Privacy Notice · Effective 6 Aug 2026 · v2

Privacy, for the people reading about privacy.

This notice covers komploop.com — the public site, its early-access waitlist, and the free assessment. The Komploop product has its own terms, presented at onboarding.

1. Who we are

Komploop is operated by [LEGAL ENTITY NAME — CNPJ 00.000.000/0000-00], [ADDRESS]. Controller contact and data-protection channel: privacy@komploop.com.

2. What we collect

Waitlist: your name, work email, optionally the domain you asked us to assess, and how you found us (the UTM parameters in the link you clicked). Inferred: your company, from your email domain. Technical: standard server access logs (IP address, timestamp), kept for security.

2b. The free assessment

If you run the free assessment, we additionally collect: your answers (the domain, which products and markets to assess, offices, and governance contacts), your name, role, and work email — we compose the address on the domain you asked us to assess, so the report provably reaches someone inside that company. From public pages of that domain we collect what the scan reads: cookies, trackers, published policies, third-party hosts, and the company profile we show you for confirmation. Some of that profiling is assembled with the help of AI models; you confirm or correct every field before anything is scored.

Third-party names. Your company's published privacy policy may name a privacy contact. We read that name from the public policy — published because the law requires it (LGPD Art. 41 §1 / GDPR Art. 37(7)) — show it only to you for confirmation, and include it in your report. Basis: legitimate interest (LGPD Art. 7 IX / GDPR Art. 6(1)(f)). If you are named in someone's report and want that corrected or removed, write to privacy@komploop.com — we act within 15 days.

How long. Assessment answers and the scan record: 12 months from your last interaction, then deleted or anonymized. The report link in your email works for 12 months; after that we archive the report and remove personal names from it. Ask us and we delete report and record immediately.

3. Why, and on what legal basis

• Manage your early-access request and send you beta updates — steps taken at your request prior to a contract (LGPD Art. 7 V / GDPR Art. 6(1)(b)).
• Prepare and email the assessment report you asked for — steps taken at your request (LGPD Art. 7 V / GDPR Art. 6(1)(b)); scanning public pages and keeping an audit record of each assessment — legitimate interest.
• Measure which channels bring signups (UTM) — legitimate interest (LGPD Art. 7 IX / GDPR Art. 6(1)(f)).
• Product news — only with your separate, optional consent (LGPD Art. 7 I / GDPR Art. 6(1)(a)), withdrawable anytime.
• Site security (access logs) — legitimate interest.
• If you later create a Komploop account with this email, we link your waitlist record to prefill your organization profile (LGPD Art. 7 V / GDPR Art. 6(1)(b)).

4. Who receives it

Named processors only: our hosting provider; when beta emails start, our email delivery provider [NAMES + TRANSFER SAFEGUARD when confirmed]; and, for assessment profiling, Anthropic PBC (AI model provider, US) [TRANSFER SAFEGUARD — confirm DPF/SCC status]. No sale, no sharing for advertising, no analytics vendors.

5. How long

Until we resolve your early-access request. If you don't convert to a customer, we delete or anonymize the record within 12 months of your last interaction — or immediately on request.

6. Your rights

Access, correction, deletion, portability, information about sharing, and withdrawal of consent (LGPD Art. 18 / GDPR Arts. 15–22). Write to privacy@komploop.com — we answer within 15 days. You may also complain to the ANPD or your EU supervisory authority.

7. Cookies and measurement

This site sets no cookies. Fonts and images are served from our own servers.

We load Google Tag Manager (Google Ireland Ltd.) with Consent Mode v2 set to denied by default: the container runs in cookieless mode, so nothing is stored on or read from your device — which is why it needs no consent under ePrivacy Art. 5(3) / LGPD. Loading it does send your IP address and user agent to Google as an unavoidable part of any request, on our legitimate interest in measuring how the site performs (GDPR Art. 6(1)(f) / LGPD Art. 7 IX); you can object at privacy@komploop.com. Before any tag that stores cookies or identifiers is switched on, we will ask you first with a consent banner — we build consent tooling for a living.

8. Changes

We version this notice (top of page) and keep a changelog. Material changes get announced to the waitlist.

← Back to komploop.com