01Who we are
Notti is a product of Zeep Labs, a brand of JULIO AUGUSTO MORAIS DE SOUSA DESENVOLVIMENTO DE SOFTWARE LTDA, registered under CNPJ No. 37.818.214/0001-80, headquartered in São Paulo, SP, Brazil. For the purposes of this policy, we are the controller of the data of the customers who use the platform.
02Controller and processor
We handle two types of data, with different roles:
03Data we collect
Depending on how you interact with Notti, we may collect:
04Sign in with Google and GitHub
The Notti dashboard lets you sign in with your Google or GitHub account. When you choose Google, we request only the basic identity scopes (openid, email and profile). We do not access Gmail, Drive, Calendar, contacts or any other service in your Google account.
From the data received from Google, we use: the unique account identifier (sub), your email and whether it is verified, and your name. We use this information only to authenticate you and to create or link your Notti account. Google also sends the URL of your profile picture, but Notti does not use it or write it to its database; it is held only temporarily in the sign-up session.
We do not sell this data, use it for advertising or to train artificial intelligence models, or share it with third parties, except infrastructure providers needed to operate the service or when required by law. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.
Notti does not store the Google access token: it is used once to complete the sign-in. For GitHub, we request the read:user and user:email scopes and handle the data the same way.
You can revoke Notti's access at any time at myaccount.google.com/permissions (Google) or github.com/settings/applications (GitHub). To delete the data already associated with your Notti account, write to our data protection officer (see the Data protection officer section).
05Dashboard usage analytics
In the SaaS version of the Notti dashboard, we use Google Firebase services (Google Analytics, Remote Config and Performance Monitoring, plus A/B tests built on them) to improve the product, measure feature adoption, detect performance problems and control feature rollout, that is, turn features on or off, show notices and release new features gradually or as experiments. Self-hosted installations do not load Firebase.
When you are signed in to the dashboard, we send Firebase: product usage events (sign-up, app created, push provider configured, notification sent, member invited, checkout started and plan changed), always with predefined-value parameters only; the pages you visit, recorded as route templates without identifiers; your internal Notti user identifier (a UUID); your plan tier and your role in the company; response times of API calls and screen load times, also without identifiers; and remote configuration fetches. The Firebase SDK itself also collects the Firebase Installation ID and browser and device information.
We do not send Firebase your email, your name, company or app names, notification content, device tokens or anything you type in the dashboard.
This processing is based on our legitimate interest in maintaining and improving the product (LGPD art. 7, IX). Google LLC acts as processor of this data, which may be processed outside Brazil, with the safeguards described in the International transfer section (LGPD art. 33). The data is kept for as long as necessary for these purposes, as described in the Retention section.
Usage analytics is on by default. You can object to it at any time by turning off the usage analytics option in the dashboard preferences: the choice is saved to your account and in your browser and, from then on, the dashboard stops sending usage events to Google Analytics and performance data to Performance Monitoring. Remote Config stays active, because it defines which features are available in the dashboard. You can also exercise this right by emailing our data protection officer (see the Data protection officer section).
06How we use the data
We use the data to provide and improve the service, deliver the notifications configured by customers, process payments, prevent fraud and abuse, comply with legal obligations, and communicate with you about your account and product updates.
Data sent through the "self-hosted waitlist" form is used only to notify you about the self-hosted launch and reply to your request.
07Legal bases
We process personal data based on the legal bases set out in art. 7 of the LGPD, mainly: performance of a contract, compliance with a legal obligation, legitimate interest and, where applicable, consent.
Data from the "self-hosted waitlist" form is processed based on your consent, given when you submit the form. You can withdraw it at any time by emailing our data protection officer.
SaaS dashboard usage analytics through Google Firebase is processed based on legitimate interest, and you can object to it in the dashboard preferences, as described in the Dashboard usage analytics section.
The site's optional cookies, in the Analytics and Marketing categories, are only used with your consent, given through the cookie banner, as described in the Cookies section.
08Sharing
We do not sell personal data. We share data only with:
09International transfer
Some vendors may process data outside Brazil, including the site analytics tools (Google, Microsoft and Cloudflare) and the Google Firebase services used in the SaaS dashboard. In these cases, we adopt the safeguards provided for under the LGPD, such as standard contractual clauses and vendors with adequate levels of protection.
10Retention
We keep data for as long as necessary to fulfill the purposes of this policy or legal obligations. After an account is closed, data is deleted or anonymized within 90 days, unless the law requires it to be kept for longer.
Data sent through the "self-hosted waitlist" form remains available for 30 days from submission. After that, it is deleted and permanently removed from our database within 30 additional days.
11Security
We adopt technical and administrative measures to protect data, including encryption in transit and at rest, role-based access control, per-app API keys and audit logging. No system is fully immune to incidents; should one occur that creates a relevant risk, we will notify those affected and the ANPD.
12Self-hosted version
In the self-hosted version, data stays on the customer's own infrastructure and is not accessed by Zeep Labs. The customer is fully responsible for processing and securing that data. We may receive only minimal technical licensing information, where applicable. Self-hosted installations do not use Google Firebase.
13Your rights
As a data subject, you may request at any time:
15Data protection officer (DPO)
To exercise your rights or ask questions about this policy, contact our data protection officer at legal@zeeptecnologia.com.br. We will respond within 15 days.
16Changes to this policy
We may update this policy periodically. Material changes will be communicated by email or through the dashboard, and the update date at the top of the page will be revised.