Privacy Policy

Who is responsible

The controller of your personal data is Talisson Junior, established in Brazil. For any question or request under this policy, write to juniortalisson16@gmail.com — a person reads that address.

What we collect

Account data — your email address, your name and avatar if you set them, your password stored only as a hash, and the roles you hold.

What you build — the scripts, flows, scrapers, pages and schedules you create, and the results and logs of running them. This may contain personal data if you put personal data in it; when it does, you are its controller and we process it for you.

Connection credentials — for the databases, storage buckets and services you connect. These are encrypted before storage and are never returned to the browser in readable form except when you explicitly ask to reveal one.

Usage metering — how many runs you made and of which kind, because that is what a plan limits and what a bill is based on.

Technical data — IP address, browser and device information, and timestamps, from ordinary server logs.

We do NOT collect payment card data. Checkout happens at Paddle; card numbers never reach our servers. We receive from Paddle only what we need to know that you paid and what for.

Why we may lawfully do it

To perform our contract with you — running your code, keeping your account, metering usage, taking payment.

Legitimate interests — keeping the service secure, preventing abuse, and understanding failures well enough to fix them. We balance these against your rights and do not use them as a catch-all.

Legal obligation — keeping the records tax and accounting law requires.

Consent — for anything optional, such as product email you can unsubscribe from. Consent can be withdrawn at any time, and withdrawing it does not affect what was done before.

Who else sees it

We share personal data only with the parties that make the service work, and only what each one needs:

— Paddle.com Market Ltd — payments, as Merchant of Record. It receives your billing details directly from you.

— Our hosting provider — the servers the cloud service runs on, located in Europe.

— Providers you connect yourself — AI providers, email providers, object storage. These receive only what your own scripts and settings send them, using credentials you supplied.

We do not sell personal data, and we do not share it for anyone else’s advertising.

Where it goes

Our cloud servers are in Europe and Paddle operates internationally, so your data may be processed outside Brazil. Where it is, we rely on the transfer mechanisms the applicable law provides — standard contractual clauses or an adequacy decision.

A self-hosted installation processes your data on your own infrastructure. In that arrangement we receive only the licence telemetry described in your licence terms — never your scripts, your data or your credentials.

How long we keep it

Account data, for as long as the account exists, and then for as long as we must keep records of it by law.

Run results and logs, for as long as they are useful to you in the product, unless you delete them earlier.

Billing records, for the period tax law requires — this is why deleting an account does not delete every trace of a payment.

When you ask us to delete your data, we delete what we are not legally required to keep, and tell you what remains and why.

What you can require of us

Under the LGPD (art. 18) and, where it applies, the GDPR, you may ask us to: confirm whether we process your data; give you access to it; correct it; anonymise, block or delete data that is unnecessary or excessive; give it to you in a portable form; tell you who we shared it with; and explain the consequences of refusing consent.

Write to juniortalisson16@gmail.com. We answer within the period the law sets, and we do not charge for it. If you think we have handled your data badly, you may complain to Brazil’s ANPD, or to your local supervisory authority in Europe.

Cookies

We use cookies and equivalent browser storage to keep you signed in and to remember interface preferences such as your language and theme. These are necessary for the product to work and are not used to track you across other websites.

On our public websites (waiso.dev and waiso.com.br) we use Microsoft Clarity to see, in aggregate, how pages are used, so we can improve them. It loads only after you accept it in the notice, and the choice is kept separately on each website. Declining changes nothing else on the site.

Security

Passwords are stored only as hashes. Connection credentials are encrypted at rest. Code you submit runs in isolated containers without network access except where you explicitly grant it, and secrets are scrubbed from logs.

No system is perfectly secure. If a breach affects your personal data and poses a risk to you, we will tell you and the authority, as the law requires.

Children

Waiso is not directed at children, and we do not knowingly collect data from anyone below the age at which they can consent for themselves where they live. If you believe a child has given us data, write to us and we will remove it.

Changes

We may update this policy. The date at the top is when it last changed, and we will give notice of a material change before it takes effect.