Taggor Privacy Policy
Version: 1.0 — Commercial Release
Last updated: November 12, 2026
Effective date: Upon publication as the applicable Privacy Policy of the Service.
Privacy contact: privacidade@taggor.dev
This Privacy Policy explains how Haftware Sistemas de Internet Ltda. (doing business through its Taggor service) handles personal information. It applies to our websites, accounts, dashboard, command-line and API access, hosted component infrastructure, and related operations (together, the “Service”). It is intended for people who register for or use Taggor, customer representatives, individuals interacting with our own websites, and visitors to websites that embed customer-created components.
Important distinction: When a Taggor customer chooses to collect information from visitors through a component, that customer generally decides what is collected and why. We normally handle that information on the customer’s behalf, under our Data Processing Addendum (DPA). For our own account management, subscriptions, security, and certain operational metrics, we determine the purposes and act as controller/business, as applicable. This Policy describes both situations but does not replace the customer’s own notice to its visitors.
1. Who operates Taggor; our roles
Haftware Sistemas de Internet Ltda., CNPJ 31.659.341/0001-05, Rua Silveira Martins, No. 810, Suite 504, Centro, Novo Hamburgo, Rio Grande do Sul, ZIP 93510-310, Brazil (“Haftware,” “Taggor,” “we,” “us,” or “our”), develops, operates, and bills for Taggor. Our general contact is contato@taggor.dev; requests concerning personal information should go to privacidade@taggor.dev.
- Independent controller/business. We determine the purposes and means of processing personal information for account registration, user authentication, billing administration, service communications, support, fraud and abuse prevention, security, and operational/product analytics described below.
- Processor/service provider. We handle personal information submitted through customer-controlled components and related collections, and certain related notifications, under the customer’s instructions and the DPA. Agencies may act as processors for website owners, in which case we may be their subprocessor.
- Customer websites. We do not control the content of customers’ websites, their component designs, their choice of information to request, or their independent use of resulting submissions. A website visitor should normally contact the website operator about those choices or rights concerning a submission.
Our role depends on the actual processing activity and the law that applies, not solely on the labels used in an agreement.
2. Information we handle and where it comes from
The categories below describe our current Service model. Particular information depends on the features used, the customer’s configuration, and the circumstances of an interaction.
| Category | Typical information and source | Purpose | Legal basis where EU/UK GDPR applies to our own processing |
|---|---|---|---|
| Account and identity | Email, name, language, identity-provider reference, account settings; provided by you or our identity provider | Establish and administer accounts, authentication, contractual messages | Contract, Art. 6(1)(b); legitimate interests, Art. 6(1)(f), where appropriate |
| Authentication and access | Session and device authorization records, credential metadata, API key prefixes and scopes, OAuth authorizations and workspace roles; generated when you access or configure the Service | Authenticate, authorize, protect access, revoke permissions | Contract; legitimate interests in security |
| Security and audit records | Account/workspace identifiers, sensitive actions, time, channel, and limited network information such as truncated IP prefixes where logged | Investigate suspected abuse, prevent fraud, document relevant operations | Legitimate interests; legal obligation where applicable |
| Subscriptions and billing | Plan, subscription state, billing contact, transaction identifiers, invoices and receipts; provided by you and payment providers | Provide and administer subscriptions, payments, taxes, accounting, disputes | Contract; legal obligation; legitimate interests in fraud prevention |
| Support and service correspondence | Information you include when contacting us, the account involved and response records | Respond to requests, diagnose issues and provide support | Contract; legitimate interests; legal obligation where applicable |
| Invitations and service notices | Invited email addresses and contact preferences supplied by workspace administrators; recipients of notices | Deliver invitations, operational alerts and legally required notices | Legitimate interests; contract where relevant; consent where legally required for optional notices |
| Product usage and operational telemetry | Feature events, component identifiers, usage counts, coarse device/country/network indicators and error details | Operate, secure, troubleshoot and improve Taggor; administer published plan limits | Legitimate interests; contract where relevant |
| Legal acceptance and requests | Accepted document version, time, relevant account identifier; privacy requests and verification information | Evidence agreements and respond to rights requests | Legitimate interests; legal obligation where applicable |
| Customer-submitted data | Fields and messages selected by the customer, ordinary contact and identification details, submission metadata and notification details, as applicable | Deliver customer-configured collection features | Processed on customer instructions, not under an independent legal basis selected by us for the customer’s collection |
We may receive information directly from you, from customer administrators who invite you, from your browser or connected software when you interact with the Service, and from service providers needed to authenticate, host and bill for it. We do not intentionally request more personal information than reasonably necessary for the stated purposes.
Where we rely on legitimate interests, those interests include Service security, preventing abuse, maintaining reliable operations, understanding feature adoption, and establishing or defending legal claims. You may object where applicable law provides that right.
3. Information collected through customer components
Customers can create and embed components such as forms on websites they operate or are authorized to manage. They determine form fields, notices, legal bases, permissions, recipients and lawful uses of submissions. Subject to their configuration and plan, the Service may process:
- data visitors choose to enter, such as names, email addresses, telephone numbers, messages, company information and ordinary identifiers (including Brazilian CPF or RG numbers where lawfully requested);
- the date and technical context of a submission, such as its associated component/site, page path without query parameters, country or general browser category, where the feature captures those fields;
- consent-related configuration or records, where enabled, such as the displayed notice’s hash, language, component version and submission time; and
- notification destinations specified by customers and information needed to deliver and manage those notifications.
The Service’s current submission design limits individual submissions to 32 KiB, subject to future product changes and any published technical limits. A customer’s selection that a collection contains personal data is not a guarantee that the actual contents have been correctly classified. The fact that a component is accepted, scanned or published does not mean its collection is lawful, and a consent-related record does not establish by itself that a valid consent was obtained.
Customers must provide appropriate notices, select valid legal grounds, respond to visitor requests, and avoid prohibited or improperly authorized categories of information under the Terms. The standard DPA forms part of the Terms without a separate optional acceptance. We do not sell customer submissions, use their contents for cross-context behavioral advertising, or use their contents to train our own or third-party generative AI models. Limited processing may be necessary for security, support requested by the customer, compliance with law or prevention of abuse, as permitted by the DPA and applicable law.
If you used a Taggor component on someone else’s website: Contact the operator identified on that website to exercise rights concerning the information you submitted. If you cannot identify the operator, email us with the website address and enough context to locate the relevant customer; we will assist or route the request where reasonably possible and legally permitted. We may not be able to identify a particular submission without the customer’s help.
4. Component metrics, cookies and similar technologies
To operate the Service, show aggregate performance information to customers, detect errors and abuse, and administer usage, Taggor processes operational information such as site/component keys, the referring domain where provided, load and display counts, customer-configured interaction events, device class, approximate country, runtime-error metadata and network information such as an autonomous system number (ASN). Some measurements may be aggregated, and some technical signals may be processed transiently for security and request-rate controls.
Our current component metrics design does not require advertising cookies or a persistent identifier designed to track the same visitor across unrelated websites. However, network and security providers necessarily may process information such as IP addresses or browser request headers in transit or in their own security systems. A statement that a submission table does not retain a full IP address does not mean that no technical system processes one. We do not claim that every technical record is automatically anonymous.
The public Taggor website is designed without advertising pixels or third-party advertising analytics. The authenticated portal uses cookies or equivalent storage necessary for sign-in, session management and security, including short-lived login-state information. These technologies are not used by us for cross-context behavioral advertising. If we introduce optional analytics, advertising cookies, or similar nonessential tracking, we will update the relevant notice and implement the consent or choice mechanism required by applicable law before using them.
We do not sell personal information or share it for cross-context behavioral advertising, as those terms are defined by applicable California law, based on the processing described in this Policy. Where applicable, we will honor legally binding opt-out preference signals such as Global Privacy Control for activities subject to such opt-out; the browser’s older Do Not Track signal does not by itself create an identical legal obligation everywhere. Customers are responsible for their own websites’ additional trackers, cookies and data practices.
5. How and why information is used
We use information only for the purposes described in this Policy or otherwise clearly communicated at collection, including to: provide features and subscriptions; authenticate users and connected agents; deliver communications; support and troubleshoot the Service; investigate abuse and protect users and systems; meet legal and financial obligations; maintain records reasonably needed for disputes; and analyze performance and improve the product.
The choice to connect a third-party AI agent is the customer’s. The customer controls which provider, permissions, prompts, information and operations to authorize. We may process the authentication and authorization metadata needed to support the connection; the agent provider’s independent privacy practices are governed by its own notices. Taggor does not itself use customer submission contents to train generative AI models.
We do not use our own account data for advertising profiling or make solely automated decisions about individuals that have legal or similarly significant effects as part of the described account administration processes. If either practice materially changes, we will provide legally required additional notices and safeguards.
6. When we disclose information
We disclose information only as necessary for the purposes above, including to providers operating under applicable contractual obligations, authorized customer administrators, recipients designated by customers, professional advisers under appropriate duties, and public authorities where legally required. In a lawful corporate reorganization, information may transfer subject to applicable notice, confidentiality and data-protection requirements.
Current principal providers and their functions include:
| Provider | Role in the Service | Main categories involved |
|---|---|---|
| Cloudflare | Hosting, content delivery, infrastructure, request protection, operational processing | Requests, published content, technical events and information routed through its infrastructure |
| Neon | Managed PostgreSQL storage, with US-hosted database infrastructure described in our deployment documentation | Account/workspace data, application records, submissions and relevant metadata |
| WorkOS | Identity and authentication | Account identifiers, names, email addresses and identity data needed for login |
| Resend | Transactional and notification email | Email destinations and the content of messages sent using the Service |
| Stripe | Subscription payments and billing | Billing details, transaction and payment information needed to process payments |
Not all of these providers perform the same legal role for every dataset. Stripe’s processing of Taggor’s own subscription payments does not, by itself, make Stripe a subprocessor of customer form submissions. The separately maintained Subprocessor List in our Legal section describes providers used specifically for customer-controlled data, their relevant roles and updates. The actual recipients, locations and terms depend on the deployed configuration and the applicable provider agreement.
We do not intentionally store complete payment-card numbers or security codes in our application database; payment details are handled by Stripe and associated payment systems. This does not mean that no limited payment identifiers or transaction records are available to us for billing support, reconciliation or compliance.
7. International processing and transfers
Haftware is established in Brazil, while certain infrastructure and service providers operate in the United States or other countries. This means that personal information may be accessed, hosted, transmitted or otherwise processed internationally, depending on the applicable feature and provider. In particular, the current database configuration described in our deployment materials uses US infrastructure. We use transfer mechanisms and safeguards required by the law governing the relevant transfer, and coordinate these requirements with the DPA and supplier agreements.
For transfers governed by Brazilian LGPD, we assess an applicable mechanism under LGPD Article 33 and ANPD Resolution CD/ANPD No. 19/2024, including adequacy decisions or duly implemented contractual safeguards where appropriate. The mere use of a foreign provider or reliance on a general contractual consent does not itself establish that the transfer mechanism is sufficient.
For personal information transferred from the EU/EEA to Haftware in Brazil, European Commission Implementing Decision (EU) 2026/179, dated January 26, 2026, recognizes Brazil as adequate for transfers within its scope. Transfers onward to other jurisdictions still require their own assessment and lawful mechanism when applicable. UK restricted transfers are assessed separately; the EU decision does not by itself establish a UK adequacy arrangement for Brazil. Appropriate UK transfer instruments may be required. You may request information on the safeguards applicable to your information at privacidade@taggor.dev, subject to lawful confidentiality protections.
8. Retention and deletion
We keep personal information for the time reasonably needed for the purposes above, the customer’s selected period, and applicable legal requirements. The following describes the current default model; specific periods may vary with lawful retention duties, the applicable plan, security events and the actual service configuration.
| Category | Current retention approach |
|---|---|
| Customer form submissions | As selected by the customer, within the plan’s published maximum; the original Service design uses maxima of 12 months (Free), 24 months (Pro) and 36 months (Agency) |
| Portal sessions | Ordinarily expire after 7 days of inactivity, subject to an overall maximum of 30 days |
| CLI/device authorization requests | Short-lived, generally minutes or hours, with expired records cleared by routine processes |
| Aggregated daily component metrics | Generally up to 25 months (up to 36 months on the Agency plan, following the plan’s retention) |
| Product adoption/usage events | Generally up to 25 months |
| Relevant security and account audit records | Generally up to 5 years, or another justified lawful period where necessary |
| Account and workspace records | During account activity and ordinarily deleted within 30 days after final account closure, subject to the deletion process, remaining contractual/legal duties and defined exceptions |
| Unaccepted invitations | Until expiry or deletion under routine expiration rules |
| Billing, invoices and tax records | For periods mandated by relevant accounting, tax, consumer and legal rules |
| Application technical logs | Ordinarily up to 7 days under the current logging configuration, subject to justified security or legal preservation |
Customers should export important data before deleting a workspace or allowing retention periods to expire. The Service may provide a 7-day recovery window before irreversible workspace deletion; thereafter, production records are deleted subject to retained security/legal records and backup expiration. Some records may persist temporarily in protected backups, which expire or are overwritten under the provider’s applicable cycle and are not normally available for routine restoration of individual submissions. Information lawfully retained to document security incidents, compliance, disputes, billing or deletion events is restricted to those purposes. We may retain aggregated information that cannot reasonably identify a person for longer periods.
9. Your privacy rights and requests
Your rights depend on your location, the law that applies, and whether Haftware or the customer controls the specific processing. For information Haftware controls, you may have rights to access, confirm processing, obtain a copy, correct, delete, restrict or object to processing, receive portable information, withdraw consent where consent is the applicable basis, and request information about sharing and international transfers. Some rights are subject to legally recognized exceptions and reasonable identity verification.
Brazil. Where LGPD applies, the rights under Articles 18 and 19 may include confirmation, access, correction, anonymization/blocking/deletion where appropriate, portability as regulated, information on sharing, review of applicable automated decisions, and petition to the Autoridade Nacional de Proteção de Dados (ANPD) at https://www.gov.br/anpd.
EU/EEA and UK. Where GDPR/UK GDPR applies, rights may include access, rectification, erasure, restriction, portability, objection, withdrawal of consent and protections concerning applicable automated decision-making. You may lodge a complaint with a competent supervisory authority (EU: https://www.edpb.europa.eu/about-edpb/about-edpb/members_en; UK: https://ico.org.uk/).
United States. Residents of California and other states may have rights under applicable state privacy laws, depending on statutory applicability: to know/access, correct, delete, obtain portable data, appeal certain denials where required, and opt out of legally defined sales, sharing, targeted advertising or certain profiling. We do not currently sell or share personal information for cross-context behavioral advertising as described in Section 4, and we do not knowingly use sensitive personal information for purposes that trigger California’s right to limit under the processing described here. We do not discriminate unlawfully for exercising protected privacy rights. Authorized agents may act for a person when applicable law permits and authorization is verified.
How to contact us: Email privacidade@taggor.dev, describing the account, the relevant website/component where applicable, your request and a safe way to respond. We may ask for information reasonably needed to verify the request, and respond within the period applicable law requires. If the information is controlled by a customer, we will ordinarily direct or forward the request to that customer when we can identify it, and assist as the DPA and law require. We will not disclose another person’s data merely because it was requested.
10. Security and incidents
We use administrative, technical and organizational safeguards appropriate to the Service and the risks involved, including workspace access controls, account and credential protections, protected communications, selected logging and audit controls, and measures designed to reduce risks from customer code and unauthorized operations. Security arrangements are described in more detail in the DPA, where applicable. No online service or automated code check guarantees that customer-published components are safe or that an incident cannot occur.
When we act as processor/service provider, we inform affected customers of relevant security incidents as required by the DPA and law so they can assess and perform their controller obligations. When we act as controller, we assess whether and when notification to individuals or regulators is required and provide it within applicable legal periods. We do not automatically assume the customer’s notification duties for the customer’s independently controlled submissions.
11. Children and sensitive information
Taggor accounts are intended for adults aged 18 or older acting in a business or professional context. We do not design the Taggor account service for children or knowingly solicit their account registration. Because customers control their embedded components, we cannot guarantee that no visitor under 18 ever interacts with a customer website. Customers must comply with laws governing children and sensitive information, including obtaining any required parental authorization and avoiding uses prohibited by our Terms. If you believe a customer component improperly collected a child’s information, contact the website operator and/or privacidade@taggor.dev with relevant details.
We do not require sensitive personal information in ordinary account registration. Customers must not use components to collect restricted categories in breach of the Terms or law. We do not undertake to detect or classify every submitted value.
12. Changes to this Policy
We may update this Policy to reflect changes to the Service, our practices or applicable law. We will publish the updated version and revision date. For material changes, we will provide additional notice or obtain consent when required by applicable law. Changes do not retroactively authorize processing for materially new purposes where additional notice, consent or other lawful grounds are required. Any contractual amendments follow the amendment provisions of the Terms; a Privacy Policy update is not, by itself, a waiver of legal rights.
13. Contact and related documents
Haftware Sistemas de Internet Ltda.
CNPJ: 31.659.341/0001-05
Rua Silveira Martins, No. 810, Suite 504, Centro
Novo Hamburgo, RS 93510-310 — Brazil
Privacy and data-subject requests: privacidade@taggor.dev
General/contractual inquiries: contato@taggor.dev
Abuse and security reports: abuse@taggor.dev
Related materials available in the Service’s Legal section include the Terms of Service, the Data Processing Addendum (DPA) (automatically incorporated into the Terms for applicable Customer Personal Data), and the Subprocessor List. If a data-protection officer or EU/UK representative must be formally designated under applicable law, the required identity and contact details will be made publicly available through the relevant legal notice.