Factual draft subject to controller identification, operator confirmation, legal basis definition and legal review before launch.
Controller and contact
Locazap identifies the product, but the project does not provide the legal controller, registration number, address or privacy contact.
This required information must be supplied before commercial publication.
Data identified in the project
Website visitors
The server logs IP address, requested path, HTTP status, byte count and request duration. A functional cookie stores the selected language. Cloudflare may inject performance metrics when Web Analytics is enabled.
Technical administration
The deployed database provides for administrator name, email, password hash, role, status, last access and audit records with operation, table, details, IP and date.
Customer companies and product users
An architecture document proposes company name, legal name, document, owner email and assigned tenant database, but those tables are not in the deployed migration. There is no operational end-customer schema in the current repository.
Data sent to artificial intelligence
There is no AI provider or integration. Prompts, recipients, retention and training use cannot be disclosed until verifiable contracts and configuration exist.
Purposes and legal bases
Logs support server operation, diagnosis and security; the cookie keeps language preference; administrator accounts enable service operation and auditing.
Applicable legal bases, mandatory fields and consequences of not providing data still require definition and legal validation.
Security
The project separates services, restricts the database to a private network, uses distinct database users, HTTP security headers, request limits, file permissions, logs and backups. These measures reduce risk but do not guarantee invulnerability.
Retention and deletion
Log files rotate daily and keep 30 rotations; the backup log keeps 12 weekly rotations.
Database, storage and configuration backups run daily and are kept for 14 days by default. An optional remote destination is not confirmed.
No approved periods exist for account, administrator, company or audit data, and no documented process propagates deletion to backups.
Data subject rights
Where applicable, the LGPD provides rights that must be exercised through a confirmed controller channel.
- Confirmation of processing and data access
- Correction of incomplete, inaccurate or outdated data
- Anonymization, blocking or deletion where legally applicable
- Sharing information, portability where applicable and withdrawal of consent when consent is the basis
Children and adolescents
The audience and policy for minors are undefined. The product should not intentionally collect children's data before specific assessment and suitable controls.
Policy changes
Relevant changes should be published with a revision date and appropriate notice when required.