Privacy policy

1. Controller and data protection officer

This Policy explains how RHAEM ("RHAEM") processes personal data in RHAEM DESK under the Brazilian General Data Protection Law (Law 13,709/2018, LGPD).

RHAEM is the controller of registration, authentication, billing, platform security and website data. For the session and device data of each customer company, RHAEM acts as a processor following the customer's instructions; the customer is the controller of that data towards its users.

Data protection officer (DPO): privacidade@rhaem.com.br.

2. Data we process

• Registration and account: name, email, language, password (stored only as an Argon2id hash), two-step verification data, company memberships and access profiles.
• Customer: legal or personal name, Brazilian tax ID (CPF or CNPJ, stored encrypted), contact and billing details and payment history. Card data is handled by the payment processor, not by RHAEM.
• Session data: operator and device identifiers, company, start and end times, permissions granted, acceptance or refusal of consent, reason for ending and audit records.
• Technical telemetry: IP address, connection type (direct or via a TURN relay server), connection quality and duration, app and operating system version, device name and error logs. Telemetry does not include session content.
• Quick Support: temporary session ID, the assisted computer's name shown to the technician and a minimal record of the session, with no account created.
• Website: preferences stored only in your browser (theme and acknowledgement of the storage notice).

We have no access to session content (screen, audio, keyboard, clipboard or files), which is end-to-end encrypted between participants.

3. Purposes and legal bases

• Providing the subscribed service, authenticating users, enforcing plan limits and billing: performance of a contract (LGPD, art. 7, V).
• Security, fraud and abuse prevention, access auditing and application access logs: compliance with a legal obligation (art. 7, II; Brazilian Internet Civil Framework, art. 15) and legitimate interest (art. 7, IX), with data minimization safeguards.
• Tax and accounting records: compliance with a legal obligation (art. 7, II).
• Transactional emails (verification, password recovery, invitations and security alerts): performance of a contract and legitimate interest in account security.
• Defense in legal proceedings: regular exercise of rights (art. 7, VI).

We do not use personal data for advertising, do not sell data and do not make automated decisions with legal effects about you.

4. Sharing and international transfers

We share data only with providers needed for the service, under contract and with minimal data: Cloudflare (hosting, network, database and connection relay servers), Resend (transactional email delivery) and the payment processor indicated at subscription. We may also share data under a court order or a request from a competent authority.

Cloudflare operates a global network and Resend is in the United States, so international data transfers may occur. These transfers rely on contractual data protection clauses and the other grounds of LGPD art. 33, with encryption in transit.

5. Retention

• Company session history and audit trail: according to the subscribed plan (30, 90, 180 or 365 days).
• Application access logs (IP, date and time): 6 months, as required by the Brazilian Internet Civil Framework.
• Account data: while the account is active; deleted within 90 days after closure.
• Tax and billing data: 5 years, as required by tax law.
• Backups: overwritten within 30 days.

6. Your rights

You may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing and withdrawal of consent, and object to processing based on legitimate interest (LGPD, art. 18).

Send your request to privacidade@rhaem.com.br. We may verify your identity first. We reply within 15 days. If the data belongs to a customer company's session, we will forward the request to that company, which is the controller. You may also complain to the Brazilian National Data Protection Authority (ANPD).

7. Security

We use end-to-end encryption for session media, TLS on every connection, Argon2id password hashing, encrypted secrets, two-step verification, explicit consent, role-based access control and auditing. Security incidents that may cause relevant risk or harm are reported to affected data subjects and to the ANPD. To report a vulnerability, write to seguranca@rhaem.com.br.

8. Cookies and local storage

We use only essential storage. The website stores in your browser the chosen theme and the acknowledgement of the storage notice. The /app console uses a strictly necessary session cookie to keep you signed in. We do not use advertising cookies, trackers or third-party analytics tools.

9. Children and teenagers

RHAEM DESK is not intended for people under 18 and we do not knowingly collect children's data to create accounts.

10. Changes

This Policy may be updated. Material changes are communicated by email and in the console before they take effect. Each version is numbered and dated on this page.

Storage on this site

This site uses no tracking cookies or third-party tools. It only keeps essential preferences in your browser: theme and acknowledgement of this notice.