Privacy Policy
Initial version — under legal reviewVersion of 2026-09-26
How lakebrasil processes the personal data of its users, under Brazil's General Data Protection Law (Law 13.709/2018, LGPD). For personal data that appears in the public sources of the lake, see Personal data in public sources.
1. Who is the controller
Data Tech Solutions, CNPJ 48.478.031/0001-89, [address to be confirmed], São Bernardo do Campo/SP.
Data protection officer (Encarregado) and privacy channel: privacidade@lakebrasil.dev. You can also use the request form.
2. What we collect
- Account: your email and authentication data managed by Amazon Cognito (the password is stored only as a cryptographic verifier; two-step verification settings).
- Access logs: IP address, date and time of access to the site, the console and the API.
- Usage metering: for each call, the key used, the tool or consulta, the credits and rows read, and the time. We don't store the questions you ask your agent.
- Payments: processed by Stripe. We don't store card data; we only receive the payment status and required tax data.
- Privacy requests and messages you send us.
3. Purposes and legal bases
| Purpose | Data | Legal basis (LGPD, art. 7) |
|---|---|---|
| Create and keep the account, authenticate, provide the service | Account, authentication | Performance of contract (V) |
| Meter usage, charge credits, show the ledger | Usage metering, payments | Performance of contract (V) |
| Keep access logs for 6 months | IP, date and time | Legal obligation (II) — Marco Civil da Internet, art. 15 |
| Keep tax and accounting records | Payments, ledger | Legal obligation (II) |
| Prevent fraud and abuse, protect the service | Access, usage | Legitimate interest (IX) |
| Answer data-subject requests | Request data | Legal obligation (II) |
4. International transfer
Customer data is hosted by Amazon Web Services (AWS) in the sa-east-1 region (São Paulo), in Brazil. When a processor handles data outside Brazil, the transfer relies on the standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024; LGPD art. 33, II, "b").
See every processor and where it is located on the sub-processors page.
5. How long we keep data
| Data | Period |
|---|---|
| Account and API keys | While the account is active |
| Access logs (IP, date and time) | 6 months |
| Per-call usage detail | 13 months |
| Credit ledger and tax records | 5 years |
| Data-subject requests and their records | 5 years |
After these periods the data is deleted or anonymized.
6. Your rights
Under LGPD art. 18 you may ask for: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary or non-compliant data; portability; deletion of data processed on consent; information about sharing; information about the option not to consent; and withdrawal of consent. You may also object to processing based on legitimate interest.
How to exercise them: in the console, under Settings, you can export your data (JSON) and delete your account yourself. For anything else, use the request form or email the data protection officer. We answer within 15 days. You may also petition Brazil's data protection authority (ANPD).
7. Security
- Encryption in transit (TLS) and at rest.
- Strong passwords and optional two-step verification (TOTP); the password never travels in clear (SRP).
- API keys stored only as hashes; the full key is shown once.
- Internal access limited to what is necessary, and logged.
8. Security incidents
If an incident may cause relevant risk or harm to data subjects, we'll notify the ANPD and the affected data subjects within the period set by ANPD regulations, describing what happened, the data involved and the measures taken.
9. Cookies and local storage
We don't use tracking, advertising or third-party analytics cookies. We only use essential local storage in your browser:
| Item | What for | Where |
|---|---|---|
| Theme (light/dark) | Remember your theme preference | localStorage |
| Session | Keep you signed in (refresh token); persists across browser sessions only if you tick "Keep me signed in" | sessionStorage or localStorage |
| Signed-in flag | Show "Console" instead of "Sign in" on the site | localStorage |
| Language banner | Don't show "View this page in English?" again once dismissed | localStorage |
10. Children and teenagers
The service isn't meant for people under 18, and we don't knowingly collect their data.
11. Changes to this policy
When this policy changes materially, we'll let you know by email or in the console and update the version date at the top of this page.