Privacy Policy

1.1. Customer data (you): for your registration, payment and platform usage data, Melosy is the Controller — it decides how and why this data is processed, in accordance with this policy.

1.2. YOUR customers' data: for the data of end customers, suppliers and contacts that you register in the system (to manage sales, quotes, tax documents etc.), you are the Controller and Melosy is the Processor — we process this data exclusively to provide the service to you, according to your instructions and the Terms of Use. Responding to these people's LGPD rights (access, correction, deletion) is your responsibility; we provide the necessary technical support.

— Identification and registration: name, e-mail, phone, company, CNPJ/CPF, business address;

— Billing: processed by Stripe (we do not store your full card number);

— A1 digital certificate (when you use tax issuance): stored encrypted and segregated in a secrets vault, used only to transmit your tax documents;

— Usage data: technical records (logs), usage metrics and session recording (see section 5);

— Terms acceptance record (see section 6): date and time, accepted version, IP address, browser identification (user-agent), displayed language and account role (owner or invitee);

— Data entered by you while using the system (products, sales, expenses, end customers — processed as Processor, section 1.2).

— Providing the contracted service (performance of contract): operating the platform, issuing tax documents, processing payments, providing support;

— Security and fraud prevention (legitimate interest/legal obligation);

— Improving the product (legitimate interest): error diagnostics and usage metrics;

— Communications about the platform, support, and contact to complete a started registration or recover an abandoned checkout — always with an unsubscribe option;

— Complying with legal and regulatory obligations, including tax obligations;

— Regular exercise of rights (art. 7, VI of the LGPD): the Terms acceptance record (section 6).

We do not sell your data. We share it only with providers that make the service possible, each in its role:

— Stripe — payment processing;

— Supabase — database and authentication;

— Cloudflare and DigitalOcean — infrastructure, network and hosting;

— LogRocket — session recording for support and diagnostics (section 5);

— Google (Analytics/Ads) and Meta/Facebook (pixel and Conversions API) — ad measurement and optimization, with pseudonymized data or click identifiers;

— Transactional e-mail providers — system notices and communications.

Some of these providers operate servers outside Brazil; in such cases, the international transfer relies on adequate contractual safeguards (LGPD, arts. 33 et seq.).

For support, security and product improvement, we use our own and third-party tools for diagnostics, usage analytics and session recording (screen replay — currently, LogRocket), with masking of sensitive data: passwords, card data and digital certificate are not captured in the recordings.

We also use our own measurement pixel (t.melosy.io, first-party cookie mel_anon) to understand the origin of visits and the usage of our pages — the data stays in our own database.

When you accept the Terms of Use and this Policy on the platform, we keep an electronic record of the acceptance: date and time, accepted version (and the cryptographic fingerprint of the text in force), IP address observed by the server, browser identification, displayed language and account role. Legal basis: regular exercise of rights (art. 7, VI of the LGPD).

Retention after account deletion: if you delete your account, this record is preserved in anonymized form — the link to your identity is replaced by an irreversible cryptographic code (keyed hash). This retention relies on art. 16, I and III of the LGPD (compliance with legal obligation and regular exercise of rights in proceedings), and is the only exception to the deletion described in section 8.

We apply technical and organizational protection measures: encryption in transit, per-customer data isolation in the database (Row Level Security), an encrypted vault for secrets and certificates, a Content Security Policy (CSP) in the browser, error monitoring and daily encrypted backups in distinct locations.

You may, at any time, request: access to your data, correction of incomplete or outdated data, export (portable data — the system's modules have self-service export while the subscription is in force; after termination, upon request, as per the Terms), deletion (right to erasure, subject to legal retentions and section 6) and withdrawal of consents.

Channel to exercise rights: support@melosy.io.

— Active account: data kept for as long as the agreement lasts;

— After cancellation or non-payment: data retained for 90 days (Terms, clauses 7 and 12) for reactivation or export; afterwards, it may be permanently deleted;

— Acceptance record: preserved in anonymized form (section 6);

— Legal obligations: tax and billing records for the periods required by law.

We use cookies and similar technologies: essential (session and authentication), measurement (our own mel_anon pixel, Google Analytics) and advertising (Meta). You can manage them in your browser settings; essential ones are necessary for operation.

Data Protection Officer of MAXX CICLO LTDA — contact: support@melosy.io.