Privacy policy

Who we are

nydo is a platform for architects and architecture firms to show their clients a project's progress and record their approvals. This policy explains which personal data we process, why, who we share it with, and your rights under Brazil's General Data Protection Law (Law 13.709/2018, LGPD).

Contact for any privacy matter, including our data protection officer: hello@nydo.com.br.

Our role

For the data of people who use nydo as architects (account, firm), we are the controller.

The data a firm puts in its projects, including its clients' data (names, emails, site address, photos, documents and answers), is processed on that firm's behalf: the firm is the controller and we are a processor. Requests about that data can go to the firm or to us, and we forward them to the firm when appropriate.

Data we process

• Account: email and name. If you sign in with Google, Google gives us your name, email and profile photo; we never see your password or any other data in your Google account.
• Firm: name, logo and who is on the team.
• Projects: name, site address (optional), photos, videos, PDFs, options with prices, notes, messages and labels the firm adds.
• Clients of a project: the email and name of the people the firm authorizes to approve.
• Approvals and change requests: the answer, the written note, the person, the date and time, the IP address and browser used, plus a copy of the option as it was at that moment.
• Project link use: when the link and each item were opened and how many times, which the firm sees to know its message arrived.
• Technical data: server access logs and error reports, which we use to keep the service working and secure.
• Use of the service: pages visited, taps and clicks, and session recordings (how the screen behaves while you use nydo), with typed text and emails hidden. We tell people apart by a random code, never by name or email.

What we use it for, and the legal basis

• Providing the service: creating and keeping your account, showing projects to whoever has the link, and recording answers (performance of a contract, art. 7, V).
• Keeping approvals as evidence: nydo exists so that architect and client have a reliable record of what was approved, by whom and when. That's why we keep the IP, browser and the copy of the option (exercise of rights and legitimate interest, art. 7, VI and IX).
• Security and abuse prevention, including bot protection at sign-up (legitimate interest).
• Fixing errors and improving the service, with error reports that carry no name or email (legitimate interest).
• Understanding how nydo is used in order to improve it, such as where people give up on an approval, with usage statistics and session recordings (legitimate interest, art. 7, IX). You can opt out at any time, as explained below.
• Answering you when you contact us.

We don't sell personal data, don't use your data for advertising, and don't train artificial intelligence models on project content.

Cookies and browser storage

We use no advertising cookies. We use the ones the service needs to work, and one for usage analytics, served from our own domain:

• Sign-in session, set by Clerk, our authentication provider.
• Project access (rpl_…): remembers for up to 180 days that this browser opened a project's link, so the client doesn't have to open it again.
• Language (NEXT_LOCALE): the language you chose.
• Usage analytics (ph_…): a random code that tells us it's the same browser from one visit to the next, without telling us who you are.
• Browser local storage for simple preferences, such as tips already dismissed.

To opt out of usage analytics in this browser, use the button below. The choice is stored in the browser itself. We also respect the browser's Do Not Track setting.

Who we share it with

With the firm: whoever has access to a project sees what was published in it, and the firm sees who answered, when, and whether the link was opened. Anyone with a project's link sees what the firm published in it; approvers must confirm their email with a code.

With the providers that run the service for us, each with only what it needs:

• Google Cloud (São Paulo, Brazil): application servers.
• Neon (São Paulo, Brazil): database.
• Cloudflare (United States and global network): file storage, delivery and site protection.
• Clerk (United States): sign-in, verification codes and sending those emails.
• Sentry (United States): error reports.
• PostHog (United States): usage analytics and session recordings.
• Google (sign in with Google, if you choose it).
• ViaCEP: address lookup by postal code, which receives only the postal code.

Some of these providers are outside Brazil. For those transfers, we use providers that contractually commit to data protection standards compatible with the LGPD (art. 33).

We may also share data when the law or an order from a competent authority requires it.

How long we keep it

• Account and projects: while the account is active, or until the firm deletes the project.
• Approvals and change requests: while the project exists, because they are the record architect and client may need to show later. A project with recorded answers cannot be deleted from the app itself; ask us to delete it.
• Error reports and access logs: for short periods set by the providers, usually weeks.
• Usage analytics: session recordings for up to 30 days and usage statistics for up to 1 year.

After that, we delete or anonymize the data, unless the law requires keeping it longer.

Your rights

Under the LGPD, you can ask for: confirmation that we process your data, access to it, correction, anonymization, blocking or deletion of what is unnecessary, portability, information about who we share it with, and review of consent where consent is the basis. You can also complain to Brazil's National Data Protection Authority (ANPD).

To exercise your rights, write to hello@nydo.com.br. We may ask you to confirm your identity. An approval already recorded may be kept after a deletion request when it's needed for the firm's or the client's exercise of rights.

Security

We use encrypted connections, signed and temporary file links, project links the firm can replace at any time, and email confirmation by code before any approval. No system is fully secure; if an incident could cause significant risk, we'll notify those affected and the ANPD.

Children

nydo is not meant for anyone under 18.

Changes to this policy

When this policy changes, we update the date above. If the change is significant, we'll tell you by email or in the service before it takes effect.