Privacy Notice

Who controls the data

Cotarpreco processes personal data to operate the quote platform, authentication, support, security, and transactional communications. The channel for data subject and privacy requests is [email protected].

Data processed

• Account: email, language, verification status, and Google authentication identifier when used.
• SaaS operation: products, categories, quotes, supplier responses, supplier contact details, items, form links, notes, subscription status, and notifications entered by the user.
• Subscription and billing: selected plan, subscription status, checkout identifiers, payment events, invoices, cancellations, and refunds processed by the payment provider.
• Support: chat messages, human support tickets, and automated satisfaction assessments.
• Security: essential session/language cookies, technical error records, and identifiers needed to protect the account.
• Recent access: a random browser identifier is stored as a hash to group and display recently used devices.

Purposes and legal bases

• Perform the contract and provide the SaaS features.
• Comply with legal and regulatory obligations where applicable.
• Prevent fraud, abuse, unauthorized access, and security incidents.
• Respond to support requests and transactional communications.
• Manage subscriptions, billing, receipts, fraud prevention, cancellations, chargebacks, and refunds.

Sharing

Data may be processed by providers required for operation, such as database/Redis infrastructure, transactional account email, Google OAuth, OpenAI API for chat answers, and Asaas for checkout, billing, subscriptions, and refunds. Cotarpreco does not store full card details. The chat sends the user's message, recent history, and a compact summary of recent records needed to provide support; avoid entering sensitive data or third-party data that is not necessary.

Retention

Remote chat history is kept for up to 7 days; technical logs now have operational retention of up to 180 days. Recent devices remain registered while the account is active or until replaced by more recent accesses. Account, records, subscription, and billing data remain while the account is active or for the period required for legal obligations, regular exercise of rights, audit, fraud prevention, and security.

Data subject rights

You may request confirmation of processing, access, correction, portability, information about sharing, withdrawal of consent where applicable, and deletion of data, subject to lawful retention cases. Authenticated users also have export and account deletion endpoints.

Security

The platform uses password hashing, essential cookies with HTTPOnly/SameSite protection, email verification, user access control, rate limiting, and security headers. No measure is absolute; incidents with relevant risk or harm will be assessed and communicated according to LGPD and ANPD regulation.