Privacy policy

This policy explains how Aquarela processes personal data in tracker by aquarela: the app at tracker.aquarela.app, the mobile and desktop apps, the public pages that companies publish and the connections with AI assistants such as ChatGPT, Claude and Codex. It follows the Brazilian General Data Protection Law (Law 13.709/2018, the LGPD).

Who we are

The tracker is a product of Aquarela Serviços e Tecnologia Ltda. ("Aquarela"), CNPJ (Brazilian company registry) 36.683.319/0001-06. To talk about privacy or with our data protection officer, write to [email protected].

Aquarela and your company

The tracker is used by companies, which appear in the app as organizations. That is why there are two roles:

• The company's content (tasks, comments, attachments, tickets, documents, status pages and everything else the team puts in the tracker) belongs to the company. The company is the controller of this data, and Aquarela processes this content as a processor, only to provide the service, according to the company's instructions and contract.
• Account, security and service usage data is processed by Aquarela as controller.

If your request is about a company's content (for example, a ticket you opened on its portal), contact that company first. We will help with whatever is needed.

Data we process

• Account: name, email, photo and identifier that come from your aquarela ID account when you sign in, as well as the companies, roles and project profiles you have in the tracker.
• Content: what you and your team record, such as tasks, comments, attachments and evidence, test cases and cycles, releases, documents, hours, ideas and votes.
• Customer service: name, email and messages of whoever opens a ticket on a company's portal, even without an account, and the replies that arrive by email.
• Connections and integrations: credentials for the integrations the company turns on (Slack, GitHub, Sentry, its own AI key), for personal tokens and for connections with AI assistants. We store these credentials encrypted or only as a cryptographic hash.
• Notices: the browser or phone subscription to receive notifications, when you turn notices on.
• Technical data: IP address, browser, device, date and time of access, error logs and the change history of each company.

What we use it for

• Providing the service your company has contracted: sign-in, projects, tasks, customer service, reports and the rest of the app (performance of a contract).
• Keeping the service secure: preventing abuse and fraud, investigating errors and keeping the access logs the law requires (legitimate interest and compliance with a legal obligation, under the Brazilian Internet Civil Framework, the Marco Civil da Internet).
• Sending service emails and notices, such as invitations, assignments and status changes. You choose what to receive in Your account → Notifications.
• Providing support when you contact us.
• Improving the product with aggregated usage numbers, without identifying people.

Aquarela does not sell personal data, does not use data for advertising and does not use companies' content to train AI models.

AI assistant

When someone uses the tracker's AI features (aqua, "Improve with AI", task from text, error triage), the text needed for that action is sent to the model provider: Anthropic, directly or through fal.ai, or the provider of the company's own key. The company decides whether to use the assistant. Aquarela does not authorize these providers to use the content to train models.

What the AI writes may contain errors. Review it before using it.

ChatGPT, Claude, Codex and other assistants

You can connect the tracker to AI assistants through the MCP protocol. The connection only happens after you sign in and authorize it, and it applies to the company you choose. With it, the assistant reads and changes in the tracker, on your behalf, what you can already see and change in that company.

The tracker receives only the requests the assistant makes to it, not your whole conversation. What the assistant does with the data it receives follows the privacy policy of whoever offers it, such as OpenAI or Anthropic. You can revoke the connection at any time in Your account → Connections.

Who we share it with

We use suppliers that process data on our behalf, only to make the service work:

• hosting and database servers contracted by Aquarela;
• Cloudflare, to store files and serve domains;
• Resend, to send and receive emails;
• Anthropic and fal.ai, for the AI features;
• Apple and the browsers' push services, to deliver notifications;
• aquarela ID, Aquarela's sign-in.

When your company turns on an integration (Slack, GitHub, Sentry, webhooks) or publishes a public page (help center, status page, ideas board), the chosen data goes to that service or becomes visible on that page, by the company's decision. We also share data when the law or a competent authority requires it.

Data outside Brazil

Some suppliers are located outside Brazil, mainly in the United States. In these cases, the transfer follows the LGPD, with contractual clauses and appropriate security measures.

How long we keep it

• Account and content: while your company uses the tracker. A deleted task stays in the trash for 30 days, where it can be restored.
• End of contract: the company can export its data before the end. Afterwards, we delete the content within 90 days, except what the law requires us to keep.
• Access logs: 6 months, as the Marco Civil da Internet requires.
• Backups: they are replaced in cycles and the data disappears with them.

Your rights

Under the LGPD, you can request confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about whom we share it with and withdrawal of consent, as well as object to a processing activity. Write to [email protected]. We reply within 15 days.

You can delete your account yourself, on the website or in the app, under “Sua conta → Excluir conta” (the app is in Portuguese). We immediately erase your name, email, photo, access and preferences, along with your aquarela ID account. What you wrote in companies (tasks, comments, messages) stays with them, without your name. A company where you are the only member is deleted with it.

You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).

Security

The tracker uses an encrypted connection (HTTPS), separates each company's data in every query, controls access by role and by project and ends idle sessions. No system is perfect: if there is an incident that may cause relevant risk or harm, we notify the companies, the affected people and the ANPD, as the law requires.

Cookies and storage on your device

We use only the cookie needed to keep you signed in. The app also stores preferences on your device, such as collapsed sections, and what it needs to open without internet. We do not use advertising cookies or third-party tracking cookies.

Minors

The tracker is a work tool and is not intended for people under 18.

Changes to this policy

When this policy changes, we update the date at the top of the page. If the change is relevant, we let you know by email or in the app.