CoastalPort Engineering

Draft under legal review. The Portuguese version is the reference version. This is a courtesy translation of the draft; in case of discrepancy, the Portuguese version prevails.

CPE Tools Privacy Policy

Version: 2026-11-12 (draft for legal review) Last updated: 12 November 2026

This Policy explains how CoastalPort Engenharia Ltda., CNPJ CNPJ], with its head office at [FULL ADDRESS] ("CoastalPort"), processes the personal data of those who register for and use the CPE Tools (CoastalWatch, BayShape CPE and XYZ2DXF), in compliance with Law no. 13,709/2018 (Brazilian General Data Protection Law, LGPD). It complements the [Terms of Use.

1. Who the controller is and how to contact us

  1. CoastalPort is the controller of the personal data processed in the CPE Tools.
  2. Data protection officer (DPO): [DPO NAME], e-mail [DPO E-MAIL, e.g. privacidade@coastalport.com.br].
  3. Requests about your data can be made through that e-mail or directly in the "My account" area.

2. What data we collect

2.1 Data you provide at registration

  • Required: full name, e-mail, password, phone, country, company or organisation, type of organisation and purpose of use of the tools.
  • Optional: job title or role, state and city, details of the intended use, tools of interest, how you heard about the CPE Tools and the authorisation to receive news.
  • Password: stored only in encrypted form (hash) by the authentication provider; not even CoastalPort has access to the password in plain text.

2.2 Data generated by use

  • date and time of registration, of each sign-in and of the last access;
  • tool opened, CoastalWatch modules and regions (local models) accessed, data exports and attempts to access features unavailable to the account;
  • a periodic indication of active use (roughly every 5 minutes while the tool is open and in use), to estimate time of use;
  • a random visit identifier, the interface language and the browser identification (user agent) at the time the terms are accepted;
  • a record of acceptance of the Terms of Use, of this Policy and of the communications authorisation, with version and date.

2.3 Data we do not collect

  • We do not use advertising cookies or third-party tracking tools (such as ad networks) in the CPE Tools.
  • Files processed in XYZ2DXF are handled in the browser itself and are not sent to CoastalPort.
  • Points of interest, display preferences and operational limits that you set in the tools are stored only in your browser (local storage), unless the tool itself states otherwise.

3. What we use the data for and on what legal basis

Each purpose is listed with the data used and the legal basis (LGPD, art. 7):

  • Creating and maintaining your account, authenticating access and enabling the features available to it — registration and access data — performance of a contract and of preliminary procedures (item V).
  • Providing support and sending communications required by the service (e-mail confirmation, password recovery, security notices and notices of changes) — name, e-mail, phone — performance of a contract (item V).
  • Ensuring security and preventing fraud and misuse (for example, account sharing and automated access) — access and usage data — legitimate interest (item IX).
  • Producing internal usage statistics to improve the tools and plan their development (most used modules and regions, profile of organisations and purposes of use) — registration and usage data — legitimate interest (item IX), with restricted access and a preference for aggregated data.
  • Sending news about the CPE Tools and CoastalPort — name and e-mail — consent (item I), which may be withdrawn at any time.
  • Complying with legal and regulatory obligations and exercising rights in proceedings — the data needed in each case — items II and VI.

[LEGAL SHOULD CONFIRM THE LEGAL BASES AND, FOR LEGITIMATE INTEREST, PREPARE THE BALANCING TEST (LIA).]

4. Who has access to the data

  1. Within CoastalPort: only the administrator user (master) and expressly authorised people, for the purposes above. Usage statistics are consulted in an internal dashboard with restricted access.
  2. Other users do not see your data. Each user accesses only their own registration. This rule is enforced directly in the database.
  3. Processors (service providers) that process data on behalf of CoastalPort, under contract and with security and confidentiality obligations:
  • Supabase Inc. — database and authentication [SERVER REGION: São Paulo (sa-east-1), TO BE CONFIRMED WHEN CONTRACTING];
  • [WEBSITE HOSTING PROVIDER, e.g. Cloudflare or Netlify] — hosting and delivery of the website;
  • [TRANSACTIONAL E-MAIL PROVIDER, if any] — sending the confirmation and password recovery e-mails.
  1. We do not sell personal data and do not share it with third parties for marketing purposes.
  2. Data may be shared with authorities when there is a legal obligation or a court order.

5. International transfer

Some processors may store or process data outside Brazil (for example, content delivery and e-mail services). In such cases, the transfer is based on art. 33 of the LGPD, through contractual clauses and protection safeguards compatible with the law. [LEGAL SHOULD CHECK EACH PROVIDER'S STANDARD CLAUSES AND RESOLUTION CD/ANPD NO. 19/2024.]

6. How long we keep data

  • Registration data: while the account is active. After the account is deleted, they are erased, except what must be kept to comply with a legal obligation or exercise rights.
  • Access records (date, time and identification): for at least 6 months, as required by art. 15 of the Brazilian Internet Civil Framework (Law no. 12,965/2014). [CONFIRM WHETHER CPE QUALIFIES AS AN APPLICATION PROVIDER FOR THIS PURPOSE.]
  • Tool usage records: up to [24] months in identified form. After that, or when the account is deleted, they are kept only in anonymous form, with no link to the person, for statistics.
  • Acceptance records: for as long as necessary to prove consent and acceptance of the terms.

7. Your rights (LGPD, art. 18)

You may, at any time:

  • confirm whether we process your data and access it — in the "My account" area or through the "Download my data" option;
  • correct incomplete, inaccurate or outdated data — in the "My account" area;
  • delete the account and the data — in the "My account" area, option "Delete my account";
  • withdraw consent to receive news — in the "My account" area;
  • request information about sharing, anonymisation, blocking or deletion of unnecessary data, portability and objection to processing based on legitimate interest — through the DPO's e-mail;
  • lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

We will respond to requests within 15 days, a period that may be adjusted according to ANPD regulations.

8. Security

  1. We adopt technical and administrative measures to protect the data, including: encrypted connection (HTTPS); passwords stored only with irreversible encryption; database access rules that limit each user to their own data; administrative access restricted to the master user; and logging of operations.
  2. No system is completely immune to incidents. In the event of a security incident that may cause relevant risk or damage, we will notify the affected data subjects and the ANPD, under art. 48 of the LGPD.
  3. Protect your password and do not share it. If you suspect misuse, change your password and let us know.

9. Local storage in the browser

The tools store in your browser (localStorage and sessionStorage) the sign-in session, the language, display preferences and points you define. These data are not advertising cookies and are not used to track you on other websites. When you sign out, the session is erased. You can clear these data in your browser settings.

10. Children and adolescents

The CPE Tools are intended for professionals, companies, institutions and students. We do not knowingly collect data from persons under 18 without the consent of their guardians. [ADJUST ACCORDING TO THE RULE ADOPTED IN THE TERMS OF USE.]

11. Changes to this Policy

This Policy may be updated. The current version will always be on this page, with the date of the last update. Relevant changes will be communicated by e-mail or in the tools.

12. Contact

Data protection officer (DPO): [NAME] — [DPO E-MAIL] CoastalPort Engenharia Ltda. — [FULL ADDRESS] — [PHONE]