Privacy Policy

This Privacy Policy explains how RK Stock Flow (“we,” “our,” or the “Platform”) collects, uses, stores, and protects personal data, in compliance with Brazil’s General Data Protection Law (Law No. 13,709/2018 — “LGPD”). By creating an account or using the Platform, you acknowledge that you have read and agreed to the terms described here. This Policy should be read together with our Terms of Use.

1. Who is the data controller

RK Stock Flow is operated by MATEUS DE M RAMALHO (trade name Ramalho Tech Solutions), registered under Brazilian company ID (CNPJ) 56.183.645/0001-61, acting as the controller of personal data processed on the Platform, as defined under LGPD art. 5, VI.

We do not currently have a formally named Data Protection Officer (DPO), given the size of the operation, pursuant to ANPD Resolution CD/ANPD No. 2/2022, applicable to small-scale data processing agents — but the contact channel below fully handles requests related to personal data and privacy.

2. What data we collect

Account registration data, provided by you or obtained via Google sign-in:

• First and last name
• Email
• Password (stored and managed by Firebase Authentication — we never have access to your password in plain text)
• Date of birth (optional)
• Gender (optional)
• Profile photo (provided via social login or set by you directly in your profile)

Usage and device data, collected automatically by the mobile apps (Stock Flow and Time Track) via Firebase Analytics and Firebase Crashlytics: screen interactions, app usage events, device information, and crash reports. The web app does not currently perform any analytics tracking.

Cookies: we use only one non-tracking, technical cookie to remember your chosen language (locale), valid for one year. We do not use advertising or cross-site tracking cookies.

Data you enter about third parties (your company’s clients and employees), described in section 9 below.

3. How we use your data

We use the collected data to:

• Create and maintain your account and authenticate your access;
• Provide the Platform’s features (inventory management, client and employee records, stock counts, reports);
• Send operational and security notices related to your account;
• Detect, prevent, and investigate fraud, abuse, or misuse of the Platform;
• Diagnose issues and improve the stability of the mobile apps (via Crashlytics/Analytics);
• Comply with applicable legal and regulatory obligations.

We do not sell your personal data and do not use it for third-party targeted advertising.

We do not carry out fully automated decisions that produce legal effects or significantly affect you, without the possibility of human review, as set out in LGPD art. 20.

4. Legal basis for processing

We process your data based on the following legal bases under LGPD art. 7:

• Contract performance (item V): to provide the Platform you signed up for;
• Consent (item I): for voluntary, optional data such as date of birth and gender;
• Compliance with a legal or regulatory obligation (item II), when applicable;
• Legitimate interest (item IX): for fraud prevention and Platform security, always proportionally and without harming your fundamental rights.

5. Who we share your data with

We share personal data only with processors strictly necessary to provide the service:

• Google Firebase (Google LLC): user authentication, and — on the mobile apps — analytics and crash reporting;
• Cloudflare (object/blob storage): storage of files generated by the Platform, such as inventory count exports;
• Google Fonts: the web app’s typefaces are loaded directly from Google’s servers, which may expose your browser’s IP address to Google when the page loads.

Within a shared workspace, a member’s name, email, and profile photo are visible to other members and the workspace owner, for collaboration and team-management purposes.

We do not share your personal data with third parties for marketing purposes.

6. International data transfers

The processors mentioned above (Google and Cloudflare) may process data on servers located outside Brazil. These international transfers rely on standard contractual clauses and other safeguards provided for under LGPD art. 33, including the compliance mechanisms adopted by Google and Cloudflare (such as Standard Contractual Clauses).

7. How long we keep your data

We retain your personal data while your account is active, plus any additional period required to comply with legal, regulatory, or contractual obligations, or to defend rights in potential disputes. When you delete your account (section 9), your registration data is removed, except where retention is legally mandated. Security backups may retain your data for an additional period of up to 30 days after deletion, solely for disaster-recovery purposes, and are permanently erased at the end of that period.

8. Information security

We adopt technical and administrative measures to protect your data, including: authentication and password management via Firebase Authentication (which never exposes your password to us in plain text), encrypted traffic via HTTPS/TLS, and per-account and per-workspace access controls. Despite these efforts, no system is entirely immune to incidents — should a security incident occur that could pose significant risk, you and Brazil’s National Data Protection Authority (ANPD) will be notified as required by LGPD.

9. Your rights as a data subject

Under LGPD art. 18, you may, at any time and by request to the contact channel in section 13:

• Confirm the existence of data processing;
• Access your data;
• Correct incomplete, inaccurate, or outdated data;
• Request anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law;
• Request portability of your data to another service provider;
• Request deletion of data processed based on your consent;
• Obtain information about entities with whom we share your data;
• Withdraw your consent at any time, without affecting the lawfulness of processing carried out beforehand.

As we do not yet have a self-service data export tool, these requests are processed manually, within a reasonable timeframe and in accordance with applicable law.

You can also delete your own account at any time, directly in the Platform, under Settings → Profile → Delete account. This removes your user record and your authentication account (Firebase).

10. Data of clients and employees registered by business users

The Platform lets business users register data about their own clients and employees (such as name, ID document, phone, address, and date of birth) for operational management purposes. Regarding this third-party data, the business user is the controller of that data (per LGPD art. 5, VI), and RK Stock Flow acts as a processor (art. 5, VII), handling the data solely per the business’s instructions and for the Platform’s purposes.

If you are an individual whose data was registered by a business using the Platform (for example, as their client or employee), your rights as a data subject should primarily be exercised with that business, which is the responsible controller. You may still contact us via the channel in section 13, and we will forward your request appropriately.

11. Use by minors

The Platform is intended for professional/business use and is not directed at children or teenagers. Registration presumes full legal capacity (18 years or older) or legal representation of a business entity.

12. Changes to this policy

We may update this Policy periodically to reflect legal, technical, or operational changes. The last-updated date is shown at the top of this page. Material changes will be communicated through the Platform before taking effect.

13. Contact us

To exercise your rights as a data subject or ask questions about this Policy, contact us at: rkstockflow@gmail.com.