Privacy Policy

Devora Cloud ("Devora", "we", "us", or "our") provides a platform-as-a-service that lets customers deploy and run applications in the cloud. Our infrastructure is hosted in the br-sao region (São Paulo, Brazil), we bill in Brazilian reais, and we also serve users located outside Brazil. For the personal data described in this policy, Devora acts as the data controller unless stated otherwise.

This policy applies to personal data we process about visitors to our website, people who register for and use our service, and those who contact our support or sales channels. It does not cover the personal data that our customers process about the end-users of the applications they deploy on our platform, which is addressed separately in the section on data of end-users of customer applications, nor does it cover third-party websites or services that we do not operate.

Account data. When you register and manage your account, we collect information such as your name, e-mail address, password (stored in hashed form), organization name, role, and account preferences, along with authentication data such as multi-factor settings and, where you use them, connections to external identity or repository providers.

Billing data. When you subscribe to a paid plan, we and our payment providers collect the information needed to process payments and issue invoices, such as billing name, contact details, tax identifiers where required, plan and transaction history, and a token or reference to your payment method. Full card numbers are handled by our payment processors and are not stored on our own systems.

Usage and telemetry data. As you use the service, we collect information about how the platform and your workloads are used, such as deployment events, resource consumption and metrics, feature usage, dashboard interactions, device and browser information, IP address, and approximate location derived from it. We use this to operate, secure, and improve the service.

Logs. Operating a cloud platform generates technical logs, including application and system logs, build and deployment logs, request metadata, and security and audit logs. These logs may contain personal data, including any personal data that appears in the content your applications emit, and we treat them as described in this policy.

Cookies and similar technologies. When you visit our website and dashboard, we and our providers use cookies and similar technologies to keep you signed in, remember preferences, secure sessions, and understand how the site is used, as detailed in the cookies section below.

Support and communications data. When you contact us for support, sales, or other matters, we collect the content of your messages and any attachments, along with contact details and records of our correspondence, so that we can respond and keep a history of the interaction.

We use personal data to provide and operate the service, including creating and managing your account, authenticating you, deploying and running your workloads, provisioning domains and certificates, and delivering the features you request. We also use it to process payments, prevent and detect fraud, and manage our billing and accounting.

We use personal data to maintain the security, integrity, and reliability of the platform, to monitor for and respond to abuse and incidents, to troubleshoot problems, and to analyze usage so that we can improve existing features and develop new ones. We use contact information to send you service-related communications, such as security alerts, billing notices, and important updates, and, where permitted and subject to your preferences, occasional product or marketing messages that you can opt out of at any time. Finally, we use personal data to comply with legal obligations and to establish, exercise, or defend legal claims.

Under the LGPD, we process personal data on the legal bases set out in Article 7, principally: the performance of a contract and preliminary procedures at your request (to provide the service you sign up for); compliance with a legal or regulatory obligation (such as tax and accounting duties); our legitimate interests, balanced against your rights and freedoms (such as securing the platform, preventing fraud, and improving the service); the regular exercise of rights in proceedings; and your consent, where we specifically ask for it, such as for certain cookies or optional communications.

For users protected by the GDPR, we rely on the corresponding bases in Article 6: performance of a contract, compliance with a legal obligation, our legitimate interests where they are not overridden by your interests or fundamental rights, and consent where applicable. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing carried out before the withdrawal, and where we rely on legitimate interests, you have the right to object as described in the section on your rights.

We use cookies and similar technologies such as local storage on our website and dashboard. Strictly necessary cookies keep you authenticated, maintain session security, and enable core functionality, and the site cannot work properly without them. Preference cookies remember choices such as language and interface settings, and analytics cookies help us understand how the site is used so we can improve it.

Depending on your location, we ask for your consent before setting non-essential cookies, and you can manage your choices through the consent controls we provide or through your browser settings. Blocking some cookies may affect the availability or functionality of parts of the service. Where cookies are provided by third parties, those providers process the related data under their own privacy terms in addition to this policy.

We do not sell your personal data. We share personal data only as needed to run the service and as described here. We share it with processors and sub-processors that perform functions on our behalf and under our instructions, including an underlying deployment and orchestration provider, payment processors, e-mail and communications providers, cloud infrastructure and connectivity suppliers, and analytics and support tooling providers. We keep such relationships under appropriate contractual safeguards and require these providers to protect personal data and use it only for the purposes we specify.

We may also share personal data when required to comply with the law, a court order, or a lawful request from a public authority; to protect the rights, safety, and property of Devora, our customers, or others; to enforce our Terms; and in connection with a merger, acquisition, financing, or sale of assets, in which case we will take steps to ensure that this policy continues to protect your personal data or that you are notified of any material change.

We host our infrastructure in the br-sao region (São Paulo, Brazil), but because we serve international users and rely on providers that may operate in other countries, personal data may be transferred to, stored in, or accessed from locations outside your country of residence. When we transfer personal data internationally, we do so in accordance with applicable law.

For transfers subject to the LGPD, we rely on the mechanisms permitted by Brazilian law, such as transfers to countries offering an adequate level of protection or the use of appropriate contractual guarantees. For transfers of personal data protected by the GDPR outside the European Economic Area, we rely on recognized safeguards, such as an adequacy decision or standard contractual clauses, together with any additional measures needed to protect the data. You may contact us for more information about the safeguards we use.

We retain personal data for as long as necessary to fulfill the purposes described in this policy, to provide the service to you, and to comply with our legal, tax, accounting, and regulatory obligations. Account and billing records are generally kept for the duration of your relationship with us and for the periods afterward required by law or reasonably needed to resolve disputes and enforce our agreements.

Operational data such as logs, metrics, and telemetry is retained for the periods appropriate to the purpose for which it was collected, which vary by data type and plan, after which it is deleted or aggregated so that it no longer identifies you. When personal data is no longer needed, we delete it or anonymize it in accordance with our retention practices and applicable law, unless a longer retention period is required or permitted by law.

We implement technical and organizational measures designed to protect personal data against unauthorized access, disclosure, alteration, and destruction. These measures include encryption of data in transit, access controls and the principle of least privilege, network segmentation, monitoring and logging, secure development practices, and regular review of our safeguards. We also restrict access to personal data to personnel and providers who need it to perform their roles.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. You play an important part in protecting your data by keeping your credentials confidential, enabling multi-factor authentication, and securing the applications and secrets you deploy on the platform. If you believe your account or data has been compromised, please contact us immediately at contato@devoracloud.com.

Subject to applicable law, you have rights over your personal data. Under the LGPD, these include the rights to confirmation of processing and access to your data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary or excessively processed data; portability of your data to another provider; deletion of data processed with your consent; information about the entities with which we have shared your data; information about the possibility of refusing consent and the consequences of doing so; and the withdrawal of consent. Under the GDPR, you have comparable rights, including access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interests, and the right not to be subject to solely automated decisions with significant effects.

To exercise any of these rights, contact us at contato@devoracloud.com. We may need to verify your identity before acting on a request, and we will respond within the timeframes required by applicable law. If you are the end-user of an application built by one of our customers, your request will usually need to be directed to that customer, who is the controller of your data, and we will support them as described below. You also have the right to lodge a complaint with a supervisory authority, such as the Brazilian National Data Protection Authority (ANPD) or, for users in the European Union, your local data protection authority.

The service is intended for businesses and professionals and is not directed to children. You must be at least 18 years old, or the age of majority in your jurisdiction, to create an account, and we do not knowingly collect personal data directly from children under this age through our own account services. Where the GDPR applies, we do not knowingly process the data of children below the applicable age of digital consent (which may be as low as 16, or lower depending on the member state) without appropriate authorization.

If you believe that a child has provided us with personal data in the context of our own services without appropriate consent, please contact us so that we can take appropriate steps to delete it. Responsibility for age-related compliance within applications that our customers build and operate on the platform rests with those customers.

When our customers deploy applications on Devora Cloud, those applications may collect and process personal data about their own end-users. In relation to that data, our customer is the data controller (or, under the GDPR, the controller) and determines the purposes and means of processing, while Devora acts as a data processor (operator) that processes the data on the customer's behalf and according to their instructions in order to provide the hosting and platform services.

As a processor, we process such end-user data only to deliver the service, to keep it secure, and as otherwise instructed by the customer or required by law. Customers are responsible for having a valid legal basis for their processing, for providing appropriate privacy notices to their end-users, and for responding to end-user rights requests. If you are the end-user of an application hosted on our platform and wish to exercise your rights, please contact the operator of that application directly; if you contact us, we will refer you to, or assist, the relevant customer.

We maintain procedures to detect, investigate, and respond to security incidents involving personal data. If a security incident occurs that is likely to result in a risk or relevant harm to affected individuals, we will notify the competent supervisory authority and affected individuals as required by, and within the timeframes set out in, applicable law, including the LGPD and, where relevant, the GDPR. Where we act as a processor for a customer's end-user data, we will notify the affected customer without undue delay so that they can meet their own notification obligations, and we will provide reasonable assistance in their response.

We may update this Privacy Policy from time to time to reflect changes in our practices, in the service, or in the law. When we make material changes, we will notify you through the dashboard, by e-mail, or by another reasonable means, and we will indicate when the policy was last revised. We encourage you to review this policy periodically, and your continued use of the service after an update takes effect indicates that you have taken note of the changes, without prejudice to any consent we are required to obtain.

If you have questions, requests, or concerns about this Privacy Policy or about how we handle personal data, or if you wish to exercise your rights, you can contact us and reach our data protection channel at contato@devoracloud.com. You can also find more information about our service on our website at devoracloud.com. We will handle your enquiry in accordance with applicable data protection law and aim to respond within a reasonable time.