Privacy Policy

1. Introduction

At Pausa we value your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, which subprocessors we share it with, how long we retain it, and what your rights are as the data subject.

2. Information we collect

We collect the following information when you use our platform:

• Authentication information: when you authenticate with Google or Microsoft, we obtain access to your email address and other basic profile information (such as your name and photo).
• Calendar events (read): with your permission, we access and store the events in your Google or Microsoft calendars to process them and provide you with visualizations and analysis.
• Calendar events (write): if you additionally grant the Google Calendar write permission (optional, separate from the read permission and requested separately), Pausa can create, edit, and delete events on your Google Calendar on your behalf, only when you perform those actions from the platform (for example, when creating a task, moving its time, adding guests or a video-call link, or deleting it).
• Survey responses: we collect your responses to the surveys linked to imported events.
• Usage information: we collect platform usage data, including interactions and usage statistics.

Pausa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. Use of information

We use the information we collect for the following purposes:

• To authenticate users and allow access to the platform.
• To process and analyze calendar events in order to provide visualizations and statistics.
• To create, edit, and delete events on your Google Calendar when you choose to do so from Pausa, only if you granted the write permission.
• To improve and optimize our platform based on usage patterns.

4. Data storage and retention

Your data is stored securely on servers located in Brazil (southamerica-east1 region, São Paulo), in compliance with industry security standards. We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or alteration.

Retention periods:

• Active user data: retained for as long as the account remains active. This processing is necessary to provide the service while the account is active.
• Post-cancellation data: 30 days from cancellation. Once this period has elapsed, personal data is anonymized.
• Database backups: 30 days, with automatic purging. Backups are inaccessible from outside during this period.
• Operational logs: 30 days. Includes platform access and operation logs.
• Privacy logs: 2 years. Includes deletion confirmations and exercise of rights, retained for regulatory accountability.

5. Subprocessors

To operate the platform we use the following subprocessors, all of them subject to data processing agreements and confidentiality obligations:

• Google Cloud — Infrastructure: API, database, and frontend. Location: southamerica-east1, São Paulo, Brazil.
• OpenAI — Classification of calendar events into MacroTareas (broad activity categories) and schedule-load analysis. Location: United States.
• n8n Cloud — Automation pipeline: sends calendar data to OpenAI for schedule-load analysis. Location: United States.
• PostHog — Platform usage analytics, with no access to calendar data. Location: us.i.posthog.com, United States.

Calendar data and personal data are stored exclusively on servers in Brazil (southamerica-east1). OpenAI and n8n process calendar data in the United States solely for the purpose of MacroTareas classification and schedule-load analysis; they do not store it or use it for any other purpose. PostHog receives only platform usage data, with no access to calendar data.

6. Sharing information

We do not share your personal data with third parties, except in the following cases:

• When necessary to comply with a legal obligation.
• With the subprocessors listed in the previous section, subject to contracts that require them to protect the confidentiality of your data.

7. User rights

Depending on your location, you may have the following rights over your data:

• Access the personal data we hold about you.
• Request the correction of inaccurate data.
• Request the deletion of your personal data.
• Object to the processing of your data in certain cases.
• Request the portability of your data in a structured format.

To exercise any of these rights, contact us at soporte@pausaco.com.

8. Legal basis for processing (LGPD)

For users in Brazil, the processing of personal data carried out by Pausa is based on the following legal grounds under the LGPD (Brazil's General Data Protection Law, Law No. 13.709/2018):

• Contract performance (Art. 7, II LGPD): the processing of calendar and profile data is necessary to provide the contracted service.
• Legitimate interest (Art. 7, IX LGPD): usage and analytics data is processed to improve the service, respecting the data subject's right to opt out.

9. International data transfers

Some subprocessors (OpenAI, n8n, and PostHog) are located in the United States. International transfers are carried out with appropriate protection safeguards in accordance with:

• Art. 33 of the LGPD, for users in Brazil.
• Argentina's Law No. 25,326 on Personal Data Protection, for users in Argentina.

10. Security

We implement technical and organizational security measures to protect your personal data, including AES-256 encryption at rest, TLS 1.2+ in transit, strict access controls, and separation of development, staging, and production environments. The full detail — including the IT admin configuration guide — is on our Security and privacy page.

11. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time. We will notify you of any material changes through the platform or by email.

12. Contact

If you have any questions or concerns about this Privacy Policy, you can contact us at soporte@pausaco.com.