Data Processing Agreement

Purpose and roles

This agreement governs how Trazza processes the personal data that each customer business uploads to the platform about its end customers, its team, and other people. It forms part of the Terms and Conditions.

The business is the controller and Trazza is the processor: it processes the data on the business's behalf and only to provide it with the service.

If Trazza were to use that data for its own purposes other than the service, it would become the controller for that use. We commit not to do so.

Duration

This agreement applies while the business uses Trazza and, afterward, for the time needed to return or delete the data as described in the return and deletion section.

Nature and purpose of processing

Trazza hosts, organizes, queries, displays, exports, and deletes data to run the schedule, the point of sale, the cash register, inventory, commissions, advances, customer management, the public site, and the artificial intelligence assistant.

It also sends emails on the business's behalf, such as appointment confirmations and reminders, only when the end customer has a recorded email and their contact consent is checked.

Trazza does not sell this data and does not use it for advertising or to train artificial intelligence models.

Types of data and data subjects

The business's end customers: name, email, phone, ID number, date of birth, district or neighborhood, preferred contact channel, date of contact consent, tags, internal notes, follow-ups, appointments, purchases, payments, discounts, and tips.

Team and staff members: name, email, phone, job title, branch, schedules, absences and their reasons, pay rules, commissions, salaries, chair rentals, advances and their installments, tips, and the cash movements they recorded. If the business publishes it, also their profile on the site: display name, job title, bio, and photo.

Business users: role, assigned branches, and the record of their actions. Access data, such as name, email, and password, is processed by Trazza as controller, under the Privacy Policy.

Third parties who appear in files: people mentioned in receipts, invoices, or photos that the business uploads.

Trazza does not ask for sensitive data. If the business writes health information in notes, such as allergies or skin conditions, it must limit it to what is necessary to provide services safely and comply with the rules of its country.

The business's instructions

Trazza processes data only according to the business's documented instructions. Those instructions are the Terms and Conditions, including the Trazza team access you authorize there, this agreement, and what the business configures in the platform: what data it uploads, whom it invites, and what permissions it grants.

If an instruction seems to us to be contrary to the law, we will tell you and may decline to carry it out until it is clarified.

As the controller, your business defines the purposes, informs its customers and its team, and obtains the consents its law requires.

Confidentiality

Trazza personnel who can access this data are bound by confidentiality.

Only people with a platform role and, except for Trazza's general administrators, an assignment to that business can enter a business's account. They enter to provide support, help with setup, or review the account, as the business authorizes in the Terms and Conditions. Each entry is logged and lasts at most 8 hours.

Security measures

Passwords stored with scrypt and a random salt, and session tokens stored only as hashes. Recovery codes and invitations are checked against a hash, but a copy of the email that contains them remains in the sent-email log.

Traffic encrypted with HTTPS and HSTS, a Content Security Policy with a unique value in each response, and an encrypted connection to the database.

Isolation between businesses verified on the server for every action and by the database itself, with automated tests that check it.

Attempt and usage limits, and daily review of attack signals.

Private files in separate storage, delivered only after verifying the session and permissions, and validation of the type and size of every uploaded file.

Audit log of important changes and of access by the Trazza team.

Separate databases and credentials for production and testing.

Subprocessors

To provide the service we use the subprocessors listed in the table on this page. By accepting this agreement, you authorize their use.

Each one receives only the data it needs for its function. OpenAI is used only if your plan includes artificial intelligence and it is turned on. Google Analytics and the bot check on the demo form are not on this list: Trazza uses them for its own purposes, as controller, and the Privacy Policy describes them.

We will notify you in advance of any new or replacement subprocessor, so that you can object on reasonable grounds before it starts processing your data, and we will update this list.

Help with individuals' requests

If an end customer or someone on your team asks to access, correct, or delete their data, or objects to its use, you can handle most of those requests from the platform: edit or deactivate records, delete customers with no sales or appointments, and export the customer base as CSV.

If a request reaches Trazza directly, we will forward it to you without delay and will not answer it ourselves, unless the law requires us to.

We will give you the reasonable information you need to respond to requests, carry out impact assessments, or answer inquiries from an authority.

Security incidents

If we detect a security incident that affects your business's data, we will notify you without undue delay and, where the law of your country sets a shorter deadline for the processor, within that deadline.

The notice will include what we know about the nature of the incident, the data and people affected, its possible consequences, and the measures taken or proposed. We will complete the information as it becomes available.

As the controller, your business decides whether to notify the authority and the affected people. We will give you the information you need to do so.

International transfers

The application and the database run in São Paulo (Brazil). Some subprocessors are in other countries, probably the United States, and file storage could be outside Brazil; this involves international transfers.

Where the law of your country requires safeguards for these transfers, such as standard contractual clauses, we will agree on them with you and with the subprocessors as appropriate.

Return and deletion at termination

During the contract you can export your customer base as CSV. At termination, you can ask us for a copy of any other data you need.

After termination, and at your request, we will delete your business's data within the period required by the applicable law, except data that a law requires us to retain.

Currently, complete deletion of a business is done on request and not from the platform. Audit, sent-email, and artificial intelligence usage logs, and the files the business uploaded, are deleted in a separate step of the deletion process. Copies in our providers' recovery systems may remain for a limited time until they are rotated out.

Information and audits

At your request, we will give you reasonable information to show that we comply with this agreement, such as a description of our security measures and our subprocessors.

If the law of your country requires an audit or inspection, we will coordinate it with you with prior notice, within a reasonable time, and protecting the confidentiality of other customers.

Liability

Each party is liable for its own breaches of this agreement and of data protection law.

The liability limits in the Terms and Conditions apply, except where the law does not allow liability to be limited.