saspiBack to sign in

SASPI · Privacy Policy

SASPI Privacy Policy — Pilot (v0 DRAFT)

Status: DRAFT for legal review. Binds no one until published. Last updated: 27 August 2026

This policy explains what personal data SASPI processes, why, and what your rights are. SASPI has two audiences and this policy speaks to both:

  • Account holders and org admins — people who sign up and run a tenant.
  • Observed developers — people whose enrolled machines run Enigmo.

Who is responsible: For account and sign-up data, SASI COMUNICACAO AGIL LTDA (CNPJ 35.379.670/0001-45) is the controller. For an organization's workspace and observation data, the organization is the controller and SASPI is the processor, acting on the organization's instructions. [JULIA: confirm entity + controller/processor split language.]

1. What we collect

Account data (we are controller):

  • Work email, name, and profile details you provide.
  • Sign-in proofs: one-time email codes; or your GitHub / Google identity — we receive your verified email and basic profile from the provider, never your provider password.
  • Tenant membership and role.

Workspace and observation data (organization is controller):

  • Enrollment records: machine, person, organization, enrollment terms shown.
  • Governed work-session records, governance-probe results, grant and secret use events (the use is recorded; secrets are brokered at point of use and not stored on the developer's machine).
  • The organization's audit record: grants, accesses, changes — attributed, timestamped, exportable.
  • Project material the organization directs us to ingest (e.g., repository history predating governance).

The scope and limits of observation are described in the Monitoring & Ownership Disclosure, which is part of this policy.

Operational data:

  • Service logs, diagnostics, and security telemetry.
  • Support communications.

2. What we use it for

Providing and securing the service; operating enrollment, sign-in, grants, and audit; support; service communications (e.g., sign-in codes, release notes); improving reliability. We do not sell personal data and we do not use it for advertising. We do not use the content of governed work to build unrelated products.

3. Legal bases (GDPR / LGPD / UAE PDPL)

Performance of a contract (providing the service you or your organization signed up for); legitimate interests (security, service integrity, improvement); consent where required (e.g., optional communications); and, for observation data, the organization's instructions as controller — the organization is responsible for its own lawful basis toward its people, as set out in the Pilot Terms. [JULIA: jurisdiction-specific review.]

4. Who else touches the data (sub-processors)

  • Hosting: staging VPS infrastructure (Hostinger). [JULIA: confirm data center location for transfer analysis.]
  • Email delivery: Resend (EU region) for sign-in codes and service mail.
  • Sign-in providers: GitHub and Google, when you choose them — governed by their terms for the sign-in transaction.

We keep the list short and will update it before GA. No other third parties receive personal data in the pilot.

5. International transfers

The pilot may involve transfers between Brazil, the EU, the UAE, and the US. [JULIA: mechanism — SCCs / adequacy / LGPD arts. as applicable.]

6. Retention

Account data: for the life of the account, then deleted or anonymized within [90] days. Observation data: per the organization's clearance window, capped at a 365-day platform ceiling. Pilot/staging data may be reset at pilot end with notice; the organization may export its record first. Logs: rolling short-term retention.

7. Your rights

Access, correction, deletion, export, restriction, and objection, as provided by applicable law. Observed developers may route requests through their organization (the controller of observation data) or contact us directly and we will assist or forward as the law requires: [privacy@saspi.ai — mailbox to be provisioned before publication].

8. Cookies

Essential cookies only: session and tenant selection. No advertising or cross-site tracking cookies.

9. Children

SASPI is a workplace product and not directed at anyone under 18.

10. Changes

We will post changes here and, for material changes, notify account holders.

— SASI COMUNICACAO AGIL LTDA · CNPJ 35.379.670/0001-45