Privacy

Who processes the data

The controller of the personal data processed by My Stack is WRP Consultoria e Informática Ltda (Brazilian company registry CNPJ 66.300.125/0001-45), at R. Copaíba, Lote 01, Bloco B, Sala 408, Águas Claras, Brasília/DF, CEP 71919-540, Brazil, which also runs the other products listed in the footer. The channel for personal data matters is eu@wendelmaques.com; requests are answered by e-mail.

What this product keeps

• The private workspace stores the people and profiles you enter, health records, messages, documents, extracted text and pending suggestions. These can include sensitive health data. Account access identifies the workspace owner; Google sign-in does not import health data from Google.
• Navigation events help us improve the service. The report excludes health records, messages, documents and form values. It does not record the screen or replay your session.
• Account: e-mail, password, passkeys, sign-in codes and sessions are kept by the account system shared by our products, in its own database — this product keeps only the account id next to what is yours. Without an account, a signed guest token stored in your browser owns what you create; signing in moves it to your account.
• Pay-per-call payments (x402) settle on the Base network, which is public by design; here we keep the transaction reference and the amount for reconciliation and accounting.
• Prepaid credit: the token is stored only as a SHA-256 hash with its balance and movements; whoever holds the token holds the credit, and it cannot be recovered by e-mail.
• Contact: your message, the e-mail you give, the page you wrote from, the language of your browser and the network (IP) address go by e-mail, through our own mail server, to the controller's mailbox.

Sign in with Google

• When you choose Sign in with Google, you allow access to your Google account identifier, verified email and basic profile. The profile can include your name, given name, family name, photo, language and Google Workspace organisation domain.
• We use this data to identify your account, give you access and display your profile. We store the link and profile fields in the account system. Google confirms your identity. We do not receive your Google password.
• Sign-in requests only openid, email and profile. It does not give access to Gmail, Drive, Calendar, contacts or Search Console. Additional integrations request their own permission when you choose to connect them.
• Sign-in tokens are used on the server to check your identity. We do not keep access or refresh tokens from this sign-in to query other Google services.
• We do not sell data received from Google. We do not use it for personalised advertising or to train general artificial intelligence models. Internal access is limited to service operation, authorised support, security and legal obligations.
• We keep the link and profile while needed for your account. Unlinking Google prevents new access through that link. It does not delete your account, the imported profile, product data or required security and billing records.
• You can remove the connection in your Google Account settings at https://myaccount.google.com/connections. To request access, correction or deletion of data we keep, write to eu@wendelmaques.com. Include the product and account email. Do not send a password or token.
• Our use and transfer of information received from Google APIs follow the Google API Services User Data Policy, including its Limited Use requirements where applicable: https://developers.google.com/terms/api-services-user-data-policy.

For how long

• Workspace data stays until you delete it. Export and deletion are available in the product. Deleting the workspace does not close the account. Required security and budget records can remain.
• Sign-in codes expire within minutes; the account session ends when you sign out or when it expires.
• Per-network rate-limit counters (guest, contact, sign-in code) expire on their own within minutes or hours.
• Payment and credit records stay as long as accounting requires.
• Visit steps stay 7 days on the product server; the copy kept for analysis, without IP or account, stays on our data server.
• Web server records, with the IP address, are deleted within 15 days.

Infrastructure and third parties

• Servers we operate run the service and store your data. Cloudflare provides DNS only.
• Amazon Web Services (SES) sends the account e-mails, such as the sign-in code, the invitation and the alerts you turned on.
• Interface libraries (Bootstrap) are served from the product's own domain, not from a third-party CDN.
• There is no Google Analytics and no advertising tracker.
• PayAI (x402 facilitator) verifies and settles payments on the Base network; the paying wallet is yours, and its address is public on-chain.
• Asaas Gestão Financeira Instituição de Pagamentos S.A. processes payments in Brazilian reais (Pix, boleto and card) and receives the payer's name, CPF or CNPJ and e-mail to issue and check the charge.
• In the product's card forms, card and billing details pass through our API to Asaas. This includes the postal code, address number, phone and buyer's IP address. We do not store the card number or security code.
• When you authorise an AI reply, the configured provider receives the conversation context, selected records and readable documents. Document text extraction sends the authorised file to Mistral. These are separate permissions from Google sign-in. Providers may process this data outside Brazil.

Cookies and browser storage

• When you sign in, the account session lives in an HttpOnly cookie on this domain; without an account, the guest token stays in your browser and identifies what you created.
• Screen preferences (theme, filters) stay in the browser's local storage and never leave it.
• To improve the path through the product, we measure page views, clicks on controls and purchase steps. We keep a random identifier and the session in your browser. These events contain no typed text, page content, IP, e-mail or account data. Global Privacy Control or "Do Not Track" disables this collection.
• There is no advertising cookie and no cross-site tracking.

IP address

To limit abuse, the IP address goes into a hash with a secret salt. The approximate country and city come from a geolocation database (MaxMind GeoLite2) on our server. This lookup does not send the address to third parties. Card payments send the IP address to Asaas to validate the payment. The raw IP is not kept in the product's databases: it appears only in the contact e-mail and in the web server records, deleted within 15 days.

Your rights

You can request access, correction or deletion of what exists about you by writing to eu@wendelmaques.com. We answer within the terms of the Brazilian data protection law (LGPD) and, where it applies, the GDPR. Data from public sources (official registries) stays at the source; only the copy here is removed.