1. Who we are and our role
Partiu Desenvolvimento de Software Ltda ("Partiu Software", "Partiu", "we", "us") builds software for graduation companies, photography studios, schools, graduating classes, and the people who take part in them. We play two different roles, and the role changes who answers your request:
When we are the business (controller)
For our websites, for accounts you open directly with us, for our own customers' billing, and for our marketing. We decide how that data is used and we answer your requests directly.
When we are a service provider (processor)
When a graduation company, studio, school, or employer uses Partiu to manage your data. That organization is the business; we act on its written instructions and help it answer your request.
If you are not sure who holds your data, send your request to us anyway. If it concerns data we process for a customer, we will tell you who that customer is and forward your request to them, and we will support them in answering it.
2. Notice at Collection
The table below lists the categories of personal information we have collected in the last 12 months, using the categories defined by the California Consumer Privacy Act (Cal. Civ. Code § 1798.140). It also shows why we collect each category, who receives it, and how long we keep it. We collect only what is reasonably necessary and proportionate to these purposes, and we will not use it for a materially different purpose without telling you first.
Name, email, phone, postal address, username, IP address, device and account IDs.Account, service delivery, support, security, communications.Cloud, communication, and payment providers; the organization that manages your graduation or work.While your account or contract is active, then up to 5 years for tax, accounting, and legal claims.
Signature on contracts, government ID number (such as the Brazilian CPF), last four digits and brand of a card.Contracts, billing, invoices, fraud prevention.Payment processors; cloud providers; the organization you contracted with.While your account or contract is active, then up to 5 years for tax, accounting, and legal claims.
Date of birth or age, when a contract or event requires it.Confirming eligibility and legal capacity, protecting minors.Cloud providers; the organization that manages your graduation.While your account or contract is active, then up to 5 years for tax, accounting, and legal claims.
Installment plans, purchases of tickets, photos, albums, and products; payment history.Service delivery, billing, customer support, accounting.Payment processors; cloud providers; the organization you contracted with.While your account or contract is active, then up to 5 years for tax, accounting, and legal claims.
Face geometry used to find you in event photos, only if you turn on facial recognition. Search selfies are processed in memory and discarded.Finding your own photos in a gallery. Nothing else.Cloud providers acting only on our instructions. Never sold, leased, or traded.Deleted within 30 days after you withdraw consent, close your account, or the gallery purpose ends, and never later than 3 years after your last interaction.
Pages viewed, app interactions, logs, browser and device type.Security, debugging, performance, and (with consent) analytics.Cloud providers; Google Analytics as a service provider, if you accept analytics cookies.Security logs up to 12 months; analytics data up to 14 months.
Approximate location from IP. Precise location only in workforce apps (time clock, field staff, fleet, sales), if the employer enables it and you allow it on your device.Security; time-clock and field check-ins for your employer.Cloud providers; your employer.As set by your employer for labor records, normally up to 5 years.
Event photos and videos, live stream recordings, profile pictures, chat messages.Galleries, albums, live streams, and messaging features.Cloud and CDN providers; the studio or organization that owns the content.For the period agreed with the studio or organization, or until you delete it.
Job title, schedule, time-clock records, freelance jobs and payments.Workforce features our customers use to manage their staff.Cloud providers; your employer or contracting company.As set by the employer, as required by labor law.
School, program, class, graduation year, committee role. We do not collect grades or transcripts.Organizing your class, graduation, and events.Cloud providers; the graduation company and class committee.While your account or contract is active, then up to 5 years for tax, accounting, and legal claims.
None. We do not build profiles to predict your preferences or characteristics.Not applicable.Not applicable.Not applicable.
Log-in credentials, government ID, biometrics, precise geolocation, message contents, data of a known child.Only the permitted purposes: providing the service, security, and legal duties.Cloud and payment providers acting on our instructions.Same as the category above it belongs to.
None of these categories are sold or shared. We do not sell personal information and we do not share it for cross-context behavioral advertising, and we have not done so in the last 12 months. We do not offer financial incentives in exchange for personal information.
Purposes, in more detail
- Providing the service: creating accounts, running graduation contracts, installments, events, tickets, galleries, apps, and support.
- Payments: charging installments and purchases through payment processors that are PCI DSS certified. We keep only the last four digits and brand of a card.
- Security and integrity: detecting fraud, abuse, and incidents, and protecting accounts.
- Communications: transactional messages you need (receipts, reminders, event updates) and, only if you opt in, marketing.
- Improving the service: debugging, measuring performance, and building features, using aggregated or de-identified data wherever possible.
- Legal compliance: tax, accounting, and responses to lawful requests.
3. Sources of personal information
- You, when you sign up, fill in forms, make payments, upload content, or contact us.
- The organization that manages your graduation or your work, such as a graduation company, studio, school, class committee, or employer that uses Partiu.
- Your devices, automatically, through logs, cookies, and app telemetry.
- Service providers, such as payment processors confirming a charge.
4. Who receives your information
We disclose personal information for business purposes only, under written contracts that limit how the recipient may use it:
- Cloud and infrastructure providers that host our systems and files (for example, Amazon Web Services).
- Payment processors (for example, Stripe) to complete transactions.
- Communication providers that deliver email, SMS, WhatsApp, and push notifications on our behalf.
- The organization you graduate or work with, when it is the business responsible for your data.
- Professional advisers and authorities, when required by law, to protect rights and safety, or in a merger or acquisition, subject to this notice.
Residents of Oregon, Minnesota, Delaware, and Maryland may ask for the list of specific third parties (or categories of third parties) to which we disclosed their personal information. Use the request form.
5. Sale, sharing, and targeted advertising
We do not sell personal information, we do not share it for cross-context behavioral advertising, and we do not process it for targeted advertising. Our websites use Google Analytics only for measurement, only after you accept analytics cookies, and with Google's advertising features switched off. We do not run advertising pixels.
We also do not engage in profiling in furtherance of decisions that produce legal or similarly significant effects about you. We have no actual knowledge of selling or sharing the personal information of consumers under 16.
Even so, you can record an opt-out, and we honor the Global Privacy Control (GPC) signal as a valid opt-out request for your browser. See Your Privacy Choices.
6. Sensitive personal information
Some of the data above is "sensitive" under state law: account log-in credentials, government identification numbers (such as the Brazilian CPF), biometric data used for facial recognition, precise geolocation from workforce apps, the contents of messages sent through our chat features, and personal data of a known child.
- We collect biometric data and precise geolocation only with your opt-in consent, and you can withdraw it at any time.
- We process personal data of a known child under 13 only with verifiable parental consent, as described in Children and Students.
- We use sensitive personal information only for the purposes permitted by the CCPA regulations (Cal. Code Regs. tit. 11, § 7027(m)): to provide the service you asked for, to keep it secure, and to meet legal obligations. We do not use it to infer characteristics about you. Because of that, the California "right to limit" does not require a separate link, but you can still contact us about it.
7. Your rights
We give the following rights to every U.S. resident, whether or not the law of your state reaches us. Where a state law gives you something extra, you get it too.
No discrimination or retaliation. We will not deny you service, charge a different price, or give you a lower level of quality because you used any of these rights. If you are a California employee, applicant, or contractor of one of our customers, you are also protected against retaliation.
8. How to exercise your rights
- Online: the privacy request form, which gives you a request number to track progress.
- By email: privacidade@partiuformatura.app, with "Privacy request" in the subject.
Verification
To protect you, we verify your identity before we release or delete data. We match what you give us with what we already hold, usually your name and the email on file, and we may ask you to sign in or confirm a code sent to that email. Requests for specific pieces of information or for deletion of sensitive data need a higher degree of certainty. We use the information you give us for verification only to verify you. Opt-out requests do not need verification.
Authorized agents
You may use an authorized agent. We will ask for written permission signed by you (or a valid power of attorney), and we may ask you to confirm your identity directly with us. Parents and legal guardians may act for a child.
Response times
- We confirm receipt within 10 business days.
- We respond within 45 calendar days. If we need more time, we may extend once by up to another 45 days, and we will tell you why.
- We act on opt-out requests as soon as possible and within 15 business days.
- Requests are free. For access and portability, we answer at least twice in any 12-month period without charge. We may decline or charge a reasonable fee only for requests that are manifestly unfounded, excessive, or repetitive, and we will explain why.
9. Appeals
If we decline your request, in whole or in part, you can appeal. Reply to our decision or choose "Appeal a decision" in the request form and include your request number. Someone who did not make the original decision will review it, and we will answer in writing within 45 days (or the period your state requires, if shorter), explaining what we decided and why.
If we deny your appeal, you can contact your state Attorney General. California residents can also contact the California Privacy Protection Agency.
10. State laws covered
This notice is designed to meet the comprehensive consumer privacy laws in force in these states:
- CaliforniaCalifornia Consumer Privacy Act, as amended by the CPRA (CCPA)
- ColoradoColorado Privacy Act (CPA)
- ConnecticutConnecticut Data Privacy Act (CTDPA)
- DelawareDelaware Personal Data Privacy Act
- IndianaIndiana Consumer Data Protection Act
- IowaIowa Consumer Data Protection Act
- KentuckyKentucky Consumer Data Protection Act
- MarylandMaryland Online Data Privacy Act (MODPA)
- MinnesotaMinnesota Consumer Data Privacy Act
- MontanaMontana Consumer Data Privacy Act
- NebraskaNebraska Data Privacy Act
- New HampshireNew Hampshire Privacy Act
- New JerseyNew Jersey Data Privacy Act
- OregonOregon Consumer Privacy Act (OCPA)
- Rhode IslandRhode Island Data Transparency and Privacy Protection Act
- TennesseeTennessee Information Protection Act
- TexasTexas Data Privacy and Security Act (TDPSA)
- UtahUtah Consumer Privacy Act (UCPA)
- VirginiaVirginia Consumer Data Protection Act (VCDPA)
Nevada residents may also direct us not to sell covered information (NRS 603A). We do not sell it, but you can still send that request. Biometric laws (Illinois, Texas, Washington, Colorado) and consumer health data laws (Washington, Nevada) are covered on the Biometric Data Policy page.
11. Additional California disclosures
- Shine the Light (Cal. Civ. Code § 1798.83): we do not disclose personal information to third parties for their own direct marketing purposes.
- Do Not Track: there is no common standard for the browser Do Not Track signal, so we do not respond to it. We do honor Global Privacy Control, and our sites do not track you across third-party websites.
- De-identified data: when we de-identify information, we keep it in de-identified form, we do not try to re-identify it, and we require anyone who receives it to do the same.
- Minors (Cal. Bus. & Prof. Code § 22581): registered users under 18 can ask us to remove content they posted publicly. Removal may not guarantee complete deletion if others copied it.
- Accessibility: this notice is available in an alternative format on request to privacidade@partiuformatura.app.