# Privacy Policy

How MEPO processes personal data on the site, at sign-up, on the portal and in billing, which cookies it uses, and how you exercise your rights.

> This summary helps you read the document. It is not part of the contract and does not replace it. If there is any difference, the full text applies.

- **Who processes your data**: SUDO TECH controls the data of the site, sign-up, billing and portal use. Data that a customer Organization enters into MEPO is processed on its behalf.
- **What we process**: Contact, sign-up, billing, portal usage and security data. We do not request sensitive data and we do not sell personal data.
- **Cookies and measurement**: On the site, we measure use only after you accept cookies. On the portal, usage measurement is part of the service.
- **Service providers**: We use hosting, payment and usage analytics providers, some of them in the United States, with legal safeguards for the transfer of data.
- **How long we keep data**: Each type of data has a retention period, after which we delete it. An evaluation with no subscription is kept, blocked, for 12 months.
- **Your rights**: Request access, correction, deletion, portability and the other rights under the LGPD and the GDPR at contato@mepo.so. We respond within 15 days.
- **Policy changes**: We notify material changes to this policy by email 30 days in advance.

This page is a translation of the document published in Portuguese (Brazil). The document refers to Brazilian law and to a company established in Brazil. The translation is provided for convenience. If it differs from the original, the Portuguese (Brazil) version prevails.

Updated on October 16, 2026

This policy explains how SUDO TECH SERVICOS TECNOLOGICOS LTDA, which operates MEPO, processes personal data. In this policy, “we” means that company.

## 1. Who we are and how to contact us

**1.1 Controller.** The controller of the data described in this policy is SUDO TECH SERVICOS TECNOLOGICOS LTDA, CNPJ (Brazilian company tax ID) 58.279.772/0001-94, with its registered office at Rua Belo Horizonte, nº 889, Sala Z, Aleixo, CEP 69.060-601, Manaus/AM, Brazil. It operates the MEPO brand.

**1.2 Contact and Data Protection Officer.** For questions, requests and complaints about personal data, write to contato@mepo.so. The Data Protection Officer (Encarregado, under Art. 41 of the LGPD) can be reached at this email address.

**1.3 Data subjects in the European Union.** If you are in the European Union, use the same email address. If we appoint a representative in the European Union (Art. 27 of the GDPR), we will state it here.

## 2. Who this policy applies to

**2.1 Who is covered.** This policy applies to:

(a) anyone who visits the mepo.so site;

(b) anyone who contacts us or requests an evaluation;

(c) anyone who uses the portal (“Users”), as regards account, security and usage data that we process as controller;

(d) anyone who manages the subscription billing of an Organization.

**2.2 When we are a processor.** Data that a customer Organization enters into MEPO, such as supplier records and fiscal documents, is processed on its behalf. For that data, the Organization is the controller and we are the processor, under the Data Processing Annex of the Terms of Service. [Section 6](#organizacoes-clientes) explains how to exercise your rights in that case.

## 3. Data we process

**3.1 Data by situation.** The table shows the data we process in each situation and where it comes from.

**Data by situation**

| Situation | Data | Source |
| --- | --- | --- |
| Visit to the site | IP address, browser, pages accessed, date and time, and language | Generated during the visit |
| Visit to the site, only if you accept cookies | Pages and clicks, origin of the visit (campaign, QR code, search engine or referring site), errors, and session recording with form fields masked | Generated during the visit, with your consent |
| Contact and proposals | Name, email, phone, company, message and service history | Provided by you, through WhatsApp, email or a form |
| Sign-up and free evaluation | Name, email, language, Region, company name, CNPJ (Brazilian company tax ID) or other tax registration, and password (stored only as a hash). On acceptance of the terms: the version, the date and time, the IP address in hashed form, and the browser | Provided by you and generated on acceptance |
| Portal use | Account identifier, name, email and role in MEPO; usage events, screens, errors and session recording with all text masked; session (date, IP address and browser) | Generated by use |
| Billing | Name and email of the person who manages the subscription, billing address, CNPJ or other tax registration, payment method and invoice history. The payment processor processes card data, and we do not see the full card number | Provided by you and by the payment processor |
| Links sent by a customer Organization | Recipient's email, name, comments and decision on a menu review or quote; IP address and browser, for security | Provided by you and generated on access |
| Support | Messages, screenshots and data of the Organization and Unit that you provide | Provided by you |

**3.2 Link between visit and account.** If you accept cookies and later create an account, we may link the visit to the account in order to know which channel brought the sign-up.

**3.3 Sensitive data.** We do not request sensitive personal data. Do not send it.

**3.4 Mandatory data.** To create the account and charge the subscription, we need sign-up and billing data. Without it, we cannot provide the service. The other data is optional.

## 4. What we use the data for and on which legal basis

**4.1 Purposes and legal bases.** The table links each purpose to its legal basis under the LGPD and the GDPR.

**Purposes and legal bases**

| Purpose | Legal basis under the LGPD | Legal basis under the GDPR |
| --- | --- | --- |
| Responding to contacts, evaluation requests and proposals | Art. 7, V (preliminary procedures for a contract) and IX (legitimate interest) | Art. 6(1)(b) and (f) |
| Creating the account, delivering MEPO and providing support | Art. 7, V and IX | Art. 6(1)(b) and (f) |
| Charging the subscription, issuing fiscal documents and keeping records | Art. 7, V and II (legal obligation) | Art. 6(1)(b) and (c) |
| Protecting the service, preventing fraud and abuse, and keeping access logs | Art. 7, II (Marco Civil da Internet, Brazil's internet law) and IX | Art. 6(1)(c) and (f) |
| Analyzing portal use and fixing errors | Art. 7, IX | Art. 6(1)(f) |
| Analyzing site use and the origin of visits | Art. 7, I (consent) | Art. 6(1)(a) |
| Notifying changes to documents, prices and billing | Art. 7, V and IX | Art. 6(1)(b) and (f) |
| Defending rights in proceedings and complying with orders from authorities | Art. 7, II and VI | Art. 6(1)(c) and (f) |

**4.2 Legitimate interest.** When we rely on legitimate interest, we assess its effect on you. You may object, under [section 11](#direitos).

**4.3 Consent.** When consent is the basis, you may withdraw it at any time, without affecting the processing already carried out.

**4.4 Portal surveys.** When short satisfaction surveys appear on the portal, answering is optional. Do not write personal data in the answers.

## 5. With whom we share data

**5.1 Recipients.** We share data with the service providers and recipients below, only as necessary for each purpose.

**Recipients of data**

| Recipient | Purpose | Which data |
| --- | --- | --- |
| Hosting and infrastructure providers | Hosting the site, the portal, MEPO's server and database, protecting access, storing files, sending service emails and counting visits to the site in aggregate, without cookies | All service data |
| Payment processor | Processing the subscription payment | Billing data |
| Usage analytics tool | Usage analytics, error logging and session recording | Usage data. On the site, only with your consent |
| Messaging application (WhatsApp) | Commercial contact, when you write to us through it | Phone number, profile name and messages |
| Corporate email provider | Receiving and replying to emails sent to us | Address and content of messages |
| Accountants, lawyers and other advisers | Meeting obligations and defending rights | Only what is necessary |
| Authorities | Complying with the law or a valid order | Only what is necessary |
| Successor company | In a merger, acquisition or sale of assets, with the same protection | Service data |

**5.2 No sale of data.** We do not sell personal data.

**5.3 Requirements for providers.** We require providers to process data only for the contracted purposes and with adequate security. The providers that process service data are listed, with purpose, country and transfer safeguard, in [Appendix V.19](/en/termos#dpa-anexo-iii) of the Data Processing Annex to the Terms of Service.

## 6. Data processed on behalf of a customer Organization

**6.1 The Organization is the controller.** When MEPO processes your data on behalf of a customer Organization, the Organization is the controller. This happens, for example, if you are a supplier or contact registered by it, or if you received from it a menu-review or quote link.

**6.2 How to exercise your rights.** To exercise your rights over such data, first contact the Organization. If you write to us, we forward the request to it, under the Data Processing Annex of the Terms of Service.

**6.3 Security data.** We process, as controller, the technical security data of access to these links, such as the IP address and browser.

## 7. Cookies and similar technologies

This section explains the cookies and storage items that the mepo.so site and the portal.mepo.so portal save in your browser, by category, with name, purpose and duration.

### 7.1 What cookies are

**7.1.1 Cookies.** Cookies are small files that the site saves in your browser to remember a piece of information, such as the language you chose. Local storage and session storage in the browser work in a similar way and follow the same rules. In this section, “cookies” includes all three.

### 7.2 Categories

**7.2.1 Essential.** They keep your session on the portal, store preferences such as language and theme, remember your choice about cookies and protect the site against bots and attacks. They always work, because without them the site and the portal do not work.

**7.2.2 Measurement.** They show how the site and the portal are used, where visits come from and where errors occur, including the recording of masked sessions, through a usage analytics tool. The site measures use only after you accept the cookie notice. On the portal, measurement is part of the service contracted by the Organization.

**7.2.3 No advertising.** We do not use advertising or marketing cookies.

**Essential cookies**

| Name | Purpose | Duration |
| --- | --- | --- |
| `mepo_locale` | Remembers the language on the site and the portal | 12 months |
| `mepo_consent` | Stores your choice about measurement on the site: accepted or rejected | 12 months |
| `mepo_consent_sync` | Tells the other tabs of the site about your choice, in browsers with no other means of doing so. It is saved and deleted at the same instant | Less than 1 second |
| `mepo-site-theme` and `theme` | Remember the light, dark or system theme | Until you clear the site data |
| `__Secure-portal-auth.session_token` | Keeps your session on the portal | Up to 7 days without use. If you log in without selecting “Remember me”, it ends when you close the browser |
| `__Secure-portal-auth.dont_remember` | Indicates that you did not select “Remember me” | Until you close the browser |
| `mepo:unit-draft:v1:…` and `mepo:command:v1:…` | Store, only in your browser, drafts of forms and command identifiers for each Unit | Until you complete the operation or clear the site data |
| `mepo.home.onboarding.dismissed` | Old item that remembered the dismissal of the first-steps list. The portal reads it and starts storing the information in the account | Until you clear the site data |
| `mepo_locale_sync` | Prevents the page from reloading in a loop when you change the language on the portal | Until the tab is closed |
| `mepo.menu-review.session` and `mepo.menu-review.csrf` | Keep the short session of anyone reviewing a menu by link | Until the tab is closed |
| `__cf_bm` and `cf_clearance` | Protection against bots and attacks, saved by the hosting provider when protection is active | Generally, 30 minutes |

**Measurement cookies**

| Name | Purpose | Duration |
| --- | --- | --- |
| `ph_…` (cookies on .mepo.so) | Identify the browser in the usage analytics tool and store the origin of the first visit, to link the site to the portal | Up to 12 months |
| `ph_…` and `__ph_…` (local and session storage) | Store usage analytics data, such as the session code | Local: until you reject or clear the site data. Session: until the tab is closed |
| `mepo-site-acquisition` | Stores, on the site, a random visit code and the origin labels | Until the tab is closed |

### 7.3 Your choice on the site

**7.3.1 Cookie notice.** The notice appears on your first visit, with “Accept” and “Reject” given equal prominence.

**7.3.2 No choice or rejection.** Until you decide, and if you reject, the site does not start the usage analytics tool, does not save measurement cookies, does not record events, does not measure the origin of visits and does not record sessions.

**7.3.3 Changing your choice.** You may change your choice at any time under “Cookie preferences”, in the footer of any page. When you reject, we stop measurement and delete the measurement cookies from this browser. If you delete the `mepo_consent` cookie, the notice comes back.

**7.3.4 Several tabs.** The decision applies immediately in all open tabs of the site.

### 7.4 How measurement works

**7.4.1 On the site.** If you accept, the usage analytics tool, from a provider in the United States, records pages, clicks, the origin of visits, language and errors and records browsing sessions with form fields masked, so that we understand how the site is used and fix problems.

**7.4.2 Shared cookie.** The measurement cookie applies to the site and to the portal, because it is a cookie on .mepo.so. This lets us recognize the same browser in both. If you log in to the portal later, the cookie is linked to your account.

**7.4.3 Origin of visits.** Also with your acceptance, we measure where visits come from, such as a QR code, a search engine or a campaign. The browser stores a random visit code and the origin labels. We send this data to ourselves to count visits and clicks on contact channels in aggregate. We do not send the page address, search terms or contact data.

**7.4.4 Visit and account.** If you accept and later create an account, we may link the visit to the account, as this policy explains.

**7.4.5 On the portal.** Usage measurement on the portal is part of the service contracted by the Organization and does not depend on the site's cookie notice. It works from the moment the page opens, including on the login screen. Anyone who logs in to the portal is identified in measurement by name, email and role in MEPO.

**7.4.6 Session recording on the portal.** Portal session recording masks all text and all fields. Screens opened through invitation, password-reset, menu-review or supplier-quote links are not recorded.

**7.4.7 Choice on the site and portal.** The site's cookie notice does not control the portal's measurement. If you reject on the site, we delete the shared .mepo.so cookie, and the portal writes it again on the next visit.

**7.4.8 Aggregate count, without cookies.** The hosting provider counts visits and measures the site's performance in aggregate, without cookies and without using browser storage. For that reason the cookie notice does not control this count, which includes the visit before you decide. The legal basis is legitimate interest.

### 7.5 Third-party services

**7.5.1 Payment and WhatsApp.** The payment page belongs to the payment processor and follows its cookie rules. Links to WhatsApp open the WhatsApp app or website, which follow their own rules.

### 7.6 How to manage cookies in your browser

**7.6.1 Browser settings.** You may also delete, block or limit cookies in your browser settings. Blocking the essential cookies may prevent login and other basic functions.

## 8. International transfers

**8.1 Where we process data.** We process data in Brazil and use providers in other countries, especially the United States. The country of each provider is listed in [Appendix V.19](/en/termos#dpa-anexo-iii) of the Data Processing Annex to the Terms of Service.

**8.2 Safeguards.** When we send data to providers outside Brazil, we use a valid mechanism: standard contractual clauses, an adequacy decision, or another mechanism provided for in Art. 33 of the LGPD and Arts. 44 to 49 of the GDPR.

## 9. How long we keep data

**9.1 Periods.** We keep data for the period shown in the table. Afterwards, we delete or anonymize it, unless the law requires retention.

**Retention periods**

| Data | Period | Reason |
| --- | --- | --- |
| Contact messages and data of prospects without a contract | Up to 24 months after the last contact | Resuming the commercial conversation and proving what was processed |
| Evaluation requests made on the site | 30 days after the request | Creating the account and avoiding repeated requests |
| Evaluation account with unconfirmed email | 14 days after sign-up | Allowing the email to be confirmed |
| Evaluation Organization with no subscription | 12 months after the end of the evaluation, with access blocked | Allowing the company to subscribe later and resume its data |
| Access account and record of acceptance of the evaluation | Up to 5 years, or until you request deletion, where the law allows | Proving acceptance of the terms |
| Account and usage data on the portal for those with a contract | While there is a contract and, afterwards, the periods in the Data Processing Annex | Providing the service |
| Records of contract, acceptance, billing and fiscal documents we issue | 5 years after the end of the contract | Tax obligations and periods for defending rights |
| Access records (IP address, browser, date and time) | 6 to 12 months | Marco Civil da Internet (Art. 15) and security |
| Portal and site usage events | Up to 24 months | Product analysis |
| Session recordings | Up to 30 days | Fixing errors |
| Cookie choice | 12 months | Remembering the choice |

## 10. How we protect data

**10.1 Measures.** We protect data with the measures in [Appendix V.18](/en/termos#dpa-anexo-ii) of the Data Processing Annex to the Terms of Service, such as separation between customers, server-side access control, encryption in transit, audit logs and private file storage.

**10.2 Incidents.** If a security incident may cause you significant risk or harm, we notify you and the authority when the law requires it.

## 11. Your rights

**11.1 Which rights.** You may request:

(a) confirmation that we process your data, and access to it;

(b) correction of incomplete, inaccurate or out-of-date data;

(c) anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the law;

(d) portability of the data;

(e) deletion of data processed on the basis of your consent;

(f) information about the entities with which we share data;

(g) information about the possibility of not consenting and the consequences of refusal;

(h) review of decisions made solely by automated processing;

(i) withdrawal of consent.

If the GDPR applies to you, you may also request restriction of processing and object to processing based on legitimate interest.

**11.2 How to request.** Write to contato@mepo.so and state which right you want to exercise. We may ask for information to confirm your identity.

**11.3 Response time.** We respond within 15 days. If the request is complex, we state the reason and the new deadline, which respects the limit of the applicable law.

**11.4 Complaints.** You may complain to the National Data Protection Authority (ANPD), in Brazil, or to the data protection authority of your country in the European Union, such as the National Data Protection Commission (CNPD), in Portugal, or the Spanish Data Protection Agency (AEPD), in Spain. We prefer to resolve matters with you first.

## 12. Automated decisions and artificial intelligence

**12.1 No automated decisions about you.** We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly affect you.

**12.2 Artificial intelligence features.** MEPO has artificial intelligence suggestion features for customer Organizations. They receive only item and preparation text, without account data, and a User confirms every result.

## 13. Children and adolescents

**13.1 Use by companies.** MEPO and the site are for businesses. They are not directed at persons under 18, and we do not knowingly process children's data. If we learn that we do, we delete it.

## 14. Changes to this policy

**14.1 Version in force.** We update this policy when the processing or the cookies change. The version in force is the one published at mepo.so/privacidade, with its date.

**14.2 Notice of material change.** If the change is material, such as a new purpose or a new type of recipient, we notify the Owners of the Organizations by email and, on the portal, the other Users, 30 days in advance, unless the law requires a shorter period.