# Privacy policy

## Who we are

TramaMax is a service for fashion professionals, available at tramamax.com, at app.tramamax.com and in the TramaMax apps for iOS, iPadOS and Android. The company that operates TramaMax, based in Brazil, is the controller of the personal data described in this policy. For any privacy question or request, write to [hello@tramamax.com](mailto:hello@tramamax.com). This address also reaches our data protection officer (*encarregado*, under the Brazilian General Data Protection Law, LGPD).

## What this policy covers

This policy explains which personal data we process when you visit our website, create an account, use the app, subscribe to a plan or contact us, why we process it, with whom we share it, and how you can exercise your rights. It applies under the LGPD (Law 13,709/2018) and, for people in the European Economic Area, the United Kingdom and Switzerland, under the GDPR and equivalent laws.

## Data we collect

**Account data.** Your email address, first and last name, optional business name, country and region, language, measurement units and currency. If you sign in with Google or Apple, we receive the identifier and email address of that account.

**Content you create.** Styles, tech packs, patterns, mannequin tables, images, orders, prices, contracts, and the records of clients, suppliers and materials that you enter. Some of this content may contain personal data of other people (for example, a client's name and email). You decide what you enter and you must have a legal basis to do so.

**Payment data.** Payments on the web are processed by Stripe; in the apps, by Apple (App Store) or Google (Google Play). We never receive your full card number. We receive the status of your subscription, the product, the dates, the amount and the country of the purchase.

**Usage and device data.** Server logs with IP address, date and time, the pages and operations requested, browser or device type and app version; security events such as sign-ins, failed codes and changes of email or two-step verification; and a record of each change with the channel used (screen, assistant or MCP).

**AI interactions.** On Plus and Pro, the messages you send to the assistant, the prompts for AI images and contract drafts, and the results, together with the credits used.

**Communications.** The messages you send us and the emails we send you, such as sign-in codes, invitations, receipts and important notices.

**Website.** The website stores your language choice in a cookie (`tm_lang`) and your currency and billing period choices in your browser's local storage. It does not use advertising cookies or third-party trackers. Our network provider, Cloudflare, may set strictly necessary security cookies to protect the site against abuse.

## How we use your data

| Purpose | Legal basis |
| --- | --- |
| Create and secure your account, sign you in and provide the app | Performance of a contract |
| Process subscriptions, credits, receipts and refunds | Performance of a contract; legal obligation |
| Send sign-in codes, invitations, receipts and service notices | Performance of a contract |
| Run AI features that you request | Performance of a contract |
| Prevent fraud and abuse, keep the service secure, and investigate incidents | Legitimate interest; legal obligation |
| Measure and improve the service with aggregated data | Legitimate interest |
| Send news and offers, if you ask for them | Consent, which you can withdraw at any time |
| Comply with tax, accounting and legal requests | Legal obligation |

We do not sell your personal data and we do not use it for third-party advertising.

## Artificial intelligence

When you use an AI feature, we send the instructions and only the records that the task needs to the AI provider that performs it: Anthropic for the assistant, and OpenAI for AI images. We use these providers under commercial terms that do not allow them to train their models on your data. Assistant conversations are kept for a limited period and then deleted. AI results can contain mistakes; review them before you use them.

If you connect an external AI application to TramaMax through MCP, that application acts on your instructions with the permissions you granted. Its provider processes the data under its own terms. You can revoke its access at any time.

## Who we share data with

- **People you choose.** When you share a style or an order, the people you invite see the content of the share and the records linked to it.
- **Service providers** that process data on our behalf, under contract: our hosting provider (servers in Brazil); Cloudflare (network, security and private file storage); Stripe (web payments); Apple and Google (store purchases and sign-in); Resend (email delivery); Anthropic and OpenAI (AI features).
- **Authorities**, when the law requires it or to protect rights, safety and the integrity of the service.
- **A buyer or successor**, if TramaMax is part of a merger, acquisition or reorganization, with the same protections.

## International transfers

Some providers process data outside Brazil and outside your country, for example in the United States and the European Union. We transfer data only with appropriate safeguards, such as standard contractual clauses, adequacy decisions or other mechanisms allowed by the LGPD and the GDPR.

## How long we keep data

We keep your data while your account is active. When you delete your account, we delete your content and personal data, except what we must keep to meet legal obligations, such as payment and tax records, which are kept for the periods required by law. Security logs are kept for a limited time. Backups are overwritten in regular cycles.

## Your rights

You can ask for confirmation that we process your data, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent and review of automated decisions, and you can object to processing based on legitimate interest. You can correct most data and delete your account directly in the app. For other requests, write to [hello@tramamax.com](mailto:hello@tramamax.com); we may need to confirm your identity.

You also have the right to complain to the Brazilian National Data Protection Authority (ANPD) or to the data protection authority of your country.

## Security

We use encryption in transit, private file storage with links that expire after a short time and only after a permission check, two-step verification, access controls, rate limits and a record of every change. No system is perfectly secure; if an incident affects your data, we will notify you and the authorities as the law requires.

## Children

TramaMax is designed for professionals and students aged 16 or older. We do not knowingly collect data from younger children. If you believe that a child has given us personal data, contact us and we will delete it.

## Changes to this policy

We may update this policy. If the changes are significant, we will tell you by email or in the app before they take effect. The date at the top shows the latest version.

## Contact

Questions and requests: [hello@tramamax.com](mailto:hello@tramamax.com).

---

TramaMax · https://tramamax.com/en/ · hello@tramamax.com