Privacy Policy

1. Data controller

The data controller for all Sostratus products and the sostratus.app website is:

52.946.146 Hugo Vinicios Rodrigues Candido
CNPJ: 52.946.146/0001-28
R. Hercílio da Costa Viana, N 0, Conjunto Vila Maria
Lagoa Santa/MG — CEP 33.230-816 — Brazil
Email: hello@sostratus.app

2. Data collected on this website

The sostratus.app institutional website collects only:

• Technical data: IP address, browser type, device, and OS via standard server logs
• Contact data: name and email if you reach out via our contact email

No purchases are made on this domain. For data collected during product purchases, see each product's Privacy Policy.

3. Data collected across product domains

Across all Sostratus product domains, the following data may be collected:

• Identity: name and email provided at checkout
• Payment: processed exclusively by Stripe — Sostratus never stores card details
• Access: login credentials and session activity within each app
• Usage: pages visited, progress, and features accessed
• Technical: IP address, browser type, device, and OS

4. Purpose of data processing

• Processing and confirming purchases
• Delivering and managing product access
• Sending transactional emails (confirmation, access expiration)
• Providing customer support
• Improving product quality and user experience
• Complying with Brazilian tax law (LGPD, Receita Federal)

Sostratus does not sell, rent, or share personal data with third parties for marketing purposes.

5. Third-party processors

• Stripe — payment processing · stripe.com/privacy
• Vercel — hosting and global content delivery
• Email provider — transactional email delivery

Each processor is bound by data processing agreements and may not use your data beyond the services they provide to Sostratus.

6. Cookies

Sostratus uses essential cookies only — required for login sessions and basic app functionality. No tracking, advertising, or third-party analytics cookies are used.

7. Data retention

Personal data is retained while an account is active and for up to 5 years after account closure, as required by Brazilian tax law. Deletion requests are processed within 15 business days, subject to legal retention requirements.

8. Your rights (LGPD & GDPR)

You have the right to access, correct, delete, port, or object to the processing of your personal data. To exercise any right, email hello@sostratus.app. We respond within 15 business days.

These rights apply under Brazilian LGPD and, where applicable, European GDPR (Article 6(1)(b) — contract fulfillment).

9. International data transfers

Your data may be processed outside Brazil by our third-party service providers under appropriate data protection safeguards, including standard contractual clauses where required.

10. Changes to this policy

Material changes will be communicated by email at least 15 days before taking effect. The current version is always available at sostratus.app/privacy.