Data processing agreement & sub-operators

01 — Subject matter and roles

This agreement forms part of every customer's Terms of Service and governs the processing of personal data that Tave carries out ON BEHALF of the agency. It is written in the language of the LGPD (Law 13.709/2018); where your compliance programme also needs GDPR terms, the equivalent is given in brackets.

YOU (the agency) are the CONTROLLER (art. 5, VI — the GDPR's controller) of the personal data you and your clients put into Tave. The decisions about purpose and means are yours.

WE are the OPERATOR (art. 5, VII — processor), and we process that data exclusively on your documented instructions (art. 39). Your documented instructions are: the Terms of Service, this agreement, and the actions you and your team take inside the product. There is no verbal instruction.

If we receive an instruction from you that, in our view, breaches the LGPD, we tell you in writing before carrying it out.

For your own account data — team records, credentials, billing, access logs — we are the controller, and the Privacy Policy governs, not this agreement.

02 — Subject matter, nature, purpose and duration of the processing

SUBJECT MATTER AND PURPOSE. Providing the contracted service: storing, organizing, displaying, transmitting and backing up your workspace data, sending the communications the product sends on your behalf, and producing and preserving the evidence of electronic signatures.

NATURE OF THE OPERATIONS. Collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, communication, transfer and extraction — in the form of art. 5, X, and always limited to what the purposes above require.

CATEGORIES OF DATA SUBJECTS. Your team members; your clients' contacts; and people who appear in the content you store.

CATEGORIES OF DATA. Name, email, job title and business contact details; the content of proposals, documents and files; amounts and commercial terms; signature evidence (typed name, email, date and time, IP, browser identifier, consent wording, hashes); and the event log recording who did what and when.

SENSITIVE DATA. The service does not require sensitive personal data (art. 11) and was not built for it. Do not put it into the product.

DURATION. For as long as the organization exists, plus the 30-day grace period after closure, save for what section 12 and the law require to be kept longer.

03 — Confidentiality

Everyone authorized to process personal data on our behalf is bound to confidentiality, by contract or by legal duty, and that obligation survives the end of the engagement.

Access is granted on the least-privilege principle and only where it is needed to operate, support or investigate an incident. Access to customer data for support happens only at your request or where it is indispensable to restore the service, and it is recorded.

We do not disclose personal data to third parties outside the cases in this agreement, art. 10, §1 of the Marco Civil da Internet (a court order for access records), and legal requirements binding on us. Where an authority makes a request, we tell you before responding whenever the law allows, so that you can react.

04 — Security measures (art. 46)

The measures below are implemented and covered by automated tests today. We list nothing here that does not exist yet.

ENCRYPTION AND CREDENTIALS. TLS required in transit, with HSTS in production. Passwords hashed with argon2id. Session, sign-in-link and signing tokens carry 32 bytes of entropy and are stored only as a SHA-256 hash — the database holds no recoverable credential.

ISOLATION BETWEEN CUSTOMERS. The organization identifier is injected into the WHERE clause of every query, and every caller-supplied relation identifier is checked against the organization before any write. Unscoped queries are a lint error. Tests interleaving two organizations prove that a cross-tenant read returns nothing and a cross-tenant write fails.

HISTORY INTEGRITY. The event log is append-only at two independent layers: the application's database role has no UPDATE or DELETE on the table, and a trigger refuses the operation even for the database owner. Signature evidence (signer identity, seal, hashes) is protected by write-once triggers, for every database user.

HTTP SURFACE. A strict content security policy with a per-request nonce; a full set of security headers on every response; request bodies bounded at 1 MB before routing; rate limits at every public authentication and link endpoint.

LOGGING AND OBSERVABILITY. Structured logs with automatic redaction of personal data — message bodies, answers, signature images, tokens and passwords are never written. Daily purge of dead tokens and sessions.

BACKUPS. From the first production deployment: the platform's own database backups plus a nightly copy held off the platform, with restoration rehearsed before real customer data enters.

WHAT WE DO NOT HAVE. We hold no ISO 27001 certification and no SOC 2 report, and we are not going to imply that we do. There is no two-factor authentication for agency users at this stage. If your procurement process requires those, talk to us before contracting.

05 — Sub-operators (art. 39)

You give general authorization for the engagement of the sub-operators listed in the table below, which process personal data on our behalf under a written contract with obligations no less protective than those in this agreement.

The list names those processing data today, plus one named exception: Anthropic, the provider behind the product's AI assist features, which are built but switched off. It is listed ahead of activation so this table is never behind the product, and it processes nothing until the features are switched on. Providers foreseen for functions that do not exist in the product yet — a merchant of record for billing, error monitoring — are not on it and process nothing.

PRIOR NOTICE. We tell organization owners by email, at least 30 (thirty) days in advance, of the addition or replacement of any sub-operator. You may object on reasonable data-protection grounds within that period; if there is no solution, you may close your plan with no penalty and a proportional refund of what was paid and unused.

We are answerable to you for our sub-operators' acts as if they were our own.

06 — International transfer (art. 33)

Processing takes place outside Brazil: the application, the database and the files sit on Railway, in a United States and/or European Union region, and transactional email is sent by Resend in the United States. The regions are in the table in section 05.

GROUNDS. Art. 33, IX read with art. 7, V — the transfer is necessary to perform the contract; and art. 33, II, "b" — standard contractual clauses in the form approved by ANPD Resolution CD/ANPD No. 19/2024, executed with each sub-operator. For customers subject to the GDPR, the same flows are covered by the European Commission's standard contractual clauses in the providers' own agreements.

No customer data enters a sub-operator before the transfer instrument with it is signed.

Brazilian law remains applicable to the processing even where the data is stored abroad (LGPD art. 3; Marco Civil art. 11).

07 — Assistance to the controller

DATA SUBJECT RIGHTS (art. 18). The product already gives you access, correction, export and deletion of your workspace data — in most cases you serve the data subject yourself, without depending on us. Where that is not enough, we help: we answer a request for assistance within 5 (five) business days, so that you can meet the art. 19 deadline towards the data subject.

If a data subject comes to US directly about data for which you are the controller, we decide nothing: we forward the request to you and tell the data subject that we did.

IMPACT ASSESSMENTS (art. 38) and ANPD enquiries: we provide the information we hold about the architecture, the security measures and the data flows, to the extent it is necessary and does not expose trade secrets or other customers' security.

RECORD OF PROCESSING (art. 37). We keep a record of the processing operations we carry out and make it available to you where you need it for your own record or to answer the ANPD.

08 — Security incidents (art. 48)

We notify you WITHOUT UNDUE DELAY on confirming a security incident involving personal data under your controllership, and in no case later than 48 (forty-eight) hours after confirmation — a deadline chosen to fit inside the 3 (three) business days ANPD Resolution CD/ANPD No. 15/2024 gives YOU to notify the authority.

The notice will carry, as far as it is known at the time: the nature of the data affected, the categories and approximate number of data subjects, the technical and security measures protecting the data, the risks involved, what we have already done and what we recommend you do. Partial information is sent immediately and completed afterwards — we do not hold the notice back waiting for a perfect report.

Notifying the ANPD and the data subjects is, in that case, your duty as controller. We give technical support and information.

Where the incident touches data for which WE are the controller, notifying the ANPD is ours, within the same resolution's 3 business days.

We require no confidentiality from you about the incident and we attach no condition to the notice.

09 — Audit and demonstrating compliance

We make available to you the information needed to demonstrate compliance with this agreement: the description of the security measures, the sub-operator list with regions, internal security review reports to the extent they do not expose other customers, and answers to a security questionnaire.

AUDIT. You may audit once per 12-month period, on 30 days' notice, during business hours, under confidentiality, and without access to other customers' data or to the shared production environment. A further audit is available where there is a confirmed incident affecting your data or an authority so determines. Reasonable audit costs are yours, unless the audit finds a material breach on our side.

We have, at this stage, no ISO 27001 certification and no SOC 2 report to offer in place of an audit. When we do, they will replace the on-site audit and this text will say so.

10 — Liability (arts. 42 to 45)

The LGPD makes the operator liable where it fails to comply with the law or does not follow the controller's lawful instructions (art. 42, §1, I). That is the measure of our liability.

Between us, each party answers for the harm it causes: you, for the decisions you take as controller — including the legal basis, informing data subjects, and what you decide to put into the product; we, for processing carried out contrary to the law or to your instructions.

If one of us is sued and pays for harm the other caused, there is a right of recourse in proportion to each party's part in the event (art. 42, §4).

The liability limits in the Terms of Service do not apply to a personal data breach caused by us, and do not exclude liability that the LGPD or the Consumer Defence Code does not allow to be limited.

11 — Your own duties as controller of your clients' data

This section exists because an operator cannot fix what the controller failed to do, and because the agency is who answers to its own clients.

LEGAL BASIS. It is for you to have a legal basis under art. 7 for every piece of data you put into Tave about your clients, and to stand behind it.

TRANSPARENCY. It is for you to tell your clients that you process their data, what for, and that you use an operator — Tave — whose infrastructure is outside Brazil, including the international transfer described in section 06. Your own privacy policy needs to say that.

DATA SUBJECT RIGHTS. You are the one who receives and answers your clients' requests. We help, as set out in section 07.

QUALITY AND MINIMIZATION. Keep the contact list accurate, revoke access for people who have left, and do not put more data into the product than the relationship requires (art. 6, III and V).

SENSITIVE DATA AND MINORS. Do not put them into the product. If you do, responsibility for the legal basis, additional measures and consequences is yours.

SECURITY ON YOUR SIDE. It is for you to use the product's access roles, choose strong passwords and control who from your team gets in. The portal link sent to your client is a bearer credential: whoever controls that inbox acts as that contact. You know that design and you decide what you send that way.

DATA PROTECTION OFFICER. If you are required to appoint one (art. 41), that is your obligation, not ours.

12 — Deletion and return on termination

On termination you choose between the return and the deletion of the personal data. If you do not choose, the default is: export made available, 30 (thirty) days of grace, permanent deletion.

Deletion reaches the database records and the stored files. Backups still holding the data fall out of circulation as their rotation cycle turns; while they exist they stay under the same security measures and are used for nothing but restoration.

LEGITIMATE EXCEPTIONS (art. 16). Beyond the grace period we keep: data the law requires us to keep — in particular application access records, for 6 months (Marco Civil art. 15), and tax documents; and the evidence of signed documents, whose retention rests on the regular exercise of rights (arts. 7, VI and 16, II). Deleting signature evidence passes a legal-retention check first — a signed contract is not a disposable record, and its retention period may outlast the account.

We tell you in writing what was deleted and what was kept, with the basis and the period.

13 — Term, changes and a signed copy

This agreement runs for as long as we process personal data on your behalf and survives the end of the Terms of Service as far as necessary — confidentiality, deletion and liability.

A material change follows the same procedure as the Terms: notice by email at least 30 (thirty) days in advance.

THIS PAGE IS THE AGREEMENT IN FORCE. If your compliance process needs a signed copy, or you want to be on the sub-operator change notification list, write to privacy@usetave.com — we will sign a copy through Tave itself.

This agreement is entered into between your organization, as controller, and Tave, with its seat in Balneário Camboriú, SC, Brazil, as operator. It is accepted together with the Terms of Service and needs no separate signature to be in force.

14 — Language and governing law

This agreement is governed by Brazilian law, in particular Law 13.709/2018 (LGPD) and Law 12.965/2014 (Marco Civil da Internet), and follows the venue elected in the Terms of Service, section 16.

The Portuguese version is the one that governs; the English version is a courtesy translation. In case of divergence, the Portuguese text prevails.

Data protection officer contact: privacy@usetave.com.