Privacy Policy

Account data

We store your email address and an internal account identifier. Sign-in works through a link sent by email; we do not store a password.

Purchase data

We store the email used for the purchase, the product, the amount, the currency, the payment method (card or Pix) and the Stripe transaction identifiers.

Card details do NOT pass through our servers and are not stored by us: payment happens inside the Stripe checkout.

Licence and activation data

For each activated computer we store a device identifier, the name reported by the operating system (for example "DESKTOP-A1B2 (win32)"), the extension version, the activation date and the last-seen date. This is what lets the panel show your computers and enforce the seat limit.

The access code is stored encrypted. It is only decrypted when you ask to reveal it in the panel, and each reveal is logged.

Operation logs

We log activation, revalidation and deactivation operations with their result. These logs do NOT contain the access code, the device identifier or the IP address.

We also log sensitive account actions — revealing a code, releasing a computer, opening the billing portal — so there is a starting point if unauthorised access is ever suspected.

IP address

The IP address is used transiently to throttle repeated attempts and contain abuse, and it appears in hosting technical logs. It is not written to the licence tables.

When you open the site without a language in the address, the host tells us the country the visit comes from, derived from the IP, and we use only that country to open the site in the language of that region. The country is not stored.

Why we process this data

• Performing the contract: delivering the purchased licence, keeping it valid and enabling downloads (LGPD art. 7, V).
• Legitimate interest: preventing use beyond the purchased seats, containing fraud and abuse (art. 7, IX).
• Legal and tax obligation: keeping records of sales (art. 7, II).

Who we share with

We share only with the providers that operate parts of the service, and only what each function requires:

• Stripe — payments, subscriptions, refunds and the billing portal.
• Supabase — authentication, database and storage of the installer files.
• Vercel — website hosting, plus aggregated audience and performance metrics.
• Upstash — attempt counting for rate limiting.
• Resend — sending the licence delivery emails.

What we do not do

We do not sell personal data, do not release it for advertising and do not build behavioural profiles for ads.

International transfer

The providers above keep servers outside Brazil. Transfers rely on the contractual safeguards each of them offers, under art. 33 of the LGPD.

How long we keep it

• Account, licence and activations: for as long as the account exists.
• Purchase records: for the period required by tax and consumer protection law.
• Operation and audit logs: for as long as needed to investigate abuse and to support chargeback disputes.

If you delete your account

Deleting the account unlinks you from your licences, but the purchased licence is not erased: it is held against the purchase email. If you create the account again with the same email, it comes back automatically.

This is deliberate — erasing the licence along with the account would mean losing what was paid for because of one click.

Your rights

Under art. 18 of the LGPD you may request confirmation of processing, access, correction, anonymisation or deletion, portability, and information about who we share data with.

Write to threshold.editor@gmail.com from the account email. We respond within 15 days.

Some data cannot be deleted on request while a legal retention duty applies — the tax record of a sale, for example. Where that is the case, we say which duty applies.

Cookies

We use a session cookie to keep you signed in. It is essential: without it there is no account area.

Vercel audience and performance metrics are aggregated and do not use a cookie to identify visitors.

Children

The products are sold to people over 18. We do not knowingly collect data from children.

Changes to this policy

If collection or sharing changes materially, we update the effective date at the top of this page.