Privacy policy

01 — Who we are and what this policy covers

Tave is an agency-operations platform, built in Brazil and offered in Portuguese and English. This policy explains what we do with personal data in three places: the usetave.com website, the waitlist and contact form, and the product itself.

The controller is Tave, with its seat in Balneário Camboriú, SC, Brazil. The channels below reach us directly and are the ones to use for anything in this policy.

Data protection officer (encarregado, LGPD art. 41): privacy@usetave.com. Contractual matters: legal@usetave.com. We answer in Portuguese or English, whichever you prefer.

Brazilian law governs this processing even though the infrastructure sits outside the country — that is what LGPD art. 3 and Marco Civil art. 11 say. See section 07.

02 — Two roles: controller and operator

The LGPD separates whoever decides on the processing (the controller, art. 5, VI) from whoever processes on someone else's behalf (the operator, art. 5, VII — the GDPR's processor). Tave is both, at different moments, and the difference changes who you go to.

We are the CONTROLLER of your account data and your use of Tave: your team's records, credentials, sessions, access logs, billing once it exists, and the data of anyone who joins the waitlist or writes to us from the site. Here the decisions are ours and so is the responsibility.

We are the OPERATOR of the data you put into Tave about your own clients: contacts, deals, proposals, documents, signatures, amounts, files. Your agency decides why and how that data is processed — you are the controller, and we process only on your documented instructions (art. 39), which are these terms, the Data Processing Agreement, and the actions you take inside the product. Using that data for purposes of our own, or selling it, is contractually excluded.

If you are a client of an agency that uses Tave, the agency is the controller of your data. See section 13.

03 — What we process, surface by surface

WAITLIST AND CONTACT (website). Name, email, company (optional), the topic you chose, the message you write, the language you were reading in and — for abuse review, never for anything else — the IP address and browser identifier. Nothing is sent back to the address you gave unless you asked for it: the notice goes to us, and the reply is written by a human.

AGENCY ACCOUNT. Name, email, password, role in the organization (owner, member, finance, contractor), the organization's language and timezone. The password is never stored as text: it is an argon2id hash. Sessions store the token's hash (never the token), the IP address, the browser identifier and an expiry. Emailed sign-in links store the token's hash, the requesting IP and a single-use 15-minute expiry.

WORKSPACE CONTENT. Everything you create in the product: clients and contacts, deals and pipeline stages, proposals, documents, templates, money figures. And the event log: an append-only trail that records every state change with who made it, when, and what changed. That trail cannot be edited or deleted — not even by us — while the organization exists; it is what carries your business history and what makes a signature defensible.

ELECTRONIC SIGNATURE. When someone signs a document through Tave, we record: the typed name, the email address the link was sent to, the date and time from the server clock, the IP address, the browser identifier, the exact consent wording accepted and its version, the signature style adopted, a SHA-256 audit chain, and the SHA-256 hash of the sealed PDF. Details in section 06.

TECHNICAL RECORDS. Structured operational logs (request id, route, duration, outcome, authentication events) and application access records. Message bodies, form answers, signature images, tokens and passwords never reach a log — an automatic redactor strips sensitive keys, masks the local part of email addresses and bounds what gets written.

WHAT DOES NOT EXIST. We run no advertising tracker, no third-party analytics and no third-party cookie — not on our site, and not on any surface your agency's clients see.

04 — The legal basis for each processing activity (arts. 7 and 11)

The LGPD requires a legal basis for every processing activity, and requires it to be honest. We do not use consent where consent would be a fiction: you cannot "withdraw consent" to your password being stored and still sign in. Where the basis is legitimate interests, it comes with the balancing test art. 10 requires and stays within what a reasonable person would expect from work software.

The table below is the complete map. Where your agency is the controller, the agency chooses the basis — we only carry it out.

SENSITIVE DATA (art. 11). The service does not ask for and does not need sensitive personal data: racial or ethnic origin, religious belief, political opinion, union membership, health, sex life, genetic or biometric data. Do not put that kind of data into the product. If you do it anyway, it is processed under your responsibility as controller and on whatever basis you hold — we assume none.

05 — Automated decisions and artificial intelligence

The numbers the product shows come from deterministic rules over your own data, never from a statistical model. We take no solely automated decisions that produce legal effects on you or otherwise affect your interests in the way LGPD art. 20 describes; if we ever do, you will have the review right that article grants, and this policy will say so first.

Two AI assist features are built into the product — classifying an inbound client message, and drafting wording you review before sending. They are switched off until we activate our AI provider, and no data of yours has been sent to any AI provider to date. The designated provider is Anthropic, already named in the sub-operator table of the Data Processing Agreement; it begins processing only when the features are switched on, under a data processing agreement, with no use of your data to train models.

The assist surface inside the product names the provider and says exactly what would be sent, before you use it. A suggestion is always yours to review — nothing the model produces is sent to a client or turned into a number without a person deciding it.

06 — Electronic signature: exactly what gets recorded

This section describes what the system records. The legal validity of the signature is dealt with in the Terms of Service, section 06.

The signer arrives through a link sent to the email address the agency named. The link is the credential: 32 random bytes, held here only as a SHA-256 hash, valid for 30 days, and bound to one document and one of the agency's portal addresses. Opened at any other address, the link opens nothing.

To sign, the person types their own name — the typed name is the signature; there is no drawn image — and ticks a consent box. The wording of that box is read from a catalog frozen on the server, in the organization's language, and is stored VERBATIM on the signer's row together with its version. We keep the whole sentence, not a version number, because a version number proves nothing if the catalog is edited afterwards.

At the same instant we record: the date and time from the server clock (never the browser's), the IP address, the browser identifier, the typed name and the signature style adopted. None of it comes from what the browser claims about itself: the actor of the event is derived from the link resolved on the server and cannot be supplied by the caller.

Every step (created, sent, viewed, signed, declined, completed, sealed) becomes a link in a hash chain: each link is the SHA-256 of the previous link plus the canonical content of the current one, bound to the organization and to the signature request. Inserting, removing or reordering an event breaks every hash after it. The head of the chain is stored on the request's row and printed inside the PDF itself.

At the end the document is sealed: a write-once PDF with an audit page, whose SHA-256 hash is recorded in the database and in the event log. Database triggers stop the seal, the hash or any signer's identity from being changed afterwards — for every database user, including us. Both parties receive the sealed PDF by email.

WHAT WE DO NOT DO: we verify nobody's civil identity. Attribution rests on control of the email address the link was sent to, plus the details captured above. Whoever controls that inbox can sign as that contact.

07 — Where the data lives, and international transfer (art. 33)

Tave's infrastructure sits outside Brazil: the application, the database and file storage run on Railway, in a United States and/or European Union region, and transactional email is sent by Resend in the United States. That is an international transfer of personal data, and we say so plainly rather than burying it in a list.

GROUNDS: LGPD art. 33, IX read with art. 7, V — the transfer is necessary to perform the contract you entered into with us, because that is where the service runs; and art. 33, II, "b" — standard contractual clauses in the form approved by ANPD Resolution CD/ANPD No. 19/2024, executed with each operator. No customer data enters a sub-operator before the matching transfer instrument is signed with it; that is a launch condition, not an intention.

We do not rely on consent for the transfer (art. 33, VIII), because it would be consent in name only: without the infrastructure there is no service.

Sitting outside Brazil does not take Brazilian law out of the picture. LGPD art. 3 and Marco Civil art. 11 keep national law applicable to processing carried out in Brazil, or aimed at offering a service to people in Brazil, even where the data is stored abroad. Brazilian law governs this policy.

08 — Who we share with

WE DO NOT SELL PERSONAL DATA. We do no processing for behavioural advertising, we build no profiles for third parties, and we never use your clients' data to offer them anything.

SUB-OPERATORS. A deliberately small set of providers processes data on our behalf, under contract, only on our instructions. Today there are two: Railway (hosting, database, files) and Resend (email delivery). They are listed with purpose, region and data involved on the Data Processing Agreement and sub-operators page. Providers foreseen for functions that do not exist in the product yet — the merchant-of-record billing, error monitoring, the AI provider — are not on that list and process nothing today; they join it, with 30 days' notice by email, before processing their first record.

AUTHORITIES. We give data to a public authority only where there is a legal basis for it. Application access records are given to third parties only under a court order, in the form of Marco Civil art. 10, §1, and we tell you about the request whenever the law allows.

SUCCESSION. In a corporate reorganization, merger or acquisition, data may pass to the successor — who is bound by this policy until a new one is announced with the same 30-day notice.

09 — Security (arts. 46 to 49)

The measures below are implemented and tested today, not planned. They are how we meet LGPD art. 46 and the record-keeping standards of Decree 8.771/2016.

Passwords hashed with argon2id at OWASP-recommended parameters; sign-in takes the same time for an existing and a non-existent account, so it does not reveal who has one. Session and sign-in-link tokens are 32 random bytes on the wire and only a SHA-256 hash at rest — a database leak returns no live credential. Session cookies are httpOnly, SameSite=Lax and Secure in production.

Tenant isolation enforced in the WHERE clause of every query, with relation identifiers checked on every write as well, proven by tests that interleave two organizations; reaching the unscoped database client is a lint error, not a convention.

An append-only event trail at two independent layers: the database role the application uses has no UPDATE or DELETE on the table, and a trigger refuses the operation even for the database owner. Signature evidence is protected by write-once triggers.

TLS required, with HSTS in production; a strict content security policy with a per-request nonce; a full set of security headers on every response; request bodies bounded at 1 MB before routing.

Rate limits on sign-in, signup, link requests and link consumption, keyed by email and IP. Automatic redaction of personal data in logs. Daily purge of dead tokens and sessions.

None of this makes a system invulnerable, and we are not going to write that it does. It makes failures harder and their consequences smaller.

10 — Security incidents (art. 48)

If a security incident occurs that may bring relevant risk or harm to data subjects, we notify the ANPD (Brazil's data protection authority) and the affected data subjects. The deadline we follow is the one in ANPD Resolution CD/ANPD No. 15/2024: within 3 (three) business days of becoming aware, with the information the regulation requires — the nature of the data, the data subjects involved, the technical protection measures in place, the risks, and what we did to reverse or reduce the effects.

Where the incident touches data for which YOUR agency is the controller, we notify YOU without undue delay, with what you need to meet your own deadline before the ANPD and before your clients. In that case the controller is the one who notifies the ANPD; we help with what we know.

Incident notices go to the organization owners' email and, where there is risk to data subjects who are not product users, by whatever means are reasonable to reach them.

11 — How long we keep things

The periods below are the ones configured, not the ones we would like to have.

Sign-in link tokens: deleted by a daily job 24 hours after expiry. The token itself lives 15 minutes.

Sessions: deleted by a daily job 30 days after they die (expired or revoked). A live session is untouched, whatever its age.

Organization data: kept while the organization exists; on closure, an export is offered, then a 30-day grace period, then permanent deletion.

Signature evidence (sealed PDF, audit chain, signer details): kept for the life of the organization, by design, because it is evidence. On closure, deletion passes a legal-retention check first — a signed contract is not a disposable record, and its retention period may outlast the account.

Application access records: kept confidentially, in a controlled environment, for the 6 (six) months required by Marco Civil art. 15, and disclosed to third parties only under a court order.

Waitlist and contact messages: kept while the conversation still makes sense, and deleted when you ask. It is a one-line request to privacy@usetave.com and needs no justification.

Tax and billing documents, once they exist: for the legal retention period, as a rule 5 years.

Deleted data also leaves the backups as their rotation cycle turns; while an old copy exists it stays under the same security measures and is used for nothing but restoration.

12 — Your rights (art. 18) and how to exercise them

As a data subject you have the right, on request, to: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or out-of-date data; anonymization, blocking or deletion of unnecessary or excessive data or data processed unlawfully; portability to another provider, subject to trade secrets; deletion of data processed on the basis of your consent; information about who we share the data with; information about the option not to give consent and what follows from that; and withdrawal of consent. You may also object to processing based on legitimate interests (art. 18, §2) and request review of an automated decision under art. 20 — we take none today.

HOW TO ASK. Write to privacy@usetave.com and say what you want. If we are unsure who is asking, we ask for identity confirmation proportionate to the request — we do not demand an ID document where replying from the registered address settles it.

DEADLINES (art. 19). We answer immediately in simplified form, or within 15 (fifteen) days in full form, with the clear and complete statement about origin, existence of records, criteria and purpose of the processing. It is free of charge.

WHEN WE CANNOT COMPLY. Some data cannot be deleted on request: what we must keep to meet a legal obligation (for example the access records of Marco Civil art. 15, and tax documents) and what constitutes the evidence of a signed document, whose retention rests on the regular exercise of rights (arts. 7, VI and 16, I and II). In those cases we tell you which data, on what basis, and for how long — we do not answer with "not possible".

COMPLAINTS. You may complain to the Autoridade Nacional de Proteção de Dados (gov.br/anpd), to consumer protection bodies, and to the courts. We would rather resolve it first, but the right is yours and does not depend on talking to us.

13 — If you are a client of an agency that uses Tave

You most likely arrived here from a proposal or signature link carrying the agency's brand. That is deliberate: the surface you see belongs to them, not to us.

THE AGENCY IS THE CONTROLLER OF YOUR DATA. They are who you ask for access, correction or deletion, and they are who answers for why your data is there. We are the operator and we help the agency answer you — technically as well, when they need it.

If you cannot work out who the agency is, or you get no answer, write to privacy@usetave.com: we forward the request to the controller and tell you that we did. What we will not do is decide about data that is not ours to decide about.

We never use your data to contact you on our own account, to sell anything, or for any purpose other than running the service the agency hired.

14 — Cookies

We use only strictly necessary cookies, which is why there is no cookie banner on this site — there is nothing for you to accept or refuse.

They are: the session cookie for someone signed into the product (httpOnly, SameSite=Lax, Secure in production, 30-day lifetime) and a language preference cookie, which holds only "en" or "pt" for the screens that do not carry the language in the URL.

There is no third-party cookie, no advertising pixel, no fingerprinting and no cross-site tracking of any kind. If that ever changes, it changes with notice and with a real choice — not with a banner whose only button says accept.

15 — Children and adolescents (art. 14)

Tave is a work tool for businesses and is not directed at anyone under 18. We do not knowingly collect data about children or adolescents and we do not offer them accounts.

If we learn that an account was created by a minor, or that a child's or adolescent's data entered the product without the legal basis of art. 14, we delete what can be deleted and tell the controlling agency. If you are a parent or guardian and believe this has happened, write to privacy@usetave.com.

16 — Changes to this policy

We may update this policy. A material change is announced by email to organization owners at least 30 (thirty) days before it takes effect, and the date at the top of this page always reflects the version in force.

A change that reduces your rights or widens what we do with your data never applies retroactively: processing already carried out stays governed by the version in force when it happened. Earlier versions are kept and sent on request to privacy@usetave.com.

17 — Language, governing law and contact

This policy is written in Brazilian Portuguese and governed by Brazilian law, in particular Law 13.709/2018 (LGPD), Law 12.965/2014 (Marco Civil da Internet) and Decree 8.771/2016.

THE PORTUGUESE VERSION IS THE ONE THAT GOVERNS. The English version is a courtesy translation; in case of any divergence between the two, the Portuguese text prevails.

Data protection officer (encarregado): privacy@usetave.com. Contractual matters: legal@usetave.com. Anything else: hello@usetave.com.