Privacy Policy

Who we are

Rizumo is operated by [LEGAL NAME], registration [NUMBER], [ADDRESS] (“we”). For any privacy matter, write to [e-mail de suporte]. Data protection officer: [NAME].

Data we process

Account: name, email, password (stored only as a scrypt hash) or your Google account identifier if you sign in with Google.

Content: workspaces, teams, retrospectives, notes, votes, comments, action items, templates and invitations created by you and your team.

Billing: payments are handled by Stripe; we never receive or store card data. We keep the Stripe customer and subscription identifiers, the plan and the period dates.

Technical: IP address, time and path of each request in operational logs, and the session cookie.

Why we use it

To provide the service (performance of contract): sign-in, showing the board to your team, sending invitations and account emails, billing the Team plan.

Security and abuse prevention (legitimate interest): rate limits, operational logs and incident investigation.

Legal and tax obligations, where applicable.

We do not sell data, use advertising trackers, or train AI models on your content.

Who we share it with

Amazon Web Services (hosting, database and email delivery) in us-east-1, United States.

Google (only if you choose to sign in with Google).

Stripe (Team plan payments).

Servers are in the United States, so data may be transferred internationally under [standard contractual clauses / applicable mechanism — to be defined].

How long we keep it

Content is kept until it is deleted by its owner (retrospective, workspace) or your account is deleted.

Operational logs: up to 14 days (application) and 90 days (load balancer). Database backups: up to 7 days after a deletion.

Expired sessions and links are deleted automatically.

Cookies and local storage

We use one essential session cookie (to keep you signed in) and short-lived cookies during Google sign-in. Your browser keeps preferences such as language and theme. No analytics or advertising cookies.

We measure usage without cookies and without identifying anyone: each page view or completed step (such as creating an account or a retrospective) only adds 1 to a daily counter, along with where the visit came from (campaign or referring site) and the language. We store no IP address or identifier for these counts.

Your rights

You can access, correct, export and delete your data. Account deletion is in Settings; workspace export is available to the owner. For any other request under GDPR or Brazil's LGPD, write to [e-mail de suporte]; we reply within 15 days.

Security

Encrypted connections (HTTPS), hashed passwords, sessions and tokens stored only as hashes, organization isolation checked on every operation, and a database with no public access.

Changes

We will notify you by email and in the app before material changes to this policy.