Privacy Policy

Data controller

The controller of the personal data processed on this platform is Estimasys Ltda., a Brazilian company headquartered in São Paulo/SP, responsible for operating Estimasys.

Data we collect

Information you provide

• name and email, when creating an account;
• company name and job title, optionally;
• CAD files you choose to upload for analysis;
• content of messages sent through support channels.

Information collected automatically

• IP address, browser type, operating system and language;
• anonymous session identifiers to limit abuse of the free plan;
• technical usage logs for the tools (without the content of the files);
• aggregated performance and stability metrics.

Purposes of processing

We use the data to:

• execute the requested analyses and deliver the results;
• authenticate users and protect account integrity;
• enforce the free plan limit of up to 3 tasks per day;
• provide technical support and answer questions;
• improve the service based on aggregated metrics;
• comply with legal, regulatory and accounting obligations.

Uploaded CAD files

Each file is processed in an isolated environment, encrypted in transit (TLS 1.3) and at rest (AES‑256). Only the components necessary for executing the requested analysis have access to the file, and this access is recorded in auditable logs.

Geometry may be converted into intermediate representations (meshes, detected features, simplified topology). These representations follow the same confidentiality rules as the original file.

Retention

• Anonymous sessions: files and results are deleted within 24 hours after the analysis ends.
• Registered accounts: files remain available in the history until you delete them, or up to 12 months after the last access to the account.
• Technical logs: kept for up to 180 days for security and diagnostic purposes.
• Billing data: kept for the period required by Brazilian tax law (5 years).

Sharing

We share data strictly when necessary, with:

• infrastructure providers (hosting, storage, CDN), under contracts with confidentiality clauses;
• payment processors, exclusively for billing operations;
• public authorities, when required by court order or legal obligation.

We do not sell, rent or transfer personal data to advertisers or any third party for commercial purposes.

Security

We adopt technical and administrative controls to protect information: encryption in transit and at rest, granular access control, multi-factor authentication for staff, environment segregation, periodic audits and a formal incident response plan.

In the event of an incident involving personal data that poses a significant risk, we will notify the affected data subjects and Brazil's National Data Protection Authority (ANPD), as required by the LGPD.

Cookies and similar technologies

We use a reduced set of cookies:

• Essential: authentication, chosen language and abuse prevention. They cannot be disabled.
• Analytics: aggregated and anonymized usage metrics, without individual profiling. They can be disabled in preferences.

We do not use advertising cookies or cross-site tracking.

Your rights as a data subject

Under the LGPD, you may, at any time, request:

• confirmation that we process your data;
• access to the personal data we hold about you;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data;
• portability to another provider;
• deletion of data processed based on consent;
• information about who we share your data with;
• withdrawal of consent, when applicable.

Requests can be made by email to [email protected] and will be answered within 15 days.

Children and teenagers

Estimasys is intended for professionals and companies. We do not knowingly collect data from minors under 18. If we identify such collection, the data will be deleted.

International transfer

To ensure global performance, part of the processing may take place in data centers outside Brazil, in countries that offer a level of protection compatible with the LGPD or under specific contractual clauses with the vendors involved.

Changes to this Policy

This Policy may be updated periodically. Relevant changes will be communicated by email or by a prominent notice on the platform with at least 15 days' notice. The current version will always be available on this page, with the update date shown at the top.

Data officer and contact

Estimasys's Data Protection Officer (DPO) can be contacted by email at [email protected]. For general privacy questions, write to the same email.