Security
LGPD
The Lei Geral de Proteção de Dados is the law we answer to. nulvless is a Brazilian company, registered in Brazil, and the ANPD is our supervisory authority — so where other vendors treat the LGPD as a foreign requirement to accommodate, it is our home ground.
It mirrors the GDPR closely on roles: you are the controller of your end users’ data, we are the operator. Where it differs is in the detail, and the detail below is what differs.
What we carry
- Processing on your instruction only
- The Terms, this addendum, what you set in the Console and the calls you make to the API are the instruction. Nothing is processed for another purpose.
- A channel for data subjects
- Article 41 requires a published point of contact. Ours is [email protected], named in the Privacy Policy along with the ANPD as the authority to complain to.
- A transfer mechanism that fits article 33
- Our database runs in the United States and our fallback email sender is in Singapore. Both are named in the sub-processor list, and the mechanism article 33 permits is applied to each.
- Notice before a sub-processor changes
- Thirty days, with the right to object — the same commitment we make under the GDPR, because the list is the same list.
What stays with you
- The legal basis under article 7
- Consent, contract performance, legitimate interest and the rest are yours to choose and to document.
- Your own data subject requests
- Your users go to you. The fifteen-day deadline runs against you as controller, and the Console gives you what you need to meet it.
- Children and adolescents
- If your product is used by children, article 14 puts specific consent requirements on you. We cannot know your audience; you do.
Where this is binding
The ANPD has no certification programme. Compliance here is demonstrated by documents and by what the system actually does, which is what this page and the ones it links to are for.