1. Who controls this data
For processing described in this Policy under its responsibility, the controller is CODESPAR TECNOLOGIA LTDA, a Brazilian limited liability company registered under CNPJ 68.398.673/0001-85, with its registered office at Av. Brigadeiro Faria Lima, 1811, conj. 1119, Jardim Paulistano, Sao Paulo/SP, postal code 01452-001, Brazil.
For any privacy question, request, or complaint, contact privacy@codespar.dev.
When CodeSpar processes personal data on behalf of a customer under that customer's documented instructions, CodeSpar acts as a processor and the Data Processing Addendum applies. Some regulated providers, including Celcoin for BRL/Pix account services, may process personal data under their own legal and regulatory responsibilities.
2. What we collect
We may collect the following categories of personal data:
- Account data: name, work email, organization, role, authentication events, account settings, and user identifiers.
- Usage and telemetry data: API calls, tool-call metadata, request metadata, mandate and policy events, operational logs, security events, device and browser data, and diagnostics generated as you use the Service.
- Billing data: subscription, invoice, plan, tax, and payment information processed directly by us or through our billing providers. We do not store card numbers ourselves.
- Customer-provided data: data that customers submit to, configure in, or generate through the Service, including mandates, agent settings, policy rules, recipients, transaction metadata, receipts, audit trail entries, and support requests.
- Verification and compliance data: where applicable, identity, contact, registration, representatives, beneficial ownership, document, screening, KYC/KYB, sanctions, fraud prevention, and transaction data.
- Communications data: messages sent to support, legal, privacy, sales, or security contacts.
- Cookie and analytics data: data generated by essential cookies, site analytics, and performance tools as described below.
3. BRL/Pix accounts, verification and Celcoin
If you request BRL/Pix account features integrated with Celcoin, processing may include identity and contact data, CPF or CNPJ, registration documents, representatives and beneficial owners when required, data necessary for identity checks, account-opening records, transaction records, Pix keys or identifiers where applicable, fraud prevention signals, and compliance records. Information actually required will be presented during registration or feature activation.
Sensitive data, including biometrics if required by the flow, will depend on a specific purpose and legal basis disclosed to you.
These data may be used for registration, identity verification, account-opening support, service delivery, fraud prevention, security, transaction monitoring, support, legal and regulatory compliance, AML/CFT obligations, sanctions screening, dispute handling, and the exercise of rights.
Data necessary for the BRL/Pix account route may be shared with Celcoin Instituição de Pagamento S.A., CNPJ 13.935.893/0001-09, code 509, and with service providers involved in that route within their respective functions. Celcoin provides the regulated account and Pix services on this route and may process personal data under its own legal and regulatory responsibilities.
4. Why we process personal data
Where LGPD applies, we rely on the bases in LGPD articles 7 and 11, including performance of a contract, compliance with legal or regulatory obligations, legitimate interests, exercise of rights, fraud prevention and security, and consent where we ask for it.
Where GDPR applies, we rely on equivalent bases under GDPR article 6, including contract performance, legitimate interests, legal obligation, and consent where required. Where special-category data is processed, we use an applicable condition under GDPR article 9 or the corresponding law.
We process personal data to provide, secure, maintain, improve, bill, support, and document the Service; authenticate users; enforce mandates and policy controls; generate receipts and audit records; prevent fraud and abuse; comply with laws and provider requirements; respond to requests; and protect CodeSpar, customers, users, providers, and the public.
5. Sharing and recipients
We may share personal data with:
- service providers and subprocessors that host, secure, support, analyze, or help deliver the Service;
- authentication, infrastructure, analytics, billing, support, communications, and workspace providers;
- regulated payment, financial service, card, Open Finance, banking, Pix, foreign exchange, wallet, or settlement providers involved in a route you request or configure;
- Celcoin for enabled BRL/Pix account services, within the purposes described in this Policy and the applicable account flow;
- authorities, courts, regulators, law enforcement, payment schemes, participating institutions, or other authorized institutions when required or permitted by law, regulation, Pix rules, fraud prevention mechanisms, dispute handling, AML/CFT obligations, or valid legal process;
- professional advisers, auditors, insurers, and transaction counterparties where necessary for business, compliance, risk, financing, insurance, accounting, or legal purposes; and
- another party with your instruction or consent.
We do not sell personal data.
6. International transfers
Our processing may occur in Brazil, the United States, and other countries where CodeSpar, its providers, or subprocessors operate. Where we transfer personal data internationally, we use appropriate safeguards required by applicable law, which may include standard contractual clauses, contractual protections, adequacy mechanisms, risk assessments, or other lawful transfer mechanisms.
7. Your rights
If LGPD applies to you, you have the data-subject rights set out in LGPD, including confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, information about consent and its consequences, revocation of consent, and review of decisions where applicable.
If GDPR applies to you, you have equivalent GDPR rights, including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where processing is based on consent.
If you are a California resident, we provide the CCPA notice that you have the right to know, delete, and correct your personal information, and the right to portability.
To exercise rights, contact privacy@codespar.dev. Rights may be subject to identity verification, legal limits, trade secrets, security needs, the rights of others, and retention obligations. Where CodeSpar acts as a processor for a customer, we may direct your request to that customer or assist the customer in responding.
8. Retention
We keep personal data for as long as necessary for the purposes described in this Policy, including to provide the Service, maintain your account, comply with legal and regulatory obligations, resolve disputes, enforce agreements, maintain security, prevent fraud, support audits, and exercise rights.
Account data is generally kept for the life of your account plus any additional period required or permitted by law. Audit records, transaction metadata, receipts, payment records, security logs, and compliance records may be retained for financial-audit, tax, AML/CFT, fraud prevention, regulatory, dispute, and recordkeeping periods.
Registration, identity, verification, account-opening, and transaction data subject to AML/CFT, fraud prevention, Pix, account, tax, or other legal and regulatory obligations may be kept after account closure for the minimum period required or permitted by applicable law and regulation. These obligations may limit deletion requests.
9. Security
We use technical and organizational measures designed to protect personal data, including encryption in transit, encryption at rest, tenant isolation, access controls, logging, monitoring, and security review processes. No system is perfectly secure. You are responsible for protecting your credentials, API keys, users, agents, devices, and configurations.
10. Cookies and analytics
We use essential cookies required to run the site and keep you signed in. We may use analytics and performance tools, including Vercel Analytics and Vercel Speed Insights, to understand aggregate site usage and performance. These tools are configured for our own product analytics and performance monitoring, not third-party advertising.
If we add non-essential cookies or tracking technologies that require consent, we will present the applicable choices through the site or product flow.
11. Children
The Service is a developer platform and is not directed to children.
12. Contact and complaints
For any question about this Policy or to exercise privacy rights, contact privacy@codespar.dev.
If you are in Brazil and are not satisfied with our response, you may file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD). If you are elsewhere, you may file a complaint with your local data protection supervisory authority.