LGPD

1. What the LGPD is

The Lei Geral de Proteção de Dados (Lei 13.709/2018) is the Brazilian law governing the processing of personal data. It applies to any organisation that processes data in Brazil, or that offers goods and services to people in Brazil, regardless of where the organisation is based.

It defines two roles that matter for everything below: the controller, who decides why and how data is processed, and the operator, who processes it on the controller instructions.

2. Which role we play, and when

ScaleCodex is in a different position depending on the context, and this distinction is not cosmetic — it decides who you should contact about your data.

• This website — we are the controller. Details are in our privacy policy.
• Our own apps (Mais Gestão, Bíblia — Estude Mais, Aprova Cartões) — we are the controller. Each app has its own policy, linked from the project pages.
• Systems we build for clients — the client is the controller and we act as operator. We process the data only as instructed, and requests from data subjects go to the client, who is the one with the relationship to you.

3. The principles we build to

Article 6 of the LGPD sets out principles. These are the ones that change how a system is actually designed:

• Purpose and necessity — a field that has no stated use does not get collected. The cheapest data to protect is the data you never held.
• Transparency — the privacy policy describes what the software does, not what would be convenient to claim.
• Security — encryption in transit, sensitive fields encrypted at rest, access scoped to the least the job needs.
• Free access and correction — a user must be able to see and correct their data from inside the product, not by filing a request and waiting.
• Accountability — decisions about data are written down, so the reasoning can be shown rather than remembered.

4. Legal bases we rely on

Every processing operation needs a legal basis under article 7. In practice we use:

• Preliminary steps and performance of a contract — for enquiries through the contact form and for client work.
• Consent — for anything optional, requested separately and revocable at any time without breaking the product.
• Legitimate interest — narrowly, for security logs and fraud prevention, and never as a catch-all for whatever else we felt like doing.
• Legal obligation — for records we are required to keep, such as tax and accounting documents.

5. Your rights and how to use them

Article 18 gives you the right to confirmation of processing, access, correction, anonymisation or deletion of unnecessary data, portability, information about sharing, and revocation of consent.

To exercise any of them regarding this site or our own apps, write to sidneydasilva537@gmail.com and say which right you are exercising. We answer within 15 days.

If your request concerns a system we built for another company, we will tell you who the controller is so you can direct it to them — we are not allowed to act on their data on our own initiative.

6. Deletion in practice

Deletion means the data is removed, not hidden behind a flag. Where a backup still holds a copy, it expires with that backup rotation, and we will tell you how long that takes.

Some records survive deletion because the law requires it — tax documents, for example. When that happens we say which records, and why.

Every app we publish includes an in-app account deletion flow and a public deletion page, as Google Play requires. That is treated as a product feature, not a legal formality.

7. Data leaving Brazil

Some of the infrastructure we use operates outside Brazil — Vercel, Supabase, Google and Resend among them. Under articles 33 to 36, international transfers require an adequate basis, typically standard contractual clauses in the provider terms.

When a project requires that data stays in Brazil, we say so during scoping and select the region accordingly, rather than discovering the constraint after the system is built.

8. Technical and organisational measures

Article 46 requires appropriate security measures. On the projects we run, that means at minimum:

• TLS for everything in transit, and encryption at rest for sensitive fields;
• access by role, enforced on the server, with production credentials held by the fewest people possible;
• secrets in environment variables or a secret manager, never in a repository;
• anonymised or synthetic data in development environments wherever the real data is personal;
• logs that record who did what, and that do not themselves become a copy of the personal data.

9. If something goes wrong

Article 48 requires the controller to notify the ANPD and the affected people when an incident may create relevant risk or harm.

Where we are the controller, we do that. Where we are the operator for a client, we notify the client without delay and give them everything they need to make their own notification — scope, timeline, what was affected and what was done.

10. Who to contact

For anything related to data protection at ScaleCodex, including requests, questions and incident reports: sidneydasilva537@gmail.com.

You may also complain directly to the Autoridade Nacional de Proteção de Dados (ANPD), and you do not need to contact us first.

11. Changes to this page

This page is updated when our practices change. The date at the top shows when it last did.