Urutau Labs URUTAUlabs

Privacy Policy

Effective as of May 24, 2026

This Privacy Policy describes how the Portaria Digital — Package Management application ("App"), developed by UrutauLabs Soluções Digitais LTDA ("Urutau Labs"), collects, uses, stores, and protects your information. We apply the principles of Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018).

This policy applies to both the iOS (App Store) and Android (Google Play) versions of the App.

1. Data we collect

We collect the following data during your use of the App:

  • Account data — name, email address, and, where applicable, authentication data via third-party providers (e.g., Google). Linked to your identity.
  • Photos and label images — photographs of packages taken by the doorman to record receipt and delivery. Linked to the package record and the building account.
  • Package data — text extracted via OCR (recipient, sender, tracking code), date and time of receipt, responsible staff member, and pickup information. Linked to the building account.
  • Performance and diagnostics — error logs, operating system version, and device model, used solely for App maintenance and improvement. Not linked to your identity.

2. Data we do NOT collect

The App does not collect or request access to:

  • Geographic location (GPS);
  • Device contacts;
  • Financial or payment data;
  • Health or biometric data;
  • Advertising identifiers (IDFA / GAID);
  • Browsing history or data from other apps.

3. Purpose of processing

We use the collected data to:

  • Record and manage the lifecycle of packages at the building;
  • Enable historical queries and movement reports;
  • Identify the staff member responsible for each record;
  • Improve the performance and accuracy of image recognition;
  • Provide technical support to users.

We do not use your data for advertising, third-party marketing, or profile selling.

4. Camera & photos

The App requests camera permission solely to photograph package labels. Images are sent to secure servers for OCR processing and linked to the package record. We do not use images for:

  • Biometric identification or facial recognition of individuals;
  • Advertising or behavioural profiling;
  • Any purpose beyond the operational package record.

If camera permission is denied, the photo-based registration flow will be unavailable; records may still be entered manually by the doorman.

5. Advertising tracking

The App does not track users for advertising purposes. We do not share data with ad networks, do not use advertising identifiers (IDFA/GAID), and do not cross-reference App data with data from other apps or websites for targeted advertising.

6. Third-party services

The App uses the following third-party services for its operation:

  • Supabase — cloud database and authentication platform (supabase.com). Data is stored on servers with encryption at rest and in transit. See the Supabase Privacy Policy.
  • Apple App Store / Google Play — App distribution. Each store has its own data policy regarding downloads and installation.

We do not share personal data with third parties for commercial purposes beyond those listed above.

7. Data sharing

We may share data with:

  • Technology service providers listed in section 6, strictly for App operation, under confidentiality agreements;
  • Competent authorities, when required by law or court order.

8. Security & encryption

We take the following measures to protect your data:

  • Data transmission via HTTPS (TLS 1.2+);
  • Data at rest encrypted by Supabase infrastructure (AES-256);
  • Access control by authentication — each user accesses only their building's data;
  • Passwords are never stored in plain text — authentication managed by Supabase.

9. Data retention

Package records are retained while the account is active. After account closure or deletion, data is deleted within 90 days, unless a legal obligation requires a longer retention period.

10. Account & data deletion

You may request deletion of your account and all associated data at any time at:

urutaulabs.com/portaria/excluir

See that page for details on which data is removed and the processing timeline.

11. Your rights (LGPD)

You have the right to:

  • Confirm the existence of and access your data;
  • Correct incomplete, inaccurate, or outdated data;
  • Request anonymization, blocking, or deletion of unnecessary data;
  • Withdraw consent at any time;
  • Request data portability.

To exercise these rights, send a request to contact@urutaulabs.com.

12. Children

The App is intended for adult professionals (18 years of age or older). We do not knowingly collect data from individuals under 18. If you identify data from minors in our system, please contact us so we can delete it immediately.

13. Policy updates

We may update this Policy periodically. We will notify users through the App or by email with reasonable advance notice before significant changes take effect.

14. Contact

Questions or requests related to privacy: contact@urutaulabs.com
UrutauLabs Soluções Digitais LTDA — Sorocaba, SP — CNPJ 66.251.506/0001-81.