Privacy Policy

1. Introduction

At PausaCo we value your privacy and are committed to protecting your personal data. This Privacy Policy explains what data we collect, how we use it, which sub-processors we share it with, how long we retain it, and what your rights are as the data subject.

2. Information we collect

We collect the following information when you use our platform:

• Authentication information: when you authenticate with Google or Microsoft, we obtain access to your email address and other basic profile information (such as your name and photo).
• Calendar events: with your permission, we access and store the events from your Google or Microsoft calendars in order to process them and provide you with visualizations and analysis.
• Survey responses: we collect your responses to the surveys linked to imported events.
• Usage information: we collect platform usage data, including interactions and usage statistics.

3. Use of information

We use the information collected for the following purposes:

• Authenticating users and enabling access to the platform.
• Processing and analyzing calendar events to provide visualizations and statistics.
• Improving and optimizing our platform based on usage patterns.

4. Data storage and retention

Your data is stored securely on servers located in Brazil (southamerica-east1 region, São Paulo), in compliance with industry security standards. We implement appropriate technical and organizational measures to protect your data against unauthorized access, loss, or alteration.

Retention periods:

• Active user data: retained for the life of the account. Processing is necessary to provide the service while the account is active.
• Post-cancellation data: 30 days from cancellation. Once this period expires, personal data is anonymized.
• Database backups: 30 days, with automatic purging. Backups are externally inaccessible during this period.
• Operational logs: 30 days. Includes access and platform operation logs.
• Privacy logs: 2 years. Includes deletion confirmations and exercise of rights, retained for regulatory accountability.

5. Sub-processors

To operate the platform we use the following sub-processors, all subject to data processing agreements and confidentiality obligations:

• Google Cloud — Infrastructure: API, database, and frontend. Location: southamerica-east1, São Paulo, Brazil.
• OpenAI — Classification of calendar events into MacroTasks and schedule-load analysis. Location: United States.
• n8n Cloud — Automation pipeline: sends calendar data to OpenAI for schedule-load analysis. Location: United States.
• PostHog — Platform usage analytics, with no access to calendar data. Location: us.i.posthog.com, United States.

Calendar data and personal data are stored exclusively on servers in Brazil (southamerica-east1). OpenAI and n8n process calendar data in the United States solely for the purpose of MacroTask classification and schedule-load analysis; they do not store it or use it for any other purpose. PostHog receives only platform usage data, with no access to calendar data.

6. Sharing information

We do not share your personal data with third parties, except in the following cases:

• When necessary to comply with a legal obligation.
• With the sub-processors listed in the previous section, subject to contracts that require them to protect the confidentiality of your data.

7. User rights

Depending on your location, you may have the following rights over your data:

• Access the personal data we store about you.
• Request correction of inaccurate data.
• Request deletion of your personal data.
• Object to the processing of your data in certain cases.
• Request portability of your data in a structured format.

To exercise any of these rights, contact us at soporte@pausaco.com.

8. Legal basis for processing (LGPD)

For users in Brazil, PausaCo's processing of personal data is based on the following legal grounds under the Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018):

• Contract performance (Art. 7, II LGPD): processing of calendar and profile data is necessary to provide the contracted service.
• Legitimate interest (Art. 7, IX LGPD): usage and analytics data is processed to improve the service, respecting the data subject's right to opt out.

9. International data transfers

Some sub-processors (OpenAI, n8n, and PostHog) are located in the United States. International transfers are carried out with appropriate protection safeguards in accordance with:

• Art. 33 of the LGPD for users in Brazil.
• Law 25,326 on Personal Data Protection for users in Argentina.

10. Security

We implement technical and organizational security measures to protect your personal data, including AES-256 encryption at rest, TLS 1.2+ in transit, strict access controls, and separation of development, staging, and production environments.

11. Changes to this Privacy Policy

We reserve the right to update this Privacy Policy at any time. We will notify you of any material changes through the platform or by email.

12. Contact

If you have any questions or concerns about this Privacy Policy, you can contact us at soporte@pausaco.com.

Effective Date: 12/31/2026