clauses approved by the ANPD (ANPD Resolution CD/ANPD No. 19/2024). Data travels with encryption in transit. By using the service, you acknowledge this transfer; if your applications process third-party data, it is up to you to assess whether this location suits your case.

6. How long we keep data

Registration data: for as long as the account exists. After closure, it is deleted or anonymized within 30 days, except what must be kept under a legal obligation.

Payment records and tax documents: 5 years after the transaction, as required by tax and civil legislation.

Saved cards and billing details: for as long as you keep them under Billing. Removing a card deletes it from Stripe and from our records; when the account is closed, cards and billing details are deleted from Stripe. Stripe may keep the transaction history for the period its own legal obligations require.

Access logs (IP, date, and time): 6 months, under article 15 of the Marco Civil da Internet, extendable by order of an authority.

Project content: for as long as the project exists. Snapshots — manual, daily, generated upon plan expiration, or taken for safety before a database is deleted or reset — are deleted 30 days after creation. Blob Storage files: while the account has an active plan; without a plan, they are deleted 72 hours later, without a snapshot.

Account activity log: 30 days, including after the project is deleted. Support messages: for as long as necessary to resolve the request and any resulting dispute.

API key request logs: 30 days. Hosted application traffic (method, status, duration and size): 30 days. Platform protection incidents: 90 days.

Application Web Analytics: we keep only the totals of each application (number of requests and visits, data volume, error rates and response time) for up to 31 days, and they are deleted along with the application. We do not keep data that identifies visitors. The details of each request (IP, address accessed, browser and country) are looked up on our edge network when the application owner opens the dashboard, and the edge network discards them within 31 days.

Login sessions (login method, IP, approximate location and device): until the session expires. Anonymized product events: 90 days.

Sign-up origin: the promotional link cookie lasts up to 30 days and is deleted after you sign in; the association between your account and the link (at sign-up or when you come back through it) is kept while the account exists. Click counts are aggregated and identify no one.

Analytics: PostHog cookie identifiers for up to 12 months and Google Analytics cookie identifiers for up to 2 years; aggregated and anonymized data may be kept indefinitely, since it does not identify you.

7. Security

We adopt technical and organizational measures proportional to the risk: isolation of each project in its own container and segregated network, encryption in transit (TLS) on all connections, including database connections, encryption at rest of environment variables and database credentials, internal communication between servers over a private tunnel with no exposure to the internet, minimal access control, security monitoring and logging, and automatic network protection against abuse.

No system is infallible. If a security incident may cause you relevant risk or harm, we will notify the Brazilian National Data Protection Authority (ANPD) and the affected data subjects within the deadline of the Security Incident Reporting Regulation (ANPD Resolution CD/ANPD No. 15/2024), as set out in Article 48 of the LGPD, stating the nature of the data, the risks and the measures taken.

You are also responsible: keep your credentials and API keys protected, enable two-factor authentication on your login provider, and review who has access to your workspaces.

8. Cookies and similar technologies

Necessary cookies: keep your session authenticated, your language and theme choice, and your decision on the consent banner. Without them the dashboard does not work; they do not depend on consent.

Promotional link cookie (vc_ref): set only when you open a Vertra promotional link (/r/…). It stores only the link name, lasts up to 30 days and is deleted after you sign in. It lets us know which link your sign-up (or your return, if you already have an account) came from, based on legitimate interest (section 3); it is not used for advertising or shared with third parties. When the link carries an offer coupon, we also set the vc_offer cookie, holding only the link name, for up to 1 day, to show the coupon once; it is deleted as soon as the coupon appears. You can object by clearing the site cookies or through the official channel.

Analytics cookies and scripts (PostHog): are loaded only on the site's public pages and on login, sign-up, and checkout, and only after you accept them in the banner. They measure visits and clicks and, only on the public pages, record the browsing session to understand usability issues (login, sign-up, and checkout are not recorded). They are not loaded on the dashboard or the admin area, where there is code, logs, and data from your projects; if you navigate from the public pages to the dashboard without reloading, measurement stops there. Choosing "Only necessary" keeps all of this off; you can change your mind by clearing the site's data in your browser, which makes the banner reappear.

Google Analytics and Google Ads: with the same banner consent, we load Google Analytics to measure conversions from our Google Ads campaigns — for example, whether a sign-up came from an ad. It uses Google cookies and records the pages you visit, only on the public pages and on login, sign-up, and checkout, with a cleaned-up address; the dashboard does not load Google Analytics, and we never send your email, name or project content. Choosing "Necessary only" keeps Google off. We do not use any other ad networks.

9. Your rights

Under article 18 of the LGPD, you may, at any time: confirm whether we process your data; access it; correct incomplete, inaccurate, or outdated data; request anonymization, blocking, or deletion of unnecessary data or data processed in noncompliance; obtain portability of the data to another provider; know who we share it with; be informed of the possibility of not consenting and the consequences; withdraw consent; and object to processing based on legitimate interest.

Under Billing you can view and edit your billing details, remove saved cards, and turn automatic renewal on or off.

You can handle much of this yourself through the dashboard: editing your profile, deleting projects, revoking connections and API keys, and exporting snapshots. For everything else — including closing your account and deleting your data — write to [email protected] from your registered email. We respond within 15 days. We may request identity confirmation and may deny, with justification, requests that conflict with a legal obligation, court order, or third-party rights — for example, deleting tax records within the retention period.

If you are not satisfied, you may file a complaint with the National Data Protection Authority (ANPD).

10. Children and adolescents

The service is not intended for anyone under 18. We do not knowingly collect data from minors; if we identify an account created by a minor without legal representation, it will be closed and the data deleted. Using the platform to host content that exploits or harms children and adolescents results in immediate termination and notification to the authorities.

11. Third-party data in your applications

If your applications or databases process the personal data of other people (your bot's users, your store's customers, members of your community), you are the controller of that data and Vertra is the processor. It is your responsibility to define the legal basis, inform the data subjects, respond to their rights, ensure adequate security within the application, and report incidents. Vertra processes that content only to perform the service, on its own infrastructure and that of the providers in Section 4, and deletes it as set out in Section 6.

Web Analytics shows you, the application owner, your visitors' access data (IP, address, browser, country and where the visit came from). When you use this feature, you are the controller of that data. The dashboard masks the IP and URL parameters by default. Only you and the people with access to the project in your workspace can see them.

If you need a formal Data Processing Agreement (DPA) with Vertra, request it through the official channel.

12. Changes to this Policy

We may change this Policy for legal, regulatory, technical, or product reasons. High-impact changes — collecting sensitive categories of data, sharing your data with third parties for their own purposes, giving new processors access to the content you host, or reducing your rights — are communicated at least 30 days in advance by email and through the dashboard. Other changes take effect upon publication, with the effective date updated. The date of the last update is at the top of this page, and the history may be requested through the official channel.

13. Final provisions

This Policy is governed by Brazilian law — the LGPD, the Marco Civil da Internet, the Consumer Defense Code, and the Civil Code — and must be read together with the Terms of Use and the Acceptable Use Policy. In the event of a conflict regarding the processing of personal data, this Policy prevails. Questions: [email protected].