Privacy Policy

Skalyn is a service operated by PUBNIC DESENVOLVIMENTO DE SISTEMAS E MARKETING DIGITAL LTDA, a Brazilian company registered under CNPJ No. 35.191.622/0001-29, with its registered office at Avenida Paulista, 777, 15th Floor, Suite 15, Room 2009, Bela Vista, São Paulo, SP, 01311-914, Brazil ("PUBNIC", "we"). "Skalyn" is the commercial and product name of the service.

For processing activities in which it acts as the controller — such as user account and authentication data, security, subscription and billing, support, and operating the service — the responsible legal entity is PUBNIC, the operator of the Skalyn service. Privacy and personal data protection questions or requests may be submitted to privacy@skalyn.io.

This Policy applies to the website (skalyn.com.br and skalyn.io), the application (app.skalyn.com.br and app.skalyn.io), and the API (api.skalyn.com.br and api.skalyn.io). Brazilian organizations operate in Brazilian reais (BRL) and international organizations operate in US dollars (USD).

It applies to everyone who uses Skalyn: coordinators who manage an organization, volunteers who take part in schedules, and people invited to join an organization.

PUBNIC acts as the controller of users' account and authentication data and of subscription, billing, support, and security data — that is, of the processing needed to operate, protect, and charge for the service itself.

When an organization registers and manages its volunteers' data in Skalyn, that organization is the controller of such data and Skalyn acts as a processor, handling it according to the organization's instructions and this Policy. The organization is responsible for having the authority and a legal basis to register, invite, manage, and communicate with its volunteers.

We collect only the data needed to run the volunteer-scheduling service:

• Account data: first name, last name, email address, phone number (optional), preferred language, and notification preferences.
• Access credentials: your password (stored encrypted, never in plain text) or, if you choose Google sign-in, the authentication data (name and email) provided by your Google account.
• Organization and membership data: the name and type of the organization (for example, NGO, religious, school, or other), your role, and the status of your membership.
• Volunteer data entered by the organization: name, email, and phone number of volunteers registered by a coordinator.
• Operational scheduling data: locations, shifts, assignments, invitations, confirmations, declines, attendance or absence records and any attendance notes, plus activity history and notifications.
• Google Calendar integration data (when enabled): the connected Google account email, the identifier of the created calendar, and a refresh token stored in encrypted form.
• Subscription and billing data: plan, interval, currency, subscription status, current period, and Stripe customer and subscription identifiers. We do not store card numbers — payment is processed directly by Stripe.
• Support and feedback communications: messages you send us, including through the in-app feedback feature.
• Technical and security data: IP address, browser and device information, access logs, session identifier, and security events generated automatically.

Skalyn has no fields designed to collect sensitive personal data (such as religious belief, health, racial origin, or sexual orientation) and asks organizations not to enter unnecessary sensitive data.

Even so, Skalyn is used by churches, faith communities, NGOs, and social projects. Combining a person's identity with the type of organization (for example, "religious"), their participation, their shifts, and their attendance history may, by inference, reveal religious belief or affiliation, or participation in a given community — which may qualify as sensitive personal data under the LGPD.

Where such processing occurs, it serves to enable the scheduling operation contracted by the organization. Each organization, as the controller of its volunteers' data, is responsible for ensuring the appropriate legal basis and, where the LGPD requires it, obtaining the specific and prominent consent of data subjects for sensitive data, collecting only what is necessary.

We process personal data for the following purposes, based on the legal grounds of the LGPD (art. 7) and, where applicable, the GDPR (art. 6):

• Create and maintain your account and grant access to the service — performance of a contract.
• Operate schedules: build shifts, send invitations, and record confirmations, attendance, and absences — performance of a contract.
• Send operational emails (invitations, confirmation requests and reminders, and alerts) — performance of a contract and legitimate interest.
• Manage subscriptions, trials, and billing through Stripe — performance of a contract and compliance with a legal obligation.
• Sync events with Google Calendar, when you authorize it — consent.
• Ensure security, prevent fraud and abuse, apply usage limits, and diagnose errors — legitimate interest.
• Comply with legal and regulatory obligations, including retention of access logs — compliance with a legal obligation.
• Exercise rights in judicial, administrative, or arbitration proceedings — regular exercise of rights.

The processing of any sensitive data follows Section 5, under the responsibility of the controller organization.

We do not sell personal data. We share data only with service providers (processors) that help us operate Skalyn, under contractual security and confidentiality obligations:

• Amazon Web Services (AWS): hosting of the application, database, and files (United States).
• Stripe: payment processing and subscription management.
• Google: login authentication and, when you enable the feature, Google Calendar synchronization.
• Resend (which uses Amazon SES infrastructure): delivery of transactional emails.
• Sentry: error and performance monitoring; it may receive technical data and identifiers to diagnose failures.
• Slack: internal receipt of operational notifications (for example, new sign-ups and feedback messages), which may contain email and the content submitted.
• Cloudflare (Turnstile): protection against automation and abuse at sign-up; it receives technical signals such as the IP address.
• Doppler: secure management of application secrets and configuration (it does not receive volunteer data).

We may also share data when required by law, court order, or a competent authority. An up-to-date list of sub-processors can be requested through the privacy channel.

Our hosting infrastructure is located in the United States (AWS, us-east-2 region). Data from Brazilian and international organizations is processed in that same region in the United States. As a result, your data may be transferred to and processed outside Brazil and the European Economic Area.

Some processors (for example, Stripe, Google, Sentry, Cloudflare, and Slack) may process data in other countries. These transfers rely on art. 33 of the LGPD and Chapter V of the GDPR, with contractual safeguards with our processors intended to ensure a level of protection consistent with applicable law.

We adopt technical and organizational measures to protect personal data, including:

• Encryption in transit (TLS 1.2/1.3) for communication with the service.
• Encryption of data at rest in the database and dedicated encryption of the Google Calendar token.
• Passwords protected with the Argon2 hashing algorithm and session authentication using HttpOnly cookies, inaccessible to browser scripts.
• Logical isolation between organizations (multi-tenant) and role-based access control.
• Edge protection (application firewall) and request rate limits to mitigate abuse, plus anti-automation protection at sign-up.
• Event monitoring, security logs, secret management with encrypted storage, and automated database backups.

No system is entirely immune to incidents. If a security incident occurs that may pose a relevant risk to data subjects, we will notify those affected and the competent authorities as required by applicable law.

We keep personal data for as long as necessary for the purposes of this Policy, according to the following criteria:

• Account and usage data: while your account is active.
• Operational and security logs: kept for about 90 days in active monitoring and archived for up to 12 months, meeting the minimum 6-month retention for application access logs under art. 15 of the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014).
• Billing data: for the period required by applicable tax and regulatory law.
• Database backups: recycled within the backup retention window.
• Pending invitations: expire after 7 days.

When you delete your account or your organization, the associated personal data enters a reversible state and is retained for 30 days; after that period, it is permanently and irreversibly deleted from our production systems by an automated job. The reactivation link sent by email is valid for 24 hours. We may keep a minimal record of the deletion, with no identifiable personal data, as evidence of compliance.

When an organization removes a volunteer or deletes a shift, the record may be kept as the organization's history for as long as the organization exists, for auditing purposes, unless deletion is requested.

At any time, you may exercise the rights provided by the LGPD (art. 18) and, where applicable, the GDPR (arts. 15 to 22):

• Confirm the existence of processing and access your data.
• Correct incomplete, inaccurate, or outdated data.
• Request anonymization, blocking, or deletion of unnecessary data or data processed unlawfully.
• Request portability of your data to another provider.
• Withdraw consent and be informed about the sharing of your data.
• Object to processing based on legitimate interest.

In the app, you can export a copy of your data in JSON format and delete your account at any time; administrators can delete the organization and its data. Deletion follows the 30-day retention schedule described above. You may also write to privacy@skalyn.io.

We do not make solely automated decisions that produce relevant legal effects on you. Requests concerning volunteer data controlled by an organization may require coordination with that organization; in such cases, we act as a processor to assist. You also have the right to lodge a complaint with the Brazilian Data Protection Authority (ANPD) or, for data subjects in the European Union, with the competent supervisory authority.

Skalyn uses only strictly necessary cookies to authenticate your access and maintain your session (including a session cookie and a CSRF-protection cookie). We do not use advertising cookies or behavioral tracking for marketing purposes.

We also use the browser's local storage to keep preferences such as language, theme, and active organization. These are not cookies and are not used for advertising.

For error diagnosis, the Sentry tool may record technical session information. We currently do not load third-party analytics tools by default; if we do, we will do so with the applicable legal basis and consent mechanisms.

The Google Calendar integration is optional and enabled by a coordinator. When enabling it, we request permission to access your Google account email and to create and manage a dedicated calendar ("Skalyn — organization name") in Google Calendar.

With the integration active, we publish shifts as events (title, location, and instructions) and add assigned volunteers as guests, by email. We store, in encrypted form, only a refresh token; we do not store other data from your Google account.

You can disconnect the integration at any time in settings. When you disconnect, or when the organization is deleted, we remove the calendar Skalyn created and its events, revoke the token with Google, and delete the connection from our systems.

Skalyn's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Skalyn is not directed at individuals under 18 and does not ask users for their age. Accounts must be created by adults with legal capacity.

If an organization needs to register underage volunteers, this is done under the organization's responsibility, which must obtain the specific and prominent consent of parents or guardians where required by law and collect only what is necessary. If we learn that we have collected a child's data without an appropriate basis, we will take steps to delete it.

We may update this Policy from time to time. When there are material changes, we will inform you through the service or by email. The date of the last update is shown at the top of this page.

Questions about this Policy or the processing of your data can be sent to our privacy and personal data protection channel at privacy@skalyn.io. For other matters, use contact@skalyn.io.