Privacy Policy — Horae Track
Last updated: [PUBLICATION DATE]
Draft version: 2026-10-02
⚠️ DRAFT — not reviewed by legal counsel; do not publish. Draft prepared for legal review. Contains bracketed placeholders to be filled in. See README.md in this folder for the complete placeholder list and attention points.
Contents
- 1. Introduction and Scope
- 2. Controller, Processor, and Data Protection Officer (DPO)
- 3. Data Processed and Purposes
- 4. Legal Bases
- 5. Cookies and Similar Technologies
- 6. Data Sharing and Subprocessors
- 7. International Data Transfers
- 8. Data Retention
- 9. Information Security
- 10. Data Subject Rights
- 11. Children's Data
- 12. Security Incidents
- 13. Changes to This Policy
- 14. California Residents Notice (CCPA/CPRA)
- 15. Contact
1. Introduction and Scope #
1.1. This Privacy Policy ("Policy") describes how [PROVIDER LEGAL NAME] ("Horae", "we"), operator of the Horae Track platform (https://horaetrack.app and https://web.horaetrack.app), processes personal data in the context of the corporate website (landing page) and the Service application.
1.2. This Policy applies to: (a) visitors of https://horaetrack.app; (b) contact persons of companies interested in the Service; (c) Authorized Users of customer companies ("Customers") who use the https://web.horaetrack.app application; and (d) representatives of the Customers themselves for registration and billing purposes.
1.3. This Policy should be read together with the Terms of Service and, where applicable, the Data Processing Agreement.
2. Controller, Processor, and Data Protection Officer (DPO) #
2.1. Controller of Customer registration/billing data and of website visitor data: for data provided directly by the Customer during registration, for billing data, and for visitor/lead data on the corporate website, Horae acts as Controller, under Article 5(VI) of the LGPD and, where applicable, Article 4(7) of the GDPR.
2.2. Processor of Customer Data entered through use of the Service: for data entered by Authorized Users in day-to-day use of the Service (time entries, activity descriptions, amounts, invoices, registration data of other Authorized Users), Horae acts as Processor, under Article 5(VII) of the LGPD and Article 4(8) of the GDPR, acting on the Customer's instructions; the Customer is the Controller of that data with respect to its own employees/contractors. This relationship is detailed in the Data Processing Agreement.
2.3. Data Protection Officer (DPO): [DPO NAME], reachable at [DPO EMAIL — proposed: [email protected]].
3. Data Processed and Purposes #
| Data category | Examples | Purpose | Horae's role |
|---|---|---|---|
| Customer registration data | Company name, tax ID, address, Owner data (name, email) | Create and manage the Account; issue billing | Controller |
| Authentication data | Email, Auth0 identifier, login metadata | Authenticate access to the Service | Controller (authentication) / Auth0 as subprocessor |
| Billing data | Payment/card data (processed by Stripe, not stored by Horae), invoice history | Process payments, issue receipts/invoices | Controller, with Stripe as subprocessor |
| Service usage data (Customer Data) | Time entries, activity descriptions, approvals, closings, amounts, contractor invoices, name/email of invited Authorized Users | Provide the Service's features to the Customer | Processor (on the Customer's instructions) |
| Transactional communication data | Email, content of invitations and notices (trial, billing, approval) | Send invitations, operational, trial, and billing notices | Processor/Controller as applicable, with Resend as subprocessor |
| Corporate website browsing data | Page visited, language, click event (no persistent identifier/cookie) | Aggregate usage metrics for the landing page (Umami, self-hosted, no cookies) | Controller |
| Contact form/waitlist data | Name, email, message | Respond to contact, manage waitlist | Controller |
4. Legal Bases #
The table below maps the LGPD and GDPR legal bases applicable to each processing purpose.
| Purpose | LGPD (Art. 7) | GDPR (Art. 6) |
|---|---|---|
| Performance of the agreement with the Customer (Service provision, billing) | Item V — contract performance | Art. 6(1)(b) — contract performance |
| Account authentication and security | Item V / Item IX — legitimate interest (security) | Art. 6(1)(b) / Art. 6(1)(f) — legitimate interest |
| Compliance with a legal or regulatory obligation (e.g., tax) | Item II — compliance with legal obligation | Art. 6(1)(c) — legal obligation |
| Sending operational, trial, and billing notices | Item V — contract performance | Art. 6(1)(b) — contract performance |
| Aggregate, anonymous website metrics | Item IX — legitimate interest | Art. 6(1)(f) — legitimate interest |
| Responding to contact/waitlist | Item V or Item I — consent, as applicable | Art. 6(1)(a) or 6(1)(b) |
| Direct marketing (where applicable, with opt-out) | Item IX — legitimate interest | Art. 6(1)(f) — legitimate interest |
4.1. Where the legal basis is consent, it may be withdrawn at any time, without affecting the lawfulness of processing carried out before withdrawal.
5. Cookies and Similar Technologies #
5.1. Corporate website (landing page): does not use tracking cookies or third-party analytics cookies. Usage metrics are collected through Umami, a self-hosted analytics tool (hosted on the Provider's own infrastructure), which does not use cookies or persistent identifiers, collecting only aggregate and anonymous data (page, language, click events).
5.2. Service application (`web.horaetrack.app`): uses only strictly necessary cookies/local storage for operation (e.g., maintaining an authenticated session via Auth0); there are no third-party advertising or behavioral tracking cookies.
5.3. As there are no non-essential cookies, no cookie consent banner is displayed, consistent with the principle that such a banner is required only when non-essential identifiers are collected.
6. Data Sharing and Subprocessors #
6.1. Horae shares personal data with the following subprocessors and partners, strictly to the extent necessary to provide the Service:
| Subprocessor | Purpose | Data involved | Country/Region |
|---|---|---|---|
| Auth0 (Okta) | Authentication and identity management | Email, user identifier, login metadata | United States |
| Stripe | Payment processing and recurring billing | Payment data, invoice history, billing email | United States / Ireland |
| Resend | Transactional email delivery (invitations, notices, notifications) | Email, name, notification content | United States |
| Cloudflare | CDN, reverse proxy, and protection (WAF) | IP address, HTTP request metadata | Global (distributed network) |
| Microsoft Azure — Key Vault | Custody of the encryption key that protects fields of Customer Data (key management) | Cryptographic key material and key-wrapping calls only; it does not store Customer Data or readable personal data | [REGION TO BE CONFIRMED] |
| Microsoft Azure — Application Insights | Technical telemetry on application operation and performance | Technical operating data (e.g., routes, response times, errors), subjected to automatic removal of personal data before sending; personal data is not intended to be sent | [REGION TO BE CONFIRMED] |
6.2. Hosting, database, and files: the application, database, and files (e.g., invoice PDFs, company logos) are hosted in two phases:
(a) open beta phase: on Horae's own server, located in Brazil; during this phase, no public cloud provider hosts this data. The external infrastructure services used during this phase are only those listed in Clause 6.1 (including Azure Key Vault and Azure Application Insights, within the limits described there);
(b) commercial launch: Horae intends to migrate the platform (application, database, and files) to a corporate cloud provider, to be chosen between Microsoft Azure and Amazon Web Services (AWS). The provider and the hosting region have not yet been decided;
(c) prior notice: before carrying out the migration, Horae will notify the Owner of each Customer, by email and/or by a prominent notice in the Service, with [NOTICE PERIOD TO BE DEFINED BY COUNSEL] advance notice, and will update this Policy to identify the provider, the region, and the applicable safeguards;
(d) if the chosen provider or region is outside Brazil, Clause 7.4 applies.
6.3. Horae may additionally share personal data: (a) with public authorities, pursuant to a court order or valid legal request; (b) in the event of a corporate reorganization (merger, acquisition), with due notice; (c) with technical support service providers, under a contractual confidentiality and security obligation equivalent to this Policy.
6.4. Horae does not sell personal data to third parties.
7. International Data Transfers #
7.1. The subprocessors listed in Clause 6.1 are located in, or process data outside, Brazil (United States). These international transfers are carried out on the basis of Article 33 of the LGPD, through: (a) standard contractual clauses equivalent to those approved by Brazil's National Data Protection Authority (ANPD), under ANPD Resolution CD/ANPD No. 19/2024; and/or (b) contractual guarantees of an adequate level of protection executed with each subprocessor.
7.2. For Customers subject to the GDPR/UK GDPR, transfers of personal data outside the European Economic Area/United Kingdom are carried out on the basis of GDPR Chapter V, through the European Commission's Standard Contractual Clauses (SCCs) (or the UK ICO's International Data Transfer Addendum, as applicable), executed with the relevant subprocessors, supplemented by a transfer impact assessment where required.
7.3. Further details on the international transfer safeguards applicable to a specific Customer may be requested from the DPO (Clause 2.3).
7.4. If, upon the migration described in Clause 6.2(b), the data hosted on the platform comes to be stored or processed outside Brazil, the corresponding international transfer must comply with Article 33 of the LGPD and ANPD Resolution CD/ANPD No. 19/2024, with the transfer mechanism to be adopted [MECHANISM TO BE DEFINED — PENDING LEGAL OPINION], and this Policy will be updated before the migration. If the chosen region is in Brazil, no such transfer will arise from the hosting.
8. Data Retention #
8.1. Customer registration and billing data is retained for the full term of the Account and for the additional period necessary to comply with legal obligations (e.g., tax, civil), subject to applicable statutes of limitation.
8.2. Customer Data (Service usage data) is retained for the term of the Account and, after termination, for the retention period described in Clause 7.3 of the Terms of Service (proposed: 90 days), after which it may be deleted, subject to legal retention obligations.
8.3. Corporate website contact/waitlist data is retained for as long as necessary for the contact purpose, or until the data subject requests deletion.
9. Information Security #
9.1. Horae adopts reasonable technical and administrative measures to protect personal data, including, to the extent applicable to the Service's current stage:
(a) encryption in transit (HTTPS/TLS) across all client-server communications;
(b) role-based access control (owner, manager, finance, contractor) and authentication via Auth0;
(c) firewall and attack protection (WAF) via Cloudflare;
(d) backup routines for the database and stored files.
9.2. No system is absolutely secure. Horae does not guarantee absolute protection against every possible incident, but commits to adopting measures proportional to the risk and to following the incident response procedure described in Clause 12.
9.3. [Note to counsel/product: this clause must remain strictly aligned with what actually exists in production — do not describe certifications, encryption at rest, or controls that have not yet been implemented.]
10. Data Subject Rights #
10.1. Under the LGPD (Art. 18) and, where applicable, the GDPR (Arts. 15–22), data subjects may request:
(a) confirmation of the existence of processing;
(b) access to the data;
(c) correction of incomplete, inaccurate, or outdated data;
(d) anonymization, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
(e) portability of data to another service provider;
(f) deletion of data processed on the basis of consent;
(g) information about entities with which the data has been shared;
(h) withdrawal of consent, where that is the applicable legal basis;
(i) objection to processing based on legitimate interest, where applicable;
(j) review of automated decisions, where applicable.
10.2. Requests may be sent to [DPO EMAIL]. Horae will respond within 15 (fifteen) days, a period that may be extended once for an equal period with justification, consistent with the LGPD's reference timeframe. For GDPR-covered requests, Horae will respond within one month, extendable as permitted under Article 12(3) of the GDPR.
10.3. Where the data subject is an Authorized User of a Customer and the data at issue is Customer Data processed by Horae as Processor, the request may be directed to the Customer itself (Controller) or to Horae, which will forward it to the Customer when appropriate, under the Data Processing Agreement.
11. Children's Data #
11.1. The Service is intended for business (B2B) use by adult professionals in the course of employment or service provision, and is not directed at children or minors. Horae does not knowingly collect data from individuals under 18.
11.2. If the inadvertent collection of a minor's data is identified, Horae will take steps to delete such data, upon contact through the channel in Clause 10.2.
12. Security Incidents #
12.1. In the event of a security incident that may pose a relevant risk or harm to data subjects, Horae will: (a) take measures to contain and remediate the incident; (b) notify Brazil's National Data Protection Authority (ANPD) and affected data subjects within a reasonable period, under Article 48 of the LGPD, when the incident poses a relevant risk or harm; (c) where applicable to Customers subject to the GDPR, notify the competent data protection authority within 72 (seventy-two) hours of becoming aware of the incident, under Article 33 of the GDPR.
12.2. Customers acting as Controllers of Customer Data will be notified by Horae within a timeframe consistent with the Data Processing Agreement (proposed: 48 hours), so they can meet their own notification obligations.
13. Changes to This Policy #
13.1. This Policy may be updated periodically. Material changes will be communicated by email to the Customer's Owner and/or by a prominent notice within the Service, indicating the effective date.
14. California Residents Notice (CCPA/CPRA) #
14.1. If Horae processes personal data of California (United States) residents as a "business" under the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA/CPRA"), such data subjects may have the right to: (a) know which categories of personal data are collected and for what purposes; (b) request access to and a copy of the data; (c) request deletion of personal data, in the legally permitted circumstances; (d) request correction of inaccurate data; (e) opt out of having their data "sold" or "shared" (Horae states that it does not sell or share personal data for cross-context behavioral advertising purposes, as defined under the CCPA/CPRA); and (f) not suffer discriminatory treatment for exercising these rights.
14.2. Requests from California residents may be sent through the same channel as Clause 10.2.
15. Contact #
To exercise data subject rights, or for questions about this document or about personal data processing, contact:
Data Protection Officer (DPO): [DPO NAME]
Email: [DPO EMAIL]
General contact: [email protected]
[PROVIDER LEGAL NAME]
CNPJ: [CNPJ]
Address: [FULL REGISTERED ADDRESS]