This Privacy Policy explains how Waypoints ('we', 'us', or 'our') collects, uses, discloses, and safeguards your information when you use our desktop chat application, website, and related services (collectively, the 'Service'). We are committed to protecting your privacy and complying with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados, or LGPD - Law No. 13.709/2018) and other applicable data protection laws.
1. Data Controller
Waypoints is the data controller responsible for your personal data. For questions about your data, contact us at contato@waypoints.com.br.
2. Information We Collect
2.1 Information you provide
- Account information: username, display name, email address, and password (stored as a bcrypt hash).
- Profile content: avatar, status message, and any other profile details you choose to provide.
- Communication content: messages, voice data (transmitted in real-time, not stored unless you explicitly record a session), images, files, and other content you share through the Service.
- Server and community content: server names, channel names, roles, and configuration you create.
2.2 Information collected automatically
- Technical data: IP address, device type, operating system, app version, and connection timestamps.
- Usage data: servers joined, channels accessed, features used, and session duration.
- Local storage: your cookie consent preference and color theme choice are stored locally in your browser or device.
3. How We Use Your Information
We process your personal data for the following legitimate purposes under LGPD Article 7:
- To provide, operate, and maintain the Service, including authentication, message delivery, and voice communication.
- To enable real-time communication features: text chat, voice channels, video calls, and screen sharing.
- To create and manage your account, profile, and community servers.
- To diagnose technical issues, prevent abuse, and ensure the security of the Service.
- To send essential service notifications (security alerts, policy changes, account verification).
- To comply with legal obligations under Brazilian law and other applicable jurisdictions.
4. Legal Basis for Processing (LGPD Art. 7)
We process your personal data under the following legal bases as defined by the LGPD:
- Consent (Art. 7, I): For non-essential processing such as optional analytics, where you have given explicit, informed, and freely given consent.
- Contract performance (Art. 7, V): To fulfill our obligations under the Terms of Use and provide the Service you requested.
- Legitimate interest (Art. 7, IX): For security, fraud prevention, and service improvement, always balancing our interests with your fundamental rights.
- Legal obligation (Art. 7, II): To comply with applicable laws, court orders, and regulatory requirements.
5. Data Sharing and Third Parties
We do not sell your personal data. We do not share your data with advertising networks. We share data only in these limited circumstances:
- Service providers: Third-party infrastructure providers (hosting, voice relay servers) that help us deliver the Service, under contractual data protection obligations.
- Legal compliance: When required by law, court order, or legitimate request from competent authorities, in accordance with LGPD and applicable laws.
- Safety: When we believe disclosure is necessary to protect the rights, safety, or property of our users or the public.
- Business transfers: In the event of a merger, acquisition, or asset sale, we will notify you before transferring any personal data.
6. International Data Transfers
Your data may be processed on servers located outside Brazil. Where this occurs, we ensure such transfers comply with LGPD Articles 33-36, using adequate safeguards such as standard contractual clauses, and we will inform ANPD (Autoridade Nacional de Proteção de Dados) where required.
7. Data Retention
We retain your personal data only as long as necessary to fulfill the purposes described in this policy:
- Account data: Retained while your account is active. You may request deletion at any time, which will permanently remove your account and associated data within 30 days.
- Messages and content: Retained as long as the server or channel exists. Server owners can delete content at any time. Deleted content is permanently removed within 30 days.
- Technical and usage data: Retained for up to 12 months for security and diagnostic purposes.
- Voice data: Transmitted in real-time and not stored on our servers unless a session is explicitly recorded by a participant.
8. Your Rights Under LGPD (Art. 18)
As a data subject under Brazilian law, you have the following rights regarding your personal data:
- Confirmation of processing: Request confirmation that we are processing your data.
- Access: Obtain a copy of your personal data in a portable, structured, machine-readable format.
- Correction: Request correction of incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion: Request that we anonymize, block, or delete unnecessary, excessive, or unlawfully processed data.
- Portability: Request portability of your data to another service provider.
- Deletion: Request deletion of your personal data, subject to legal retention obligations.
- Information about sharing: Know which third parties have access to your data and for what purpose.
- Information about consent: Know what consent you have given and request withdrawal at any time.
- Revocation of consent: Withdraw consent at any time, without affecting the lawfulness of processing prior to withdrawal.
To exercise any of these rights, contact us at contato@waypoints.com.br. We will respond within 15 business days as required by LGPD.
9. Security Measures
We implement appropriate technical and organizational measures to protect your personal data, including: TLS encryption in transit, bcrypt password hashing, end-to-end encrypted direct messages, access controls, and regular security reviews. However, no method of transmission over the internet is 100% secure, and we cannot guarantee absolute security.
10. Children's Privacy
The Service is not directed to children under 13 (or the minimum age required by your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and, where appropriate, sending a notification within the app. The 'Last updated' date at the top reflects the most recent revision.
12. Contact Us
For questions, concerns, or requests regarding this Privacy Policy or your personal data, contact us at:
- Email: contato@waypoints.com.br
- ANPD complaints: You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD) through their official channels at www.gov.br/anpd.