Privacy Policy

1. Who we are

HELPFLUX SOLUÇÕES EM TECNOLOGIA LTDA, registered under CNPJ 58.063.432/0001-21, headquartered in Santa Maria de Jetibá/ES ("HelpFlux", "we"), operates the Hotel em Dia platform (the "Platform"), software for audit checklists, operational audits and document expiry tracking for hotel chains and hotels. This Privacy Policy describes how we collect, use, share and protect personal data, in accordance with Law No. 13,709/2018 (General Data Protection Law, LGPD) and with the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet, Law No. 12,965/2014).

2. Controller and processor

The roles defined in the LGPD apply as follows:

• HelpFlux is the controller of the data of website visitors and of the person who creates and administers the client chain's account.
• For the personal data of the users that the client chain registers (administration, leadership, regional managers, auditors and hotel managers) and the records they make on the Platform, the client chain is the controller and HelpFlux acts as the processor, processing this data according to the chain's instructions and this Policy.

3. Data we collect

• Registration data: name, email and, if provided, phone or WhatsApp number of each user; the role and hotels of each one; the chain's name and, if provided, its CNPJ
• Website contact data: name, email, WhatsApp or phone number and, if provided, the number of hotels of anyone who requests a free resource on the website, such as the document expiry tracking spreadsheet, with the date and the text of the consent
• Usage data: the hotels' documents (file, issue date and expiry date), audits (answers, notes, scores and photos), action plan items (what was done, comments, attachments and approval) and the change log, which records who changed what and when
• Technical and browsing data: IP address, browser, operating system and access times, kept with the session, and the cookies described in section 4

4. Cookies and similar technologies

We only use essential cookies needed for the Platform to work: the session cookie, which keeps you signed in, the one that protects against forged requests and, if you check "Remember me" when logging in, the one that keeps your access. They are essential and cannot be disabled. The browser also stores a display preference (the collapsed side menu), with no personal data.

We do not use advertising cookies. Cloudflare, which protects the website traffic (section 6), may set its own security cookies.

5. Why we use data and on what legal basis

We process personal data for the purposes below, with the corresponding legal bases under the LGPD:

• Providing and maintaining the Platform; storing documents, audits, actions and the change log; calculating the scores and the Operational Health Index: performance of a contract (art. 7, V)
• Building the chain's dashboards and reports: performance of a contract (art. 7, V)
• Sending the service emails (invitations, password creation, document expiry alerts and the weekly summary): performance of a contract and legitimate interest (art. 7, V and IX)
• Assisting anyone who creates an account or requests a demo: preliminary procedures related to a contract (art. 7, V)
• Providing the free resource requested on the website and contacting the person about Hotel em Dia: consent (art. 7, I), which may be withdrawn at any time through the contact in section 13
• Ensuring security, preventing fraud and keeping access logs: compliance with a legal obligation (Marco Civil, art. 15) and legitimate interest (art. 7, II and IX)

6. Sharing and processors

We do not sell personal data. We only share data with those needed to operate the Platform:

• Users of the same chain: each person sees data according to their role and the hotels assigned to them
• Hosting provider: the server where the Platform and the data are stored
• Cloudflare: DNS, proxy and protection of the traffic between the browser and the server
• Resend: sending the Platform's emails (invitations, password creation and alerts)
• Google (Gemini): provider of the artificial intelligence (AI) features that the chain chooses to use, such as reading the checklist the administrator uploads and the document uploaded to the Vault, writing the quarterly summary, suggesting actions, explaining why a hotel's score dropped and answering questions about the chain's numbers. It receives only what is needed and only when someone uses one of these features: the file uploaded for reading, the question typed in the question box and numbers or texts already summarized, which the Platform separates without names of people. The chain can switch off each feature
• Authorities: when required by law, regulation or court order

7. International data transfer

The hosting provider and Cloudflare may process data on servers located outside Brazil, including in the United States. This transfer takes place because it is necessary to provide the contracted service, under the cases set out in article 33 of the LGPD.

When the chain uses an artificial intelligence feature, the content sent to that feature is processed by Google (Gemini) outside Brazil, also under the cases set out in article 33 of the LGPD. If none of these features is used, nothing is sent to Google.

8. Storage and security

The Platform's data is stored on the hosting provider's server (section 6). We use SSL/TLS encryption for data in transit, isolation of data by chain, files (documents, photos and attachments) stored in a private area and delivered only through temporary links, passwords stored as hashes (never in plain text) and appropriate technical and organizational measures to protect information against unauthorized access, loss or alteration.

When the HelpFlux team needs to enter a chain's area to provide support, that access is logged.

9. Data retention

We keep data only for as long as needed for the purposes of this Policy:

• Documents, audits, actions and change log: while the chain's account is active. The Platform does not delete operational records: documents, audits and actions are deactivated or keep versions, so that the history remains verifiable
• Account and usage data, after the account is closed: the chain may request export and deletion; we keep only what the law requires
• Website contact data: until the person withdraws consent or requests deletion

When the chain requests deletion, the data is deleted or anonymized, except for what the law requires us to keep.

10. Your rights (LGPD)

Under the LGPD, you have the right to:

• Confirm whether your data is being processed
• Access your personal data
• Correct incomplete or outdated data
• Request the anonymization, blocking or deletion of data
• Request data portability
• Be informed about who we share your data with
• Withdraw consent at any time

If the data concerns users registered by a client chain (for which we act as processor), we will forward the request to the controlling chain or handle it according to its instructions.

11. Intended audience

The Platform is intended for hotel chains, hotels and their staff aged 18 or over. We do not knowingly collect data from minors. If we identify improper processing of such data, we will take the appropriate steps to delete it.

12. Changes to this Policy

We may update this Policy from time to time. Significant changes will be communicated through the Platform or by email, and the "last updated" date at the top will be revised.

13. Data Protection Officer (DPO) and contact

To exercise your rights or ask questions about privacy, contact our Data Protection Officer (Encarregado):

• WhatsApp: (28) 99974-3099
• Email: [email protected]

You also have the right to file a complaint with the National Data Protection Authority (ANPD). The use of the Platform is also subject to our Terms of Use.