Privacy

Syntax Lab, Brazilian company registration (CNPJ) 61.779.209/0001-90, operates Backlog Syntax. Thales Gomes is responsible for the product and acts as data protection officer under article 41 of the LGPD, accepting communications from data subjects and from Brazil's National Data Protection Authority (ANPD) at [email protected]. Syntax Lab determines the purposes of account and security data processing. For content entered into workspaces, the controller role depends on who determines its purpose and includes the workspace owner.

• name, email address and password hash to create and authenticate the account, along with the date and version of acceptance of the terms and acknowledgment of this notice;
• sessions, IP addresses and security events associated with sign-in;
• workspaces, projects, tasks, comments, evidence and activity history;
• service account identity, scope and usage, with agent tokens stored as hashes.

Data is used to provide the requested service, authenticate users, isolate workspaces, prevent abuse and fulfill requests and legal obligations. Service provision relies on performance of a contract; abuse prevention relies on legitimate interests with data minimization. We do not use task content for advertising, analytics or model training. When connecting your own agent, you control its permissions and should assess how that agent's provider processes data.

Privacy settings let you export your data and delete your account with explicit confirmation. A workspace's sole owner must first transfer ownership or delete the workspace. Account deletion removes your identity and sessions but does not delete other participants' shared content; retained audit references are pseudonymized. For correction, objection or other rights, contact [email protected]. We verify identity and authorization before fulfilling requests.

Regardless of what the interface already offers, the LGPD guarantees you, upon request:

• confirmation that processing exists, and access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
• portability to another provider, subject to trade and industrial secrets;
• deletion of data processed on the basis of consent, except where the law requires retention;
• information about the public and private entities with which we share data;
• information about the option to withhold consent and about the consequences of refusing;
• withdrawal of consent;
• objection to processing based on legitimate interests where the law is not being complied with.

We respond at [email protected] after verifying your identity. Confirmation and access requests are answered within 15 days, as required by article 19 of the LGPD. If our answer does not satisfy you, you may petition against Syntax Lab before Brazil's National Data Protection Authority under article 18, paragraph 1, of the LGPD, at gov.br/anpd.

The application and database are hosted by Hostinger in São Paulo, Brazil. Cloudflare delivers and protects traffic through its global network. Backups are stored on the VPS and in Google Drive, which may process data outside Brazil. Release and maintenance copies are limited to 14 versions per destination, in addition to Hostinger's automatic weekly VPS backups. This version has no automatic daily database backup; keep exports of important data. Deleted data may remain in backups until expiration and must be reconciled before a restored service goes live. Active data is retained while needed for the service; sessions expire or are revoked. No transactional email provider, Google sign-in, advertising or analytics is enabled in this version. Do not enter sensitive or third-party data without the appropriate authorization and purpose.

Part of the operation processes data outside Brazil. Cloudflare processes request metadata, IP addresses and TLS termination across its global network, and the offsite backup is kept in Google Drive, whose region this integration does not select. The database and the application remain in São Paulo. For Hostinger and Cloudflare, the transfer relies on the contractual clauses of those providers' public data processing agreements, which we reviewed. For Google Drive, we reviewed Google's standard data processing addendum, but contractual coverage specific to this account has not been independently verified, so we do not claim verified coverage for that destination. The full provider inventory, with function, country, data processed and transfer mechanism, is public in docs/privacy/subprocessors.md in the product repository.