TF SoftwareTF Software
‹ Back to home

Privacy Policy

Version 2026-09-02 · updated 2026-09-02

This policy explains what personal data TF Software processes when you use tfsoftware.com.br, create a TF account or sign in to the company console, why we process it, and what you can require from us. It describes the system as it works today.

1. Who the controller is

TF Software, CNPJ 40.673.061/0001-34, with offices at Praça João Duran Alonso, 34 – Cidade Monções, São Paulo/SP, 04571-010, Brazil, is the controller of the data described here. For anything concerning personal data, write to contato@tfsoftware.com.br

2. What we collect

We collect only what is needed to create your account, keep it secure and give you access to the products your company has contracted:

  • Account data:name, e-mail, phone (optional), preferred language and time zone. Your password is stored only as a bcrypt hash — never in readable form.
  • Access data:IP address and browser identification at sign-up and at each login, plus the outcome of every attempt (success, wrong password, locked account).
  • Company data:legal name, CNPJ, and each member's role within the company (owner, administrator or member).
  • Verification codes:the six-digit codes e-mailed during sign-up and password reset, with the time they were sent and used.

We do not collect CPF, bank details, card numbers or sensitive data (health, biometrics, racial origin, religious belief or political opinion). The CNPJ lookup checks public company records only and is never performed on a CPF.

3. Our legal basis

  • Performance of a contract (LGPD art. 7, V): creating and maintaining your account, identifying you at login, and granting access to the products your company has contracted.
  • Legitimate interest (art. 7, IX): keeping the platform secure — rate-limiting login attempts, locking accounts under attack, and logging access so misuse can be investigated.
  • Legal obligation (art. 7, II): retaining access logs for the period required by the Brazilian Internet Act (Marco Civil).

4. How long we keep it

Cleanup runs automatically — it does not wait for a request:

  • Verification codes: deleted 30 days after they are created.
  • Login records: deleted 180 days after the event.
  • Account and company data: for as long as the account exists. When you close it, the data is marked deleted and is no longer reachable through the platform, and the e-mail address becomes free for a new sign-up.

5. Who we share with

Three providers receive data, each for a single purpose:

  • SendGrid (Twilio Inc.)— delivery of verification and password-reset e-mails. Receives the recipient address and the message body. Servers in the United States.
  • TF Fiscal— public CNPJ lookup, used to fill in the legal name when a company is registered. Receives only the CNPJ number you type. A service of the TF group itself, in Brazil.
  • Tencent Cloud COS— storage and delivery of the site's images. Receives the IP address and browser identification of page visitors. Servers in São Paulo, Brazil.

We do not sell, rent or hand over personal data for advertising, and the site carries no third-party analytics or tracking.

6. Where the data lives

The platform servers are located in São Paulo, Brazil. There are two international transfers: sending e-mail through SendGrid (United States), based on art. 33, II of the LGPD as necessary to perform our contract with you; and audience measurement through Google Analytics (United States), based on the consent you give in the cookie banner (art. 33, VIII), which you may decline or withdraw by clearing your browser data.

7. How we protect it

The measures below are implemented, not intentions:

  • All traffic uses HTTPS. Passwords are stored as bcrypt hashes, so not even the TF team can read them.
  • A session expires after 8 hours of inactivity and at most 24 hours after login. With «keep me signed in», the limit becomes 30 days.
  • Resetting your password ends every open session on every device. After repeated failed logins the account is locked temporarily.

8. Your rights

LGPD art. 18 gives you the right, at any time, to:

  • confirm that we process your data and obtain access to it;
  • correct incomplete or outdated data — name, phone, language and time zone you can change yourself under «My profile»;
  • request deletion of your account and of any data we are not legally required to keep;
  • know who we share your data with, and withdraw consent where processing relies on it.

To exercise any of these rights, write to contato@tfsoftware.com.br  We will respond within the period set by the LGPD.

9. Cookies

Cookies required to operate the site: the session cookie that keeps you signed in, and your language preference. In addition, we use Google Analytics to measure site usage — those cookies are only enabled if you accept in the banner, and declining does not affect your use of the site. There are no advertising cookies.

10. Changes

If this policy changes, the date at the top of this page is updated. We suggest reviewing it from time to time; the version published here is always the one in force.