Privacy Policy

Welcome to Keldan.

Keldan Tecnologia Ltda. ("Keldan", "Company", "we", "our", or "us") values your privacy and is committed to protecting the personal information entrusted to us.

This Privacy Policy explains how we collect, use, disclose, store, transfer, and protect Personal Data when individuals interact with our websites, cloud services, software platforms, APIs, applications, developer tools, documentation, customer support channels, and any other products or services provided by Keldan (collectively, the "Services").

Our objective is to ensure transparency regarding our privacy practices while complying with applicable privacy and data protection laws, including, where applicable:

Brazilian General Data Protection Law (LGPD)
European General Data Protection Regulation (GDPR)
UK GDPR
California Consumer Privacy Act (CCPA), when applicable
Other applicable international privacy regulations

This Privacy Policy applies regardless of the country from which you access our Services.

By accessing or using our Services, you acknowledge that you have read and understood this Privacy Policy.

Keldan is a technology company specialized in building enterprise software, cloud platforms, APIs, infrastructure services, software development kits (SDKs), developer tools, integrations, automation solutions, and digital products for businesses worldwide.

Our Services may include:

Cloud Software (SaaS)
APIs
Developer Platforms
Infrastructure Services
Marketplace Solutions
Gaming Infrastructure
Payment Technology Infrastructure
Artificial Intelligence Services
Business Automation Tools
Data Integration Services
Authentication Services
Monitoring and Analytics Solutions

Unless expressly stated for a specific regulated service, Keldan is not a bank, financial institution, money transmitter, cryptocurrency exchange, payment processor, gambling operator, or licensed financial services provider.

Certain Services offered by Keldan may support customers operating regulated businesses; however, regulatory compliance remains the responsibility of each customer unless otherwise expressly agreed.

This Privacy Policy applies to:

visitors of our websites;
customers;
prospective customers;
developers using our APIs;
users of our platforms;
applicants for employment;
vendors;
business partners;
contractors;
individuals communicating with Keldan.

This Privacy Policy does not apply to:

third-party websites;
customer-owned applications;
customer databases;
services operated by third parties;
products governed by separate privacy notices.

When accessing third-party websites through links available on our Services, their respective privacy policies will govern the processing of your information.

For purposes of this Privacy Policy:

"Personal Data" means any information relating to an identified or identifiable natural person.

"Sensitive Personal Data" means any category of personal information receiving special protection under applicable law, including health information, biometric identifiers, racial or ethnic origin, religious beliefs, political opinions, genetic information, sexual orientation, or similar categories.

"Customer Data" means any information uploaded, stored, processed, transmitted, or managed by customers while using Keldan Services.

"Processing" means any operation performed on Personal Data, whether automated or not, including collection, recording, organization, storage, adaptation, retrieval, consultation, use, disclosure, transfer, restriction, deletion, or destruction.

"Controller" means the legal entity determining the purposes and means of processing Personal Data.

"Processor" means the legal entity processing Personal Data on behalf of a Controller.

"Subprocessor" means a third-party service provider engaged by Keldan to process Personal Data on behalf of our customers.

"User" means any person accessing or using our Services.

"Services" means all products, software, APIs, applications, websites, cloud services, documentation, infrastructure, platforms, and related technologies provided by Keldan.

"Applicable Privacy Laws" means any law governing privacy, security, confidentiality, or Personal Data protection applicable to Keldan or its customers.

The role Keldan plays when processing Personal Data depends on the specific Service being used and the contractual relationship established with our customers.

Depending on the circumstances, Keldan may act as:

Data Controller;
Joint Controller;
Data Processor.

5.1 When Keldan Acts as a Controller

Keldan acts as an independent Controller whenever we determine the purposes and means of processing Personal Data.

Examples include:

Account registration
Website visitors
Sales inquiries
Customer support
Marketing communications
Event registrations
Recruitment processes
Billing administration
Security monitoring
Fraud prevention
Service analytics
Legal compliance

In these situations, Keldan determines how and why Personal Data is processed.

5.2 When Keldan Acts as a Processor

For many of our enterprise products, Keldan merely provides the underlying technology infrastructure.

In these situations:

our customer determines which Personal Data is processed;
our customer determines why the information is processed;
our customer remains responsible for compliance with applicable privacy laws;
Keldan processes such information only according to documented customer instructions and applicable law.

Examples include:

SaaS platforms
Cloud hosting
APIs
Infrastructure services
White-label platforms
Developer services
Marketplace services

5.3 Customer Responsibility

Customers remain responsible for obtaining all necessary legal authorizations, consents, notices, and legal bases required to process Personal Data through Keldan Services.

Nothing in this Privacy Policy transfers such legal responsibilities to Keldan unless expressly provided by applicable law or a written agreement.

Depending on how you interact with Keldan, we may collect different categories of Personal Data.

6.1 Information You Provide Directly

You may voluntarily provide information such as:

Full name
Email address
Company name
Job title
Phone number
Country
Billing information
Account credentials
Profile information
Support requests
Communications
Survey responses
Marketing preferences

Providing certain information may be necessary to access specific Services.

6.2 Business Information

When using our enterprise Services, we may collect information relating to organizations, including:

Company name
Business address
Tax identification number
Industry
Website
Domain names
Authorized representatives
Billing contacts

6.3 Account Information

When creating an account, we may collect:

Username
Email address
Password (stored only in encrypted or hashed form)
Authentication methods
Security preferences
Two-factor authentication configuration
Recovery methods
Account settings

6.4 Payment Information

Depending on the Service, billing-related information may include:

Billing address
Subscription details
Invoice information
Tax information
Payment method identifiers
Transaction references

Keldan does not intentionally store complete payment card information unless expressly required by a specific Service and handled in accordance with applicable security standards.

6.5 Communications

When contacting Keldan, we may collect:

Emails
Chat messages
Support tickets
Phone recordings (where legally permitted)
Meeting notes
Feedback
Attachments

These communications help us provide support, improve our Services, and maintain security.

Whenever you access our Services, certain technical information may be collected automatically.

Such information may include:

IP address
Browser type
Browser version
Operating system
Device identifiers
Language settings
Time zone
Network information
Session identifiers
Date and time of access
Pages visited
Features used
Clickstream information
Referring URLs
Exit pages
Device performance
Crash reports
Diagnostic information

We collect this information to:

maintain platform security;
improve system performance;
troubleshoot issues;
detect abuse;
generate operational metrics;
improve user experience.

Customer Data refers to information uploaded, created, transmitted, or stored by our customers while using Keldan Services.

Examples include:

end-user information;
application data;
configuration data;
uploaded files;
databases;
transactional records;
API payloads;
operational logs;
custom business information.

Customer Data belongs to our customers.

Except as required to provide the Services, maintain security, comply with legal obligations, or fulfill contractual commitments, Keldan does not access, use, or disclose Customer Data for its own commercial purposes.

Our customers remain responsible for determining:

what information is processed;
why it is processed;
how long it should be retained;
whether consent or another legal basis is required;
how data subjects may exercise their rights.

We may receive Personal Data from trusted third-party sources, including:

identity providers;
authentication services;
payment providers;
business partners;
CRM systems;
public business registries;
fraud prevention providers;
analytics providers;
marketing partners;
cloud service providers.

We may combine information obtained from third parties with information already available to improve our Services, prevent fraud, verify identities, comply with legal obligations, and enhance user experience.

All third-party information is processed in accordance with applicable privacy laws and this Privacy Policy.

Keldan processes Personal Data only when necessary to provide, improve, protect, and operate its Services.

Depending on the context, Personal Data may be processed for one or more of the following purposes.

10.1 Service Delivery

We use Personal Data to:

create and manage user accounts;
authenticate users;
provide access to Services;
maintain customer environments;
deliver requested features;
process subscriptions;
manage licenses;
administer customer organizations;
provide technical support;
deliver software updates;
fulfill contractual obligations.

10.2 Customer Relationship Management

We process Personal Data to:

respond to inquiries;
communicate with customers;
provide customer support;
manage business relationships;
notify users of important service information;
provide onboarding assistance;
administer customer success activities.

10.3 Security

Protecting our infrastructure is one of our highest priorities.

We may process Personal Data to:

detect suspicious activities;
authenticate identities;
prevent unauthorized access;
investigate security incidents;
identify vulnerabilities;
prevent fraud;
monitor infrastructure;
protect customer environments;
secure APIs;
maintain audit trails;
comply with security requirements.

10.4 Platform Operations

We process technical information to:

improve platform stability;
monitor service availability;
troubleshoot failures;
optimize performance;
measure infrastructure capacity;
maintain system reliability;
improve user experience.

10.5 Product Improvement

We continuously improve our Services.

Personal Data may be analyzed to:

understand feature usage;
identify product improvements;
prioritize roadmap decisions;
measure adoption;
develop new features;
improve documentation;
improve accessibility.

Where possible, aggregated, anonymized, or pseudonymized information is used.

10.6 Communications

We may communicate with users regarding:

account notifications;
security alerts;
billing information;
product announcements;
maintenance notices;
legal notices;
customer support;
newsletters;
educational materials;
marketing communications where permitted by law.

Users may opt out of marketing communications at any time.

10.7 Legal Compliance

Personal Data may be processed to:

comply with applicable laws;
satisfy regulatory obligations;
respond to lawful governmental requests;
enforce our agreements;
resolve disputes;
protect our legal rights;
exercise legal claims.

10.8 Business Operations

We may process Personal Data to support ordinary business activities, including:

financial reporting;
accounting;
auditing;
tax compliance;
mergers and acquisitions;
internal governance;
corporate administration;
risk management.

Where applicable under privacy laws such as the GDPR, UK GDPR, and LGPD, Keldan processes Personal Data based on one or more lawful grounds.

These legal bases include:

11.1 Contract Performance

Processing necessary to:

provide requested Services;
create accounts;
fulfill contractual obligations;
process subscriptions;
provide customer support.

11.2 Legal Obligations

Processing required by law, including:

tax obligations;
accounting requirements;
regulatory compliance;
court orders;
lawful governmental requests.

11.3 Legitimate Interests

Keldan may process Personal Data based on legitimate business interests, provided such interests do not override the rights and freedoms of individuals.

Examples include:

improving Services;
preventing fraud;
maintaining security;
protecting infrastructure;
conducting analytics;
communicating with customers;
improving documentation;
developing new products.

11.4 Consent

For certain activities, we rely upon user consent.

Examples include:

marketing emails;
optional cookies;
surveys;
event registrations;
promotional communications.

Where consent is the legal basis, it may be withdrawn at any time.

11.5 Protection of Vital Interests

In exceptional circumstances, Personal Data may be processed to protect the life, health, or physical safety of an individual.

Certain Keldan Services may incorporate artificial intelligence ("AI") technologies to enhance functionality, automation, analytics, and user experience.

Examples may include:

intelligent search;
recommendations;
content generation;
workflow automation;
customer support assistants;
anomaly detection;
operational insights.

AI-generated content may be inaccurate, incomplete, or inappropriate for specific circumstances.

Users remain responsible for reviewing outputs before making business, legal, financial, or operational decisions.

Keldan continuously works to improve AI quality but does not guarantee the accuracy or suitability of AI-generated content.

Unless explicitly authorized, Customer Data is not used to train publicly available artificial intelligence models.

Keldan uses cookies and similar technologies to improve the functionality, performance, and security of its Services.

Cookies may be classified as:

Essential Cookies
Functional Cookies
Performance Cookies
Analytics Cookies
Security Cookies
Preference Cookies
Marketing Cookies (where permitted)

Cookies may be stored directly by Keldan or by authorized third-party providers.

Users may configure browser settings to reject certain cookies.

However, disabling some cookies may affect the proper functioning of our Services.

Additional information is available in our Cookie Policy.

To understand how our Services perform and how they are used, Keldan may utilize analytics, monitoring, and observability technologies.

These tools may collect information such as:

page views;
feature usage;
API performance;
latency metrics;
error rates;
infrastructure health;
application diagnostics;
anonymous usage statistics.

Analytics information helps us:

improve reliability;
optimize performance;
identify software defects;
enhance usability;
prioritize development efforts.

Whenever reasonably possible, analytics information is aggregated, anonymized, or pseudonymized before analysis.

We do not use analytics technologies to intentionally identify individual users unless necessary for security, fraud prevention, technical support, or legal compliance.

Keldan does not sell Personal Data.

We only share Personal Data when necessary to provide our Services, comply with legal obligations, protect our legitimate interests, or when instructed by our customers.

Personal Data may be shared under the following circumstances.

15.1 Service Providers

We may share Personal Data with carefully selected third-party service providers that perform services on our behalf.

Examples include providers of:

cloud infrastructure;
hosting services;
content delivery networks (CDNs);
identity and authentication services;
customer support platforms;
email delivery services;
payment processing;
analytics;
monitoring and observability;
logging;
security services;
customer relationship management (CRM);
marketing automation;
software development tools;
backup and disaster recovery.

These providers are contractually required to process Personal Data only for authorized purposes and to maintain appropriate security measures.

15.2 Corporate Group

Personal Data may be shared among Keldan affiliates and subsidiaries when necessary for operational, legal, financial, administrative, security, or customer support purposes.

All entities within the Keldan corporate group are required to maintain confidentiality and appropriate safeguards.

15.3 Business Partners

When you request integrations or services involving third-party partners, certain information may be shared with those partners as necessary to provide the requested functionality.

Such processing will be governed by the applicable agreements and privacy policies of those partners.

15.4 Customer Instructions

For Services where Keldan acts as a Data Processor, Personal Data may be processed and disclosed strictly in accordance with the documented instructions of the customer.

15.5 Legal Requirements

We may disclose Personal Data when we reasonably believe disclosure is necessary to:

comply with applicable laws;
respond to valid legal requests;
comply with court orders;
cooperate with regulatory authorities;
protect the rights of Keldan;
protect our customers;
protect public safety;
investigate fraud;
investigate abuse;
investigate security incidents.

15.6 Business Transactions

If Keldan is involved in a merger, acquisition, investment transaction, corporate restructuring, financing, bankruptcy, or sale of assets, Personal Data may be transferred as part of that transaction.

Appropriate confidentiality obligations will continue to apply.

Keldan relies on trusted infrastructure providers to operate its Services securely and reliably.

These providers may process limited Personal Data solely for purposes related to providing infrastructure or operational support.

Categories of subprocessors may include:

cloud computing providers;
content delivery networks;
email providers;
monitoring platforms;
authentication providers;
payment providers;
analytics providers;
customer support platforms;
backup providers;
logging providers;
infrastructure security providers.

Keldan maintains appropriate contractual safeguards with subprocessors, including confidentiality obligations and data protection commitments where required by law.

A current list of subprocessors may be published separately or provided upon request where contractually required.

Because Keldan operates globally, Personal Data may be transferred to and processed in countries other than the country where it was originally collected.

These countries may have privacy laws that differ from those applicable in your jurisdiction.

Whenever Personal Data is transferred internationally, Keldan implements appropriate safeguards designed to provide an adequate level of protection.

Depending on the applicable law, such safeguards may include:

Standard Contractual Clauses (SCCs);
International Data Transfer Agreements (IDTAs);
adequacy decisions;
contractual commitments;
technical safeguards;
organizational safeguards;
encryption;
access controls.

We take reasonable measures to ensure Personal Data remains protected regardless of where it is processed.

Keldan retains Personal Data only for as long as necessary to fulfill the purposes described in this Privacy Policy, comply with legal obligations, resolve disputes, enforce agreements, and maintain the security and integrity of our Services.

Retention periods may vary depending on:

the type of information;
legal requirements;
contractual obligations;
regulatory requirements;
operational needs;
customer instructions.

When Personal Data is no longer required, we securely delete, anonymize, or permanently destroy it using appropriate technical and organizational measures.

18.1 Typical Retention Periods

Although actual retention periods may vary, Keldan generally follows the principles below:

| Category | Typical Retention |

|-----------|-------------------|

| Account Information | While the account remains active |

| Billing Records | As required by applicable law |

| Customer Support Records | As necessary for support and legal purposes |

| Security Logs | According to operational and security requirements |

| Infrastructure Logs | Limited operational retention period |

| Backup Data | Rotating backup lifecycle |

| Marketing Preferences | Until consent is withdrawn or no longer required |

Longer retention periods may apply when required by law or necessary to establish, exercise, or defend legal claims.

Protecting Personal Data is a fundamental part of Keldan's security program.

We maintain administrative, technical, and organizational safeguards designed to protect Personal Data against accidental, unlawful, or unauthorized access, disclosure, alteration, destruction, or loss.

Our security program may include measures such as:

encryption in transit;
encryption at rest where appropriate;
role-based access control (RBAC);
multi-factor authentication (MFA);
least privilege access principles;
security monitoring;
centralized logging;
vulnerability management;
secure software development lifecycle (SSDLC);
infrastructure hardening;
network segmentation;
audit logging;
continuous monitoring;
backup procedures;
disaster recovery planning;
incident response procedures;
periodic security reviews;
employee security awareness training.

No security system can guarantee absolute protection.

While Keldan continually improves its security controls, users are also responsible for maintaining the confidentiality of their credentials, using strong passwords, enabling multi-factor authentication where available, and promptly notifying Keldan of any suspected unauthorized access.

Depending on your country of residence and the applicable privacy laws, you may have certain rights regarding your Personal Data.

Subject to applicable legal requirements, you may have the right to:

obtain confirmation that we process your Personal Data;
access your Personal Data;
request correction of inaccurate or incomplete Personal Data;
request deletion of Personal Data;
request anonymization where applicable;
request restriction of processing;
object to certain processing activities;
withdraw consent where processing is based on consent;
request portability of your Personal Data;
request information regarding third parties with whom your Personal Data has been shared;
request review of decisions based solely on automated processing where applicable;
lodge a complaint with the competent data protection authority.

These rights may be subject to legal or contractual limitations.

20.1 Rights under the LGPD

Where the Brazilian General Data Protection Law (LGPD) applies, you may request:

confirmation of processing;
access to Personal Data;
correction of inaccurate information;
anonymization, blocking, or deletion of unnecessary or excessive data;
portability;
deletion of data processed based on consent;
information regarding data sharing;
information regarding the consequences of refusing consent;
withdrawal of consent;
review of automated decisions where applicable.

20.2 Rights under the GDPR

Where the GDPR applies, individuals may have the right to:

access Personal Data;
rectification;
erasure ("Right to be Forgotten");
restriction of processing;
portability;
objection to processing;
withdraw consent;
object to direct marketing;
not be subject solely to automated decision-making where legally applicable.

Requests relating to Personal Data may be submitted through our designated privacy contact.

Before fulfilling a request, Keldan may require reasonable verification of identity to prevent unauthorized disclosure of Personal Data.

Requests will be processed within the timeframes required by applicable law.

Certain requests may be denied where:

required by law;
necessary to protect the rights of others;
technically infeasible;
excessive or repetitive;
incompatible with contractual obligations.

Whenever permitted, we will explain the reasons for any denial.

Our Services are intended for businesses and professional users.

Keldan does not knowingly collect Personal Data from children under the minimum age established by applicable law without appropriate legal authorization.

If we become aware that Personal Data relating to a child has been collected in violation of applicable law, we will take reasonable steps to delete such information promptly.

Parents or legal guardians who believe a child has provided Personal Data to Keldan may contact us using the information provided below.

Our Services may contain links to third-party websites, applications, documentation, marketplaces, or external resources.

Keldan is not responsible for:

the privacy practices of third parties;
the security of third-party websites;
the content published by third parties;
products or services offered by third parties.

Users are encouraged to review the privacy policies of any third-party service before providing Personal Data.

We may update this Privacy Policy from time to time to reflect:

legal developments;
regulatory changes;
technological advances;
improvements to our Services;
changes to our business operations.

When material changes are made, we will update the "Last Updated" date shown at the beginning of this document.

Where required by applicable law, we may also provide additional notice through our Services or by other appropriate means.

Continued use of the Services after such updates constitutes acknowledgment of the revised Privacy Policy.

Questions regarding this Privacy Policy or our privacy practices may be directed to:

Keldan Tecnologia Ltda.

Email:

privacy@keldan.com.br

Data Protection Contact:

privacy@keldan.com.br

Website:

https://www.keldan.com.br

For requests related to Personal Data, please include sufficient information to allow us to identify your request and verify your identity where necessary.

Depending on the Services used, Keldan may process categories of Personal Data including:

Identity Data

Name
Username
Job Title
Company
Profile Information

Contact Data

Email Address
Phone Number
Mailing Address

Authentication Data

Password Hashes
Multi-Factor Authentication Settings
Authentication Tokens
Session Information

Technical Data

IP Address
Device Information
Browser Information
Operating System
Network Information
Time Zone
Language

Usage Data

Service Usage
Feature Utilization
Clickstream Data
Performance Metrics
Diagnostic Information

Billing Data

Billing Address
Subscription Details
Invoice Information
Tax Information

Communications

Support Requests
Emails
Chat Messages
Meeting Notes
Feedback

Customer Data

Customer Data processed on behalf of customers as described in applicable agreements.

Depending on the circumstances, Keldan processes Personal Data under one or more of the following legal bases:

Performance of a Contract
Compliance with Legal Obligations
Legitimate Interests
Consent
Protection of Vital Interests
Public Interest where applicable

Keldan follows the principle of retaining Personal Data only for as long as necessary to:

provide Services;
comply with legal obligations;
resolve disputes;
protect our rights;
maintain security;
comply with contractual commitments.

After the applicable retention period expires, Personal Data is securely:

deleted;
anonymized;
destroyed; or
archived where legally required.

This Privacy Policy shall be interpreted in accordance with the laws applicable to the entity providing the relevant Services and any mandatory data protection legislation applicable to the processing of Personal Data.

Nothing in this Privacy Policy limits any rights granted to individuals under applicable privacy legislation.