Version 2026-08-09.1

Privacy policy

This Policy describes how VORTEX TECNOLOGIA E SOLUÇÕES DIGITAIS LTDA (“VORTEX”, “we”), headquartered in São Paulo/SP, Brazil, handles personal data on k4tron, in compliance with the Brazilian General Data Protection Law (Law 13,709/2018 — LGPD). VORTEX is the controller of the data described here.

Data Protection Officer (DPO) and channel for any privacy matter: support@k4tron.com.

1. What data we process

Account data — name, e-mail and Google identifier (if you sign in with Google) or password (stored only as a cryptographic hash — never in plain text).

Acceptance record — the Terms version accepted, date, time and IP address of each acceptance. It is the contractual evidence of the relationship.

Sessions and devices — session cookies and device connection codes (individually revocable), used to keep you authenticated.

Service usage — credit-consumption events (date, model used, credits charged), which feed your statement and plan metering.

Payment — processed by a certified payment processor. We do not receive or store your card data; we keep only the charge history (amount, date, status) linked to your subscription.

Submitted content — the instructions, code snippets and files you send to the assistant, and the responses generated. This content is the service’s raw material: without processing it, k4tron does not work.

2. What we use it for

  • Providing the service (running your requests on the AI models, metering credits, keeping your session) — legal basis: performance of contract.
  • Billing and invoicing — performance of contract and legal obligation.
  • Security and fraud prevention (login rate limits, blocking accounts with fraud indicators) — legitimate interest.
  • Diagnostics and observability (technical records of calls to investigate errors, quality and cost) — legitimate interest.
  • Transactional communications (e-mail verification, password reset, billing notices). We send no marketing.
  • Legal obligations and dispute defense (e.g. payment chargebacks) — legal obligation and regular exercise of rights.

We do not use your content to train artificial-intelligence models.

3. Who we share it with

We share data only with processors necessary to provide the service, in the following categories:

  • payment processing (your card data is collected directly by the processor — it never passes through us);
  • authentication (when you choose to sign in with a third-party account);
  • artificial-intelligence model providers, which process submitted content to generate responses;
  • transactional e-mail;
  • cloud infrastructure and technical observability.

Some of these processors are located outside Brazil; international transfers occur with the safeguards provided by the LGPD (arts. 33 et seq.). The list of processors is available on request through the privacy channel indicated at the top of this Policy. We do not sell personal data to anyone.

4. How long we keep it

  • Account data and payment history: while the account exists and, after closure, for the period required to meet legal obligations and defend against potential disputes.
  • Terms acceptance record: for the applicable limitation periods, as contractual evidence.
  • Observability records (including submitted content): for the period necessary to operate and diagnose the service, then deleted.
  • Content processed by model providers: handled under each provider’s policies, contractually limited to providing the service.

5. Your rights

The LGPD (art. 18) guarantees you, among others: confirmation that processing exists, access, correction, anonymization or deletion of unnecessary data, portability, information about sharing, and withdrawal of consent.

To exercise them, write to support@k4tron.com. We respond within the legal deadlines. You may also close your account at any time; data deletion follows the periods in section 4.

6. Cookies

We use only essential cookies: authenticated session and language/theme preferences. We use no advertising cookies or third-party tracking.

7. Security

We adopt technical and organizational measures proportional to the risk: encryption in transit (TLS), passwords stored with strong hashing, revocable device codes, restricted infrastructure access and security event logging. No system is infallible; relevant incidents will be communicated as required by the LGPD.

8. Children and teenagers

k4tron is intended for those with capacity to contract: use by a minor requires the assistance of a legal guardian, as set out in the Terms of use. We do not knowingly process minors’ data without guardian consent (LGPD, art. 14); accounts identified in that situation will be closed.

9. Changes

This Policy may be revised. Each version carries its own identifier, shown at the top of this page; relevant changes will be communicated through the platform’s channels.