Summary in plain language
This summary helps you read the document. It is not part of the contract and does not replace it. If there is any difference, the full text applies.
Who processes your data
SUDO TECH controls the data of the site, sign-up, billing and portal use. Data that a customer Organization enters into MEPO is processed on its behalf.
Read in full: Who processes your dataWhat we process
Contact, sign-up, billing, portal usage and security data. We do not request sensitive data and we do not sell personal data.
Read in full: What we processCookies and measurement
On the site, we measure use only after you accept cookies. On the portal, usage measurement is part of the service.
Read in full: Cookies and measurementService providers
We use hosting, payment and usage analytics providers, some of them in the United States, with legal safeguards for the transfer of data.
Read in full: Service providersHow long we keep data
Each type of data has a retention period, after which we delete it. An evaluation with no subscription is kept, blocked, for 12 months.
Read in full: How long we keep dataYour rights
Request access, correction, deletion, portability and the other rights under the LGPD and the GDPR at contato@mepo.so. We respond within 15 days.
Read in full: Your rightsPolicy changes
We notify material changes to this policy by email 30 days in advance.
Read in full: Policy changes
This policy explains how SUDO TECH SERVICOS TECNOLOGICOS LTDA, which operates MEPO, processes personal data. In this policy, “we” means that company.
1Who we are and how to contact us
1.1Controller. The controller of the data described in this policy is SUDO TECH SERVICOS TECNOLOGICOS LTDA, CNPJ (Brazilian company tax ID) 58.279.772/0001-94, with its registered office at Rua Belo Horizonte, nº 889, Sala Z, Aleixo, CEP 69.060-601, Manaus/AM, Brazil. It operates the MEPO brand.
1.2Contact and Data Protection Officer. For questions, requests and complaints about personal data, write to contato@mepo.so. The Data Protection Officer (Encarregado, under Art. 41 of the LGPD) can be reached at this email address.
1.3Data subjects in the European Union. If you are in the European Union, use the same email address. If we appoint a representative in the European Union (Art. 27 of the GDPR), we will state it here.
2Who this policy applies to
2.1Who is covered. This policy applies to:
- (a)anyone who visits the mepo.so site;
- (b)anyone who contacts us or requests an evaluation;
- (c)anyone who uses the portal (“Users”), as regards account, security and usage data that we process as controller;
- (d)anyone who manages the subscription billing of an Organization.
2.2When we are a processor. Data that a customer Organization enters into MEPO, such as supplier records and fiscal documents, is processed on its behalf. For that data, the Organization is the controller and we are the processor, under the Data Processing Annex of the Terms of Service. Section 6 explains how to exercise your rights in that case.
3Data we process
3.1Data by situation. The table shows the data we process in each situation and where it comes from.
| Situation | Data | Source |
|---|---|---|
| Visit to the site | IP address, browser, pages accessed, date and time, and language | Generated during the visit |
| Visit to the site, only if you accept cookies | Pages and clicks, origin of the visit (campaign, QR code, search engine or referring site), errors, and session recording with form fields masked | Generated during the visit, with your consent |
| Contact and proposals | Name, email, phone, company, message and service history | Provided by you, through WhatsApp, email or a form |
| Sign-up and free evaluation | Name, email, language, Region, company name, CNPJ (Brazilian company tax ID) or other tax registration, and password (stored only as a hash). On acceptance of the terms: the version, the date and time, the IP address in hashed form, and the browser | Provided by you and generated on acceptance |
| Portal use | Account identifier, name, email and role in MEPO; usage events, screens, errors and session recording with all text masked; session (date, IP address and browser) | Generated by use |
| Billing | Name and email of the person who manages the subscription, billing address, CNPJ or other tax registration, payment method and invoice history. The payment processor processes card data, and we do not see the full card number | Provided by you and by the payment processor |
| Links sent by a customer Organization | Recipient's email, name, comments and decision on a menu review or quote; IP address and browser, for security | Provided by you and generated on access |
| Support | Messages, screenshots and data of the Organization and Unit that you provide | Provided by you |
3.2Link between visit and account. If you accept cookies and later create an account, we may link the visit to the account in order to know which channel brought the sign-up.
3.3Sensitive data. We do not request sensitive personal data. Do not send it.
3.4Mandatory data. To create the account and charge the subscription, we need sign-up and billing data. Without it, we cannot provide the service. The other data is optional.
4What we use the data for and on which legal basis
4.1Purposes and legal bases. The table links each purpose to its legal basis under the LGPD and the GDPR.
| Purpose | Legal basis under the LGPD | Legal basis under the GDPR |
|---|---|---|
| Responding to contacts, evaluation requests and proposals | Art. 7, V (preliminary procedures for a contract) and IX (legitimate interest) | Art. 6(1)(b) and (f) |
| Creating the account, delivering MEPO and providing support | Art. 7, V and IX | Art. 6(1)(b) and (f) |
| Charging the subscription, issuing fiscal documents and keeping records | Art. 7, V and II (legal obligation) | Art. 6(1)(b) and (c) |
| Protecting the service, preventing fraud and abuse, and keeping access logs | Art. 7, II (Marco Civil da Internet, Brazil's internet law) and IX | Art. 6(1)(c) and (f) |
| Analyzing portal use and fixing errors | Art. 7, IX | Art. 6(1)(f) |
| Analyzing site use and the origin of visits | Art. 7, I (consent) | Art. 6(1)(a) |
| Notifying changes to documents, prices and billing | Art. 7, V and IX | Art. 6(1)(b) and (f) |
| Defending rights in proceedings and complying with orders from authorities | Art. 7, II and VI | Art. 6(1)(c) and (f) |
4.2Legitimate interest. When we rely on legitimate interest, we assess its effect on you. You may object, under section 11.
4.3Consent. When consent is the basis, you may withdraw it at any time, without affecting the processing already carried out.
4.4Portal surveys. When short satisfaction surveys appear on the portal, answering is optional. Do not write personal data in the answers.
5With whom we share data
5.1Recipients. We share data with the service providers and recipients below, only as necessary for each purpose.
| Recipient | Purpose | Which data |
|---|---|---|
| Hosting and infrastructure providers | Hosting the site, the portal, MEPO's server and database, protecting access, storing files, sending service emails and counting visits to the site in aggregate, without cookies | All service data |
| Payment processor | Processing the subscription payment | Billing data |
| Usage analytics tool | Usage analytics, error logging and session recording | Usage data. On the site, only with your consent |
| Messaging application (WhatsApp) | Commercial contact, when you write to us through it | Phone number, profile name and messages |
| Corporate email provider | Receiving and replying to emails sent to us | Address and content of messages |
| Accountants, lawyers and other advisers | Meeting obligations and defending rights | Only what is necessary |
| Authorities | Complying with the law or a valid order | Only what is necessary |
| Successor company | In a merger, acquisition or sale of assets, with the same protection | Service data |
5.2No sale of data. We do not sell personal data.
5.3Requirements for providers. We require providers to process data only for the contracted purposes and with adequate security. The providers that process service data are listed, with purpose, country and transfer safeguard, in Appendix V.19 of the Data Processing Annex to the Terms of Service.
6Data processed on behalf of a customer Organization
6.1The Organization is the controller. When MEPO processes your data on behalf of a customer Organization, the Organization is the controller. This happens, for example, if you are a supplier or contact registered by it, or if you received from it a menu-review or quote link.
6.2How to exercise your rights. To exercise your rights over such data, first contact the Organization. If you write to us, we forward the request to it, under the Data Processing Annex of the Terms of Service.
6.3Security data. We process, as controller, the technical security data of access to these links, such as the IP address and browser.
8International transfers
8.1Where we process data. We process data in Brazil and use providers in other countries, especially the United States. The country of each provider is listed in Appendix V.19 of the Data Processing Annex to the Terms of Service.
8.2Safeguards. When we send data to providers outside Brazil, we use a valid mechanism: standard contractual clauses, an adequacy decision, or another mechanism provided for in Art. 33 of the LGPD and Arts. 44 to 49 of the GDPR.
9How long we keep data
9.1Periods. We keep data for the period shown in the table. Afterwards, we delete or anonymize it, unless the law requires retention.
| Data | Period | Reason |
|---|---|---|
| Contact messages and data of prospects without a contract | Up to 24 months after the last contact | Resuming the commercial conversation and proving what was processed |
| Evaluation requests made on the site | 30 days after the request | Creating the account and avoiding repeated requests |
| Evaluation account with unconfirmed email | 14 days after sign-up | Allowing the email to be confirmed |
| Evaluation Organization with no subscription | 12 months after the end of the evaluation, with access blocked | Allowing the company to subscribe later and resume its data |
| Access account and record of acceptance of the evaluation | Up to 5 years, or until you request deletion, where the law allows | Proving acceptance of the terms |
| Account and usage data on the portal for those with a contract | While there is a contract and, afterwards, the periods in the Data Processing Annex | Providing the service |
| Records of contract, acceptance, billing and fiscal documents we issue | 5 years after the end of the contract | Tax obligations and periods for defending rights |
| Access records (IP address, browser, date and time) | 6 to 12 months | Marco Civil da Internet (Art. 15) and security |
| Portal and site usage events | Up to 24 months | Product analysis |
| Session recordings | Up to 30 days | Fixing errors |
| Cookie choice | 12 months | Remembering the choice |
10How we protect data
10.1Measures. We protect data with the measures in Appendix V.18 of the Data Processing Annex to the Terms of Service, such as separation between customers, server-side access control, encryption in transit, audit logs and private file storage.
10.2Incidents. If a security incident may cause you significant risk or harm, we notify you and the authority when the law requires it.
11Your rights
11.1Which rights. You may request:
- (a)confirmation that we process your data, and access to it;
- (b)correction of incomplete, inaccurate or out-of-date data;
- (c)anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the law;
- (d)portability of the data;
- (e)deletion of data processed on the basis of your consent;
- (f)information about the entities with which we share data;
- (g)information about the possibility of not consenting and the consequences of refusal;
- (h)review of decisions made solely by automated processing;
- (i)withdrawal of consent.
If the GDPR applies to you, you may also request restriction of processing and object to processing based on legitimate interest.
11.2How to request. Write to contato@mepo.so and state which right you want to exercise. We may ask for information to confirm your identity.
11.3Response time. We respond within 15 days. If the request is complex, we state the reason and the new deadline, which respects the limit of the applicable law.
11.4Complaints. You may complain to the National Data Protection Authority (ANPD), in Brazil, or to the data protection authority of your country in the European Union, such as the National Data Protection Commission (CNPD), in Portugal, or the Spanish Data Protection Agency (AEPD), in Spain. We prefer to resolve matters with you first.
12Automated decisions and artificial intelligence
12.1No automated decisions about you. We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly affect you.
12.2Artificial intelligence features. MEPO has artificial intelligence suggestion features for customer Organizations. They receive only item and preparation text, without account data, and a User confirms every result.
13Children and adolescents
13.1Use by companies. MEPO and the site are for businesses. They are not directed at persons under 18, and we do not knowingly process children's data. If we learn that we do, we delete it.
14Changes to this policy
14.1Version in force. We update this policy when the processing or the cookies change. The version in force is the one published at mepo.so/privacidade, with its date.
14.2Notice of material change. If the change is material, such as a new purpose or a new type of recipient, we notify the Owners of the Organizations by email and, on the portal, the other Users, 30 days in advance, unless the law requires a shorter period.