Skip to content
PLCWare
Customer panelTry 30 days

Informative translation. In case of divergence, the Portuguese version prevails, unless the law of your country requires the interpretation most favorable to the consumer.Read the Portuguese version

Privacy Policy

This version is in effect as of: 2026-10-20

This policy explains what data PLCWare collects, why, who we share it with, and what rights you have over it, under Brazil's General Data Protection Law (LGPD) and, if you are in the European Union, the European Economic Area or the United Kingdom, also the GDPR.

Controller and contact

The controller of the data covered by this policy is Nextech Digital Solutions LTDA, CNPJ 43.125.453/0001-57, headquartered at Rua Theofilo Ferreira da Rocha, 359, Caixa D'Água, Três Rios/RJ, CEP 25807-145.

For any privacy matter, including exercising the rights described below, reach us: support@plcware.io

Data we collect

We collect the following data to issue, renew and support your license, apply promotions and run the waitlist:

  • E-mail — identifies your license and is where we send keys and notices.
  • Language — the one we use for e-mails and the customer panel.
  • History of issued keys — the keys themselves are stored encrypted; the date and type of each issuance stay in plain text.
  • Trial requests — when a trial was requested, for which e-mail, the language chosen, the confirmation and key-issuance dates, and the version of the Terms of Use and the EULA you accepted when requesting the trial, with the date of acceptance.
  • Support tickets — reply e-mail, subject, message text, app version, request type, language and protocol number.
  • Subscription data received from Paddle — customer and subscription identifiers, plan, seat count, period, status, the last payment's amount and currency, billing/period-end dates, and a refund date when there is one.
  • IP address — used for rate limiting, stored only as an HMAC for up to 1 hour, and for the Turnstile anti-bot check (sent to Cloudflare); never written to our database.
  • Internal notes — what we write about your case to serve you better — deleted together with your data.
  • Audit log — a record of the administrative actions on your account, kept for 5 years from each entry to prove what was done on it. After you delete your data, your e-mail in it is replaced by a pseudonym, a code calculated from the e-mail with a secret key: the e-mail cannot be recovered from it, but, if you give us the e-mail again, we can locate those records.
  • Voucher redemption — the code, e-mail and language of a redemption request; the confirmation link is valid for 24 hours and unconfirmed requests are deleted by the daily routine.
  • Waitlist — name, country, e-mail and language, the date you gave consent, the confirmation date and, if you leave the list, the date you left; and, for each notice sent, whether it went out or failed.
  • Purchases started on the site — the billing country given, the e-mail typed at checkout, the discounts applied, the version of the Terms of Use and the EULA you accepted when starting the purchase, with the date of acceptance (the first purchase also records that acceptance on your license), and, where applicable, the hold on a spot in a limited promotion.
  • Personal coupons and benefits — the e-mail they were granted to, the promotion they came from, when they were used or withdrawn, and which subscription the discount was applied to.
  • English copy of e-mails — for each e-mail we send in another language, we keep the English text, without the license key and without the e-mail's personal links (for access, confirmation, purchase or leaving the waitlist), which carry secret codes: in their place, the copy tells you to use the original e-mail and, for the key, the customer panel as well. The copy is opened through a secret link in the e-mail itself and is tied to an identifier derived from your e-mail. We use a hash of the link's code to look up the copy. When we keep the sent e-mail to prove or retry delivery, that stored text also contains the full link to the copy.
  • Price notices and billing-correction receipts — the text sent, the destination e-mail and the dates, as proof of the notice or the refund.
  • Notices of changes to the Terms of Use — for each notice of a new version of the Terms of Use and the EULA, the text sent, the destination e-mail, the version announced, the sending dates and, for a change that reduces rights, the date from which the new version applies, as proof of the notice.
  • Trial claim — when a trial key is issued, we record the issuance date and a pseudonym of your e-mail: a code calculated, with a secret key, from the normalized e-mail (without a +tag and, for Gmail addresses, without dots). The e-mail cannot be recovered from it, but we can recognize a new trial request made with the same e-mail.
  • Subscription cancellation — when you cancel from the panel, the date of the cancellation, until when the license stays valid and, if you choose to give them, a reason and a comment (both optional), which we use to understand why customers cancel.
  • Feedback — the e-mail, language, score and comment of whoever answers in the customer panel or in the site's support form (the Feedback option) and, only if you agree to its publication, the name, role and company that may appear next to the testimonial.
  • Browsing data, only if you accept analytics cookies — the pages visited, where the visit came from (referring site and campaign), clicks on downloads and the completed steps of the trial, the waitlist and the purchase (for a purchase, the Paddle transaction number, the plan and the amount; never an e-mail, a name or a phone number), the language, the device and browser type, the approximate location and the random identifier in the Google Analytics cookie. Google uses the IP address only to estimate the location and does not store it.

Payment data — card number, billing address and tax data — is collected and processed directly by Paddle, the merchant of record for the sale; we never store it.

What we use your data for, and the legal basis

We use your e-mail, language, key history, the record of your acceptance of the Terms of Use and the EULA, and the subscription data we receive from Paddle for performance of the contract and for preliminary procedures you requested (LGPD, art. 7, V): processing the trial, issuing and renewing the license, sending the next cycle's key, and providing support. The record of the acceptance and the notices of changes to the Terms of Use also serve to prove what was contracted and notified and to defend rights in legal proceedings (LGPD, art. 7, VI).

We use HMAC-pseudonymized identifiers — derived from the IP address, the e-mail or the session id, depending on the case — in rate-limit counters, and the Turnstile check, which receives the IP address, on the basis of legitimate interest (LGPD, art. 7, IX), for security and abuse prevention on the site's forms and the key-issuing service. You can object to this processing through the contact e-mail; we will assess the request under LGPD, art. 18, §2.

We send these e-mails: trial and voucher-redemption confirmation, key delivery (including complimentary keys), the next cycle's key, a panel access link, support confirmation, notice of a change to the license e-mail, price notices, notices of changes to the Terms of Use and the EULA, billing-correction receipts, purchase links, notices about coupons and benefits and, only to those who signed up, the waitlist e-mails. They are sent from no-reply@plcware.io, and replies go to support@plcware.io. We never send marketing without separate opt-in consent, we never sell your data to third parties, and the site carries no advertising trackers.

The waitlist is based on your consent (LGPD, art. 7, I): you give it in the form and confirm it through the link we e-mail you; without that confirmation, we send no notice. Every notice carries a link to leave the list, and leaving withdraws consent for later sends.

Price notices, notices of changes to the Terms of Use, correction receipts and e-mails about a subscription's discount are part of performing the contract (LGPD, art. 7, V). The personal coupons and benefits we offer, and keeping count of how many times each promotion was used, are based on legitimate interest (LGPD, art. 7, IX), to apply each offer's conditions and prevent abuse.

We keep the audit log, the subscription identifier after deletion and the financial records without e-mail to prove the operations carried out on your account and to defend rights in legal proceedings (LGPD, art. 7, VI) and, on the basis of legitimate interest, to reconcile sales with Paddle (LGPD, art. 7, IX).

The trial claim serves to prevent repeated trials and fraud — one trial per person — on the basis of legitimate interest (LGPD, art. 7, IX). You can object to this processing through the contact e-mail; we will assess the request under LGPD, art. 18, §2.

With your consent (LGPD, art. 7, I), we use Google Analytics to measure how many people visit the site, where they come from and which pages and steps work, so we can improve the site. Google Analytics only loads after you accept analytics cookies in the cookie banner; before that, or if you reject them, no data goes to Google. We do not use this data for advertising or link it to your e-mail or your license, and Google's advertising features stay off. You can change your choice at any time under Cookie preferences, in the footer; rejecting changes nothing in how you use the site.

Processors, other recipients and international transfer

We share or exchange data with the following recipients:

Each one's privacy policy link, and its Data Processing Addendum (DPA) link where it has one, sit next to its description above.

The recipients above process the data in these countries: Cloudflare, on its global network, with the database in eastern North America; Resend, in the United States; Paddle, in the United States and the United Kingdom; GitHub, in the United States; Google, in the United States. For the countries of the European Union, the transfer is based on the adequacy recognized by the ANPD (LGPD, art. 33, I; Resolution CD/ANPD No. 32/2026). For the other countries, which have no adequacy recognized by the ANPD, the transfer to Cloudflare, Resend, Paddle and GitHub is based on the need to perform the contract with you or the preliminary procedures you requested: issuing and delivering the license, sending the e-mails, processing the subscription and providing support (LGPD, art. 33, IX, with art. 7, V). The transfer to Google is based on your specific and highlighted consent, given in the cookie banner, which names that destination (LGPD, art. 33, VIII). We only transfer what is necessary for these purposes. You can ask for more information about these transfers through the contact e-mail.

Validity windows

  • E-mail panel access link (magic link) — 15 minutes, single use.
  • Trial confirmation link — 24 hours.
  • Customer panel session — 30 days, renewed on each visit to the panel; ended at once if you click Sign out.
  • Rate-limit counters — up to 1 hour after the last request counted.
  • Waitlist confirmation link — 7 days.
  • One-click purchase link sent by e-mail — 60 minutes, single use.
  • Purchase link for a personal benefit, sent by e-mail — 90 days.
  • Link to the English copy of an e-mail — 90 days.

How long we keep the records

  • Access-link and session records — deleted automatically by a daily routine — normally within 24 hours after they expire.
  • Unconfirmed trial requests — deleted automatically by a daily routine — normally within 24 hours after the confirmation link expires.
  • A confirmed trial record — e-mail, language, dates and the record of acceptance — kept while your account exists, so we can enforce one trial per person.
  • Subscription and license records, including the acceptance of the Terms of Use and the EULA given at purchase, and the key history — kept while your account exists, with no automatic deletion; you delete them from the panel, once every subscription is canceled, or by e-mail. The sale's fiscal records stay with Paddle.
  • Support tickets — kept, with no automatic deletion by age, until you delete your data or ask for a ticket to be deleted; deleting a ticket does not delete your account. If the ticket has a GitHub issue, its deletion enters a queue: a routine tries to delete it and keeps the request pending until GitHub confirms; if permission is missing, our staff fixes the access or deletes the issue by hand. The English copy of the ticket's confirmation e-mail does not repeat the subject or the message; it expires after 90 days, or earlier, when you delete your data.
  • Unconfirmed waitlist sign-ups — deleted automatically by the daily routine once the confirmation link expires.
  • Confirmed waitlist sign-up — kept until deleted at your request, by e-mail; leaving the list stops the sends and records the date you left, but does not delete the sign-up.
  • E-mail typed at checkout — removed by the daily routine 30 days after the purchase is started or the promotion hold ends; the rest of the record (country, discounts, hold and record of acceptance) is kept without the e-mail for up to 5 years from removal of the e-mail, to reconcile sales with Paddle.
  • Personal coupons and benefits — kept for as long as your account exists, even after they are used or withdrawn, to keep count of each promotion's use.
  • English copies of e-mails — deleted by the daily routine when the link expires.
  • Price notices and correction receipts — kept for as long as the license exists; when you delete your record, the notices are deleted and the receipts lose the e-mail and the text, leaving only the refund's financial data.
  • Notices of changes to the Terms of Use — kept for as long as the license exists and deleted with it. If the license moved to another e-mail and the previous holder deletes their data, we delete the destination e-mail and the text of the notices sent to them; the version announced and the dates stay with the license.
  • Cancellation reason and comment — kept while the license exists and removed with it when you delete your data. If the license moved to another e-mail, the record goes with the license until the new holder deletes their data.
  • Feedback — kept while your account exists or until you ask for its removal, and deleted with the account when you delete your data; that of people who are not customers, until that request, by e-mail. A testimonial only appears on the site with your consent and after our approval, never with your e-mail.
  • Trial claim — the pseudonym and the issuance date are kept for up to 5 years from the issuance of the trial, including after you delete your data, so that deleting an account does not allow a second trial; the daily routine deletes the claim when the period ends.
  • Audience measurement data in Google Analytics — kept for 14 months and then deleted by Google; the Google Analytics cookie lasts up to 395 days from the last visit.

Data held by Paddle, as controller, must be requested directly from Paddle. Cloudflare's technical logs are kept for up to 3 days on Workers Free and up to 7 days on Workers Paid; from 2026-12-01, up to 7 days on both plans. Our database's restore feature (automatic backups) allows going back to any moment in the last 30 days, at most. E-mail delivery records held by Resend are deleted within 30 days.

Your rights (LGPD, art. 18)

You can request confirmation of the processing, access, correction, anonymization, blocking or deletion of unnecessary or excessive data, portability, information about sharing, revocation of consent where applicable, and file a petition with the ANPD (LGPD, art. 18, §1). We answer full-access requests within 15 days.

From the customer panel, you can download your data as JSON at any time, and once every subscription is canceled, delete your record (cancel it in the Paddle portal; if the cancellation was scheduled for the end of the period, deletion becomes available from that date). Outside the panel, we handle the same requests by e-mail: support@plcware.io

Deleting your record removes from our database the e-mail, language, subscription and license records, key history, trial request, access-link and session records, support tickets, waitlist sign-up, personal coupons and benefits, price notices, notices of changes to the Terms of Use and the English copies of e-mails; in purchases started on the site and in correction receipts, the e-mail is removed from the record. A deleted piece of data can remain in the database's automatic backups for up to 30 days, unused, until they are replaced.

A key already issued keeps working until its own expiry date, because it is checked on your own machine, with no call to our servers (offline validation).

After deletion, we keep Paddle's subscription id and the deletion date, with no e-mail attached, for up to 5 years, so that a late-delivered or retried Paddle event cannot recreate your data. The financial records of purchases started on the site, of discounts applied and of billing corrections also remain, without the e-mail and for the same period, to reconcile sales with Paddle. The record of each purchase started includes the version of the Terms of Use and the EULA accepted, with the date of acceptance. The daily routine deletes these records when the period ends. A purchase, refund or discount removal that is still pending keeps only the records needed until it is completed.

To leave the waitlist, use the link in any notice. To delete your sign-up — even if you never bought a license — write to the e-mail above.

When a license's e-mail changes, its records — subscription, keys, trial request, support tickets, internal notes, voucher redemptions, personal coupons and benefits, and completed purchases — move to the new e-mail, even when their content mentions the previous one, because that history is needed to serve the license (LGPD, art. 7, IX). If the holder of the previous e-mail asks for their own data to be deleted, that history is not rewritten; it is deleted when the holder of the new e-mail deletes theirs.

Data Protection Officer (DPO): none appointed — as a small-scale processing agent, the company is exempt from appointing one (Resolution CD/ANPD No. 2/2022, art. 11). Contact channel: support@plcware.io

If you are in the European Union, the European Economic Area or the United Kingdom

In those cases, the GDPR or the UK GDPR also applies to your data. The legal bases equivalent to those described above are performance of the contract (art. 6(1)(b)), legitimate interest (art. 6(1)(f)) and, for the waitlist and analytics cookies, consent (art. 6(1)(a)). In addition to the rights above, you can object to processing based on legitimate interest and complain to the data protection authority of the country where you live.

Brazil has had an adequacy decision from the European Commission since 26 January 2026 (Commission Implementing Decision (EU) 2026/179). For recipients in the United States certified under the EU-U.S. Data Privacy Framework, we use that mechanism (for UK data, where they are also certified under the UK Extension); in the other cases outside Brazil and the European Economic Area, we use the European Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914), with the UK Addendum, provided for in the providers' data processing agreements.

Cookies

We use three strictly necessary cookies, all HttpOnly. The customer panel one keeps your session: it stays in your browser for 30 days, renewed on each visit to the panel, and ends sooner if you click Sign out; our server also enforces that limit. The checkout one is created when you start a purchase and identifies the purchases started in that browser, to limit spot holds in promotions and to let you correct the details of a purchase in progress; it is a session cookie, meaning it ends when you close the browser. The admin panel one is used only by our operators; it is also a session cookie, with a 1-hour limit enforced by the server. Because they are necessary for the service you requested, they do not depend on consent.

The anti-bot check (Turnstile, from Cloudflare) and Paddle's checkout run in their own windows, on those companies' domains, and do not write cookies or data to browser storage on our domain; what they process follows their own policies, linked above. We use no advertising cookies.

Analytics cookies only exist if you accept them in the banner: Google Analytics writes on our domain the _ga cookie, with a random identifier of your browser, and a cookie starting with _ga_ that keeps the state of the visit. They last up to 395 days from the last visit. To change your choice, use Cookie preferences, in the footer: when you reject, we turn Google Analytics off and delete those cookies. Your choice is kept in the browser's local storage, with no personal data, until you change it or clear the site's data. You can also block or delete cookies in your browser's settings.

Complaint to the ANPD

You may also file a petition with Brazil's data protection authority (ANPD), under LGPD art. 18, §1. ANPD website