Legal & Compliance Center

1. Data Controller and Data Protection Officer (DPO)

Checklist Na Prática is operated by Na Prática Gestão e Tecnologia Ltda., CNPJ 18.751.571/0001-23, a B2B SaaS cloud technology provider based in Brazil. Under GDPR and LGPD definitions, we operate as:

• Data Controller: for customer account registration data, administrator contact credentials, billing information, and support communications.
• Data Processor: for operational data entered into the platform by our enterprise clients (task items, attached inspection photos, worker identification tags, and internal routine audits).

2. Categories of Personal Data Collected

We only collect data strictly necessary to provide our digital routine and checklist services:

3. Legal Bases for Processing (GDPR Art. 6 & LGPD Art. 7)

We only process personal data when a valid legal basis exists under applicable law:

4. Sub-processors and Third-Party Disclosures

We never sell, rent, or lease personal data. Data is shared exclusively with vetted enterprise sub-processors under strict confidentiality and data protection agreements:

5. Data Subject Rights (GDPR, LGPD & CCPA/CPRA)

We honor and support all privacy rights provided under international data protection laws:

6. Security and Data Retention

Our security controls incorporate multi-layered safeguards:

• Encryption Standards: End-to-end transport encryption via TLS 1.3 and hardware-accelerated AES-256 encryption for database volumes and photo storage.
• Logical Multi-Tenant Segregation: Strict organization-level scoping ensures that one enterprise tenant cannot access another tenant's records.
• Retention Schedules: Data is kept while the account is active. If a subscription is cancelled for non-payment, the organization's checklists, runs and photos are kept for 90 days (to reactivate or export) and then permanently deleted. We keep only what the law requires, such as tax records, access logs (6 months under Brazil's Marco Civil da Internet) and the record of your acceptance of these terms.
• How to request deletion of your data: delete your account under My Account, or email checklist@na-pratica.com from your registered address. We reply within 15 days.

7. Contact the Data Protection Officer

To submit a data access request or query our data governance team, reach out to our DPO:

1. Subject Matter, Software License & Acceptance

These Terms of Use and Software License ("Terms") govern use of the Checklist Na Prática application, an operational checklist software offered as a service (SaaS). Upon payment of the subscription, we grant the Customer a limited, non-exclusive, non-transferable and revocable license, valid while the subscription is active, to access the application over the internet and use it in its organization's activities. The license does not transfer ownership of the software or any right to its source code.

Acceptance is electronic: by ticking the "I have read and agree" box when creating an account (or when a new version of these Terms is presented). We record the date, time, IP address, browser and accepted Terms version, which serves as evidence of the agreement without a physical signature. Anyone accepting on behalf of a company represents that they are authorized to do so.

2. Organizations & Account Management

The service operates under a structured multi-tenant model:

• Organization Owner: The initial registrant maintains administrative control, license management, and authorization for team members and workers.
• Credential Integrity: Users are solely responsible for safeguarding their login credentials and magic link tokens. Account sharing is strictly prohibited.
• Worker Roles: Routine field executors operate under the direction and supervision of the contracting Customer organization.

3. Intellectual Property & Customer Data Ownership

4. Subscription, Automatic Renewal, Annual Price Adjustment & Cancellation

• Payment: subscriptions are billed in advance by card through Stripe. We never store card data.
• Automatic renewal: the subscription renews automatically at the end of each billing cycle (monthly or yearly), for the same period and charged to the same payment method, until the Customer cancels it.
• Annual price adjustment: prices may be adjusted once every 12 months. The new price is announced by email at least 30 days in advance and applies from the following renewal. If the Customer disagrees, it may cancel before that date with no penalty.
• Plan changes: upgrades and downgrades take effect immediately, prorated over the remaining period.
• Cancellation by the Customer: at any time from the billing portal, with no penalty. Access continues until the end of the paid cycle; partial periods are not refunded unless required by law (e.g. the 7-day withdrawal right under Brazil's Consumer Protection Code, where applicable).
• Non-payment: if a payment fails, we retry the charge automatically and notify you by email. If payment is still not made, the subscription is cancelled and access to paid features is suspended.

5. Data Retention & Deletion After Cancellation

After a subscription is cancelled for non-payment, the organization's data (templates, completed checklists, photos and reports) is kept for 90 days. During that period the Customer may settle payment and reactivate the account, or request an export of its data. After that period the data is permanently deleted and cannot be recovered; backup copies are removed in the normal backup rotation. We keep only the records the law requires (tax, access logs and acceptance of these Terms).

6. Acceptable Use Policy

Users agree not to tamper with digital audit trails, falsify compliance photos, attempt unauthorized penetration testing without consent, or reverse engineer platform services.

7. Availability, Maintenance & "As Is" Software

The software is provided "as is" and "as available", without warranty that it will be uninterrupted or error-free, or fit for purposes not described in these Terms. We aim for 99.5% monthly availability as a target, not a guarantee.

• Scheduled maintenance: maintenance windows may occur, announced at least 48 hours in advance and preferably during low-usage hours.
• Emergency maintenance: urgent security or stability fixes may be applied without prior notice.
• Third parties: we are not liable for failures of internet or power providers, Customer devices, or third-party services outside our control.

8. Limitation of Liability

Checklist Na Prática is a management support tool. Compliance with health (e.g. ANVISA), labor, safety or any other regulations is the Customer's sole responsibility. To the maximum extent permitted by law, and except for willful misconduct or gross negligence:

• the platform's total financial liability for technical failures or any other cause related to the service is capped at the amount actually paid by the Customer in the twelve (12) months preceding the event;
• we are not liable for lost profits, lost revenue, indirect or consequential damages, or losses caused by data entered incorrectly by the Customer.

9. Governing Law & Dispute Resolution

These Terms are governed by the laws of the Federative Republic of Brazil. The parties submit to the exclusive jurisdiction of the competent courts of the company headquarters for the resolution of any dispute.

1. What are Cookies and Web Storage?

Cookies are small data files transferred to your computer or mobile device by your web browser. They authenticate your user session across requests and prevent unauthorized form submissions through CSRF tokens.

2. Platform Cookie Inventory

Below is a comprehensive schedule of all cookies utilized across our application:

3. Browser-Level Cookie Management

You may also inspect, filter, or erase cookies via your browser's native settings panel (Chrome, Safari, Firefox, Edge). Please note that blocking strictly necessary cookies will render authentication inoperative.

1. Parties & Regulatory Roles

2. Processing Scope & Data Categories

• Purpose: Providing cloud-hosted checklist automation, task verification, photographic evidence logging, and routine analytics.
• Duration: The duration of the active subscription agreement plus statutory post-termination export windows.
• Categories of Data Subjects: Customer employees, contractors, field inspectors, and authorized staff members.
• Types of Personal Data: Worker names, corporate email addresses, timestamps, task audit notes, captured photos, and IP connection headers.

3. Processor Obligations

4. Sub-processors

Controller grants general written authorization to engage AWS, Stripe, Google Cloud Platform, and Resend as infrastructure sub-processors, and Meta Platforms for ad measurement (Meta Pixel and server-sent conversion events with hashed email and user ID, IP address and user agent), the latter only for users who consented to marketing cookies. Processor shall notify Controller of any intended changes concerning the addition or replacement of sub-processors with at least 30 days prior written notice.

5. Security Incident Notification

6. Return and Deletion of Data

Upon termination of services, Controller shall have 30 days to export all operational reports. Following this period, Processor will permanently delete Customer Personal Data from active systems in accordance with standard backup rotation schedules.