Privacy Policy

Last updated: October 26, 2026

This is a translation of the original document in Portuguese, which was written under Brazilian law. In case of any discrepancy, the Portuguese version prevails.

This policy explains how Codilla processes the personal data of people who visit the codilla.io website, create an account, buy a license or use Sentinela, in compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD).

1. Who is responsible for your data

Codilla is the controller of the personal data described in this policy. For any privacy matter, including exercising your rights, contact our data protection officer at contato@codilla.io.

2. What data we collect

Customer area account

Email and password (the password is stored encrypted by our authentication provider; we have no access to it).
If you sign in with Google: name, email, profile photo and Google account identifier. We don't receive your Google password or access to other services in your account.

Purchases

Plan purchased, amount, date, payment method and transaction identifiers. Payment data (card number, CPF/CNPJ for boleto, Pix details) is collected and processed directly by Stripe; we don't store card numbers.

Sentinela license and activation

License key, a technical identifier of the computer where Sentinela was activated (generated from the system and not reversible), that computer's name and the license activation and verification dates.

Contact form

Name, email, phone, company and the message you send us.

Website browsing

Pages visited, device and browser type, traffic source and IP address, collected by analytics tools (Google Analytics and Vercel Analytics) and cookies.

3. What Sentinela does not send us

Sentinela runs on your company's computer and network. Monitored files, supplier and analyst records, follow-up emails and delivery history stay on your infrastructure and are not sent to Codilla. To activate and verify the license, Sentinela sends only the license key, the computer's technical identifier and the computer's name.

4. What we use the data for and on what legal basis

Creating and maintaining your account, processing purchases, issuing and validating licenses and enabling downloads — performance of a contract (art. 7, V, LGPD).
Meeting tax and accounting obligations, such as keeping sales records — compliance with a legal obligation (art. 7, II).
Preventing fraud and license misuse, including control of activated computers — legitimate interest (art. 7, IX).
Responding to inquiries and proposals — pre-contractual procedures at the data subject's request (art. 7, V).
Measuring website usage to improve it — legitimate interest (art. 7, IX) for Vercel Analytics, which doesn't use cookies; consent (art. 7, I) for Google Analytics, which is only enabled if you accept analytics cookies.

5. Who we share it with

We don't sell personal data. We only share it with service providers that process data on our behalf, for the purposes above:

Stripe — payment processing.
Supabase — authentication, database and file storage.
Vercel — website hosting and traffic analytics.
Google — sign-in with Google and traffic analytics (Google Analytics).
Formspree — receiving contact form messages.

We may also share data when required by law or by order of a competent authority.

6. International transfer

Some of these providers store data on servers outside Brazil. In these cases, the transfer takes place to perform the contract with you and with providers that adopt protection safeguards compatible with the LGPD (art. 33).

7. How long we keep it

Account and license data: while the account exists or the license is in force.
Purchase records: for the period required by tax law (generally 5 years).
Contact messages: up to 2 years after the last contact, if they don't become a contract.
Browsing analytics: according to the retention periods of the tools used.

8. Your rights

Under the LGPD (art. 18), you can request at any time:

confirmation that we process your data and access to it;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of unnecessary or excessive data;
data portability;
information about who we share your data with;
deletion of the data, except data we must keep by legal obligation.

Send your request to contato@codilla.io. We respond within 15 days. You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).

9. Security

We adopt technical and organizational measures to protect data, such as encrypted connections (HTTPS), per-user access control in the database and digitally signed license files. No system is completely immune to incidents; if one affects your data, we will notify you and the ANPD as required by law.

10. Cookies

We use necessary cookies to keep you signed in to the customer area and to process payments securely; they don't depend on consent. Analytics cookies (Google Analytics) are only set if you accept them in the cookie notice. You can change your choice at any time through the "Cookies" link in the site footer, and also block or delete cookies in your browser settings; blocking the necessary ones prevents sign-in.

11. Changes

We may update this policy. The date of the last update is shown at the top of the page, and relevant changes will be communicated by email or in the customer area.