Privacy Policy

1. Controller

Titulata is a personal data governance platform operated by a company incorporated in Brazil. We process account data under the LGPD, on the basis of art. 7, V (performance of a contract) and IX (legitimate interest).

2. Personal data processed

We process only the data strictly necessary, in line with the necessity principle (LGPD art. 6, III):

• Account data: email, company name, and industry.
• Metadata of connected databases: table and column names, data types and aggregate statistics. Row values are never stored.
• Usage data: scan history, risk scores, and encrypted credentials (AES-256-GCM).

3. No retention of data subjects’ data

We do not store the personal data of our customers’ customers. Scans collect only metadata and aggregate statistical patterns.

4. Data subject rights

Under LGPD art. 18, the data subject has the right to:

• Access: request a copy of the personal data we hold.
• Correction: request correction of incomplete, inaccurate or outdated data.
• Deletion: request deletion of your account and all associated data.
• Portability: receive your data in a structured format.

5. Retention period

Account data is kept while the account is active. Scan results are kept for 12 months. Earlier deletion may be requested at any time.

6. Processors

We use the following processors: Supabase (database and authentication), Anthropic (language model; column metadata only, never row values), Sentry (error monitoring) and Upstash Redis (rate limiting).

7. Security measures

All data encrypted in transit (TLS 1.3) and at rest (AES-256-GCM for credentials). Row-Level Security ensures each organization can only access its own data.

Contact

For privacy or legal inquiries: legal@titulata.com