Privacy policy

This policy describes the data processed by the website. License presence, optional statistics and feedback from the app are also explained in the NiaBend app privacy notice, version 2026-11-05.1. Usage of the demo version of the software has its own notice: the demo privacy notice, version demo-2026-10-21.1.

1. Who is responsible

The controller of your data is NIA SYSTEMS LTDA, CNPJ 69.515.575/0001-43, Rua Domingos Gionedis, s/nº, Cambuí, Campo Largo – PR, Brazil — the company behind NiaBend. For anything about your data, write to [email protected] or use the contact form.

2. What the site keeps

• Account: name, e-mail, company, tax ID (CNPJ or CPF), phone, country and language. The password is not stored — only an Argon2id hash of it, from which it cannot be recovered.
• Sign-ins: on every login we keep the date, IP address and browser; we also count how many times you signed in each day.
• Purchases: plan, amount, status and dates of each order, the name you asked us to write into the license, the note you wrote on the order and the date you accepted the terms. When payment is by card through the provider, we keep the brand, last 4 digits, expiry and name on the card — never the full number, which stays with the provider.
• Downloads: which installer version you downloaded, when, IP address and browser. If the click comes from a device the program does not run on (a phone, for example), we also keep its operating system (such as “Android”), the date and whether you downloaded anyway or stopped at the warning.
• Video lessons: which lessons you opened, how far you got, how long you watched, in which language and when. It is what lets a lesson resume where you stopped, on any device, and what our team sees to follow how the course is used.
• NiaBend ESA Manager: the access request you make in your account (the optional message, the status of the request and the dates it was made, granted, declined or withdrawn, and who on our team granted it) and each download of the installer, with version, date, IP address and browser. When the installed program looks for a new version, it sends only the installed version and the computer platform, without identifying you; that check is not kept beyond the server’s technical logs.
• Licenses: the company name written into the license, the machine code, the nickname you gave the machine and, on every activation, transfer, renewal or download of the file, the date and IP address.
• Contact messages: name, e-mail, company, phone, subject and message. They also arrive in our mailbox.
• “Notify me”: name, e-mail, company, phone, IP address and browser — even without an account. Used only for the notice you asked for — that the download opened or that the full software was released — and, if you ticked the option, for news. When you ask with your account, the notice takes its details.
• Session: a first-party cookie, needed to keep you signed in.
• Anonymous counters: how many pages the site served per day and how many license checks it received from the program — numbers only, with no IP and no cookie.
• Actions by our team: when someone on our team administers the site, we record what they did, when, from which IP address and on which account, order or license (by its identifier). That is how we check who touched your data and your licenses.

3. Why we keep it (legal basis)

• Performance of a contract (LGPD, art. 7, V): account, licenses, purchases, support, what you watched in the video lessons, so you can resume where you stopped, and the NiaBend ESA Manager access you requested. Without this data there is no way to issue the license, grant the download or serve you.
• Exercise of legal rights (art. 7, VI): the record of each purchase — who accepted, date and time, IP address and browser, the exact version of the terms accepted and the summary shown (price, discount and for how many charges) —, cancellations and reactivations with their reference numbers, and the billing notices sent by email. It is what proves the purchase in a complaint, a payment dispute or a lawsuit.
• Legal obligation (art. 7, II): invoices and payment records, for as long as tax law requires; and the sign-in records, which the Brazilian Internet Act (Marco Civil, art. 15) requires us to keep.
• Legitimate interest (art. 7, IX): IP address and machine code on activations and downloads, to prevent fraud and the use of one license on more than one computer; and app presence, with the approximate country and state of the connection, to monitor where each license is in use; following who watches the video lessons, to improve the course and our support; the operating system of the device on download attempts, to warn about the incompatibility and help those who tried to install on the wrong device; and the record of actions by our team, which also fulfils our security duty (art. 46): knowing who did what.
• Consent (art. 7, I): the notices you ask for (of the download and of the release of the full software), news by e-mail and the usage of the demo version of the software — in the latter case, sending is the condition for using the demo, as the demo notice states prominently (art. 9, § 3). You can withdraw it at any time, and withdrawing does not undo anything already done.

Fraud prevention (legitimate interest, art. 7, IX): to prevent fake sign-ups and abuse of the demo version, we automatically check the sign-up data and the computer where the demo is used. When there is a sign of fraud, the demo download and activation may be held until our team reviews them. You can ask for that review through the contact form (art. 20). Apart from that, we make no automated decisions about you.

4. App data and local files

Drawings, programs, reports, tooling, machines and calibrations stay on your computer. The insights service does not receive these files or CAD documents, file paths or diagnostic logs.

Online license validation works separately from statistics. Presence is part of licensing and does not depend on consent: when available, it sends installation and session identifiers, version and a reduced license proof. If the service does not recognize the installed license, the app also sends that license document, and we record the license's customer, plan, validity, machine identifier and signature, plus the approximate country and state of the connection, for up to 90 days after the last contact to identify licenses in use without registration. When it opens, the software also asks the site for the current announcement, stating the language, the installed version and a reduced license proof, used only to choose the announcement for that plan and version. Only after an explicit choice, usage statistics may send screen and completed-action counters, the views and clicks of each in-app announcement, 6-hour slots and estimated active time, with a separate identifier. In this consented flow and in license presence, the server estimates country and state from the upload connection using a local GeoIP database, without retaining IP addresses, cities or coordinates in insights; for presence, only the most recent contact is kept, deleted 24 hours after the last contact. From these consented uploads we also keep, with no time limit, aggregated and anonymous statistics — counts per feature, month, version and approximate location, how many installations used the software on each day and month and for how long, feedback ratings and each announcement’s numbers per day — with no identifiers, session or license, to track usage over time; to count each month’s installations without repeats, the installation identifier is kept until 30 days after the month ends. Feedback sends a rating and optional comment only on your initiative, without association with your license, account or statistics.

Installing the app and using your license do not depend on accepting statistics or submitting feedback. See the categories, retention periods and how to withdraw your choice or request deletion in the app privacy notice.

Demo version. In the free demo version of the software, sending usage data is the condition for using it and is linked to your account: screen and action counters, demo limits reached, paid features looked for, clicks on "See plans" and on the demo announcement, estimated active time and the approximate country and state of the connection, kept for up to 12 months; after that, only anonymous counts remain, with no link to your account. We use this data to improve the product and so that our sales team can talk to the people trying it. Details, the legal basis and how to withdraw your acceptance are in the demo privacy notice.

5. The machine identification

To issue the license we need a code that identifies the computer. It is derived from a Windows identifier through a cryptographic hash function: the original identifier cannot be recovered from the code, and it reveals no computer name, user, address or any other data about the equipment. We keep this code because it is what ties the license to that machine.

6. Cookies and audience measurement

We use a session cookie needed to keep you signed in and store your theme and measurement preferences in your browser. We use no advertising cookies or third-party analytics scripts.

Only after you agree, our own analytics record public pages visited, access time, active reading time and interest by section, with approximate country and state or region when available. Location is estimated by our access infrastructure; we do not use GPS or store IP addresses in analytics. We do not record form contents, URL parameters or associate visits with your account.

A random identifier is stored in the tab session after consent and renewed after 30 minutes without activity. Audience records are kept for up to 90 days; after that, only each month’s totals remain (pages, countries and regions), with no session or time. Declining does not restrict use of the site. You can withdraw consent through “Privacy preferences” on public pages; collection stops immediately. We respect browser Do Not Track and Global Privacy Control signals. Reports represent only visitors who allowed measurement.

7. Who we share with

Only with those needed for the site to work, and each one gets only what its task requires:

• Hostinger — hosts the site and the database. The server is in the United States.
• Resend — sends the account, license and contact messages, processed in the service's São Paulo region (the company is American). It sees the address and content of every message we send you. Our mailbox, where your messages arrive, is Hostinger Mail.
• Cloudflare — sits in front of the site (proxy and CDN): it receives every request, sees your IP address and the content in transit (including the session cookie and whatever you submit in forms) and caches the static files. It also stores the daily backup of the database (R2), encrypted before it leaves the server with a key Cloudflare does not have.
• Paddle — our official reseller (merchant of record): once sales open, it processes payments, in Brazil and abroad, and receives the buyer's e-mail and country, which the invoice requires. Card data lives with it; we only receive the brand, last 4 digits, expiry, name on the card and the payment status — as section 2 says.

We do not sell or hand over your data. Authorities receive it only when the law requires, under a valid order.

International transfer (LGPD, art. 33): the data is stored in the United States, at Hostinger; the site's traffic passes through Cloudflare and the backups are kept there; e-mail sending (Resend) is processed in Brazil, but by an American company; payments are processed by Paddle, outside Brazil. Protection comes from those providers' contractual clauses and, for the backups, from encryption: outside our server they are unreadable.

8. How long we keep it

• Purchase records (acceptances, versions of the accepted texts and billing notices): 5 years after the end of the subscription, the period during which a claim can still be made (Brazilian Consumer Code, art. 27). They are not deleted or changed before that, neither by the automatic cleanup nor by deleting the account.
• Sign-ins (sessions): 180 days after a session expires, its IP address and browser are erased; the date and the type of device (for example, “Windows · Chrome”) are kept for as long as the account exists.
• E-mail links (verification and password reset): deleted 7 days after they expire.
• IP address and browser on downloads, activations, license events and notify-me requests: cleared after 180 days. The rest of the record stays.
• Download attempts from an incompatible device: the operating system of the device and the date are kept for as long as the account exists and are removed when it is deleted.
• “Notify me”: those who did not ask for news are deleted 90 days after being contacted; those who did stay until they leave the list; requests made by account holders are kept for as long as the account exists.
• NiaBend ESA Manager access request: for as long as the account exists; when the account is deleted, the request message is erased.
• Video lessons: what you watched is kept for as long as the account exists and is removed when it is deleted.
• Contact messages: those from account holders are kept for as long as the account exists, as the support history; the others are deleted 2 years after they were sent.
• Account: for as long as it exists. On request, we delete it within 15 days; orders, licenses and invoices are kept for at least 5 years, anonymized, for tax obligations and as proof of what was purchased.
• Backups (encrypted): 14 days on the server and 90 days in a copy outside it, on the computer of the person responsible for the site; the hosting provider also takes a weekly copy of the whole server, kept for as long as its own policy says.
• Raw data from payment providers (webhooks): deleted after 90 days.
• Anonymous statistics (use of the software and the demo, site audience): no time limit — they are counts only and identify no one.
• Record of actions by our team: actions for 5 years and pages opened for 1 year; the IP address is cleared after 180 days.
• Fraud prevention: the reason for a hold stays while the account exists and is removed when it is deleted; the code of the computer where an account blocked for abuse used the software stays while the block lasts, even after the account is deleted.

9. Your rights (LGPD)

The LGPD (art. 18) entitles you to confirm whether we process your data, access it, correct it, request portability, request deletion and revoke the consent you gave. Ask through the contact form or at [email protected]; we reply within 15 days. To avoid handing your data to someone else, we may ask you to confirm your identity — usually, that the request comes from the account e-mail.

What stays even after deletion: orders, invoices and issued licenses, for at least 5 years, by legal obligation — without your contact details. If you believe we have not handled your data as we should, you may complain to the Brazilian Data Protection Authority (ANPD).

If you are in the European Union or the United Kingdom, the equivalent rights under the GDPR and the UK GDPR apply, and the contact is the same.

10. E-mail communications

• Necessary: account verification, password reset, license ready, NiaBend ESA Manager access granted, billing and replies to what you asked. They are part of the service and cannot be turned off while the account exists.
• Download notice: a single e-mail, to those who left their contact asking for it.
• News: only to those who ticked the option — when creating the account, in the notify-me form or in Account → Profile. We keep the date, origin and IP address of that choice, to be able to prove it was made. Every news e-mail has a link to leave the list: no password, immediate effect. You can also leave in Account → Profile or by writing to [email protected]. News is sent from a sender separate from account messages, so you can filter it without losing the important ones.

11. Security

The site works over HTTPS only. Passwords, session tokens and e-mail links are stored only as hashes: whoever reads the database cannot use them. The same goes for the authorization passwords of our team: sensitive actions in the admin panel require this second password, and every action by the team is recorded. The server runs without privileges and does not hold the key that signs licenses — it is kept off the server. Backups are encrypted with a key that is also kept off the server. The server's technical logs are kept for 30 days. If an incident puts your data at risk, we notify you and the ANPD (art. 48).

12. Minors and changes

The site is aimed at companies and professionals; we do not open accounts for anyone under 18. Relevant changes to this policy are announced by e-mail to everyone with an account. The date at the top is that of the latest version.

13. Data protection officer (DPO)

NIA SYSTEMS LTDA is a micro-enterprise and, as a small-scale processing agent, is not required to appoint a data protection officer (ANPD Resolution CD/ANPD No. 2/2022, art. 11), and has not appointed one. The channel for you, as data subject, and for the ANPD is [email protected], as well as the contact form.