Documents
Privacy policy.
What we collect when you visit the website or use MadBuilder, what it is for and how to request access, correction or deletion.
Courtesy translation; the Portuguese version prevails. Read the Portuguese version
Summary
- We do not sell anyone's data.
- The website counts visits with Google Analytics, loaded through Cloudflare Zaraz.
- The only form on the website is the quote request form, on the custom development page. What you write in it is used only to answer your request.
- Payments go through Mercado Pago. We do not store card data.
- The data in your projects is yours. We only process it to provide the service.
- To access, correct or delete your data, write to contato@madbuilder.com.br.
Who we are
MadBuilder is a product of MAD Solutions Ltda, CNPJ 51.888.856/0001-86, headquartered at Av. Paulista, 1636, conj. 4, 15º andar, Bela Vista, São Paulo/SP, Brazil, postal code 01310-200. In this policy, "we" means MAD Solutions.
It applies to the madbuilder.dev website and to the MadBuilder platform: the Manager (manager.madbuilder.dev), the editor, the AI agent, the Online Test and MadCloud. For the personal data of your account, we are the controller, as defined by Brazil's General Data Protection Law (LGPD, Law 13,709/2018).
What we collect
When you visit the website
Browsing data: pages viewed, referring site, device and browser type, language and approximate location (from the IP address). The collector is Google Analytics, which runs through Cloudflare Zaraz. We use this data in audience reports, without identifying you by name.
When you create and use an account
- Account data: name, email and password, and access settings such as two-step verification (2FA). If you sign in with an account from another service, we receive from it only what you authorize, such as name and email.
- Platform usage: the actions you take, with date and time, the audit trail (including what the AI agent does on your behalf) and the consumption and cost of each AI call.
- Technical logs: IP address, browser, operating system, date and time of access. They are used for security and to fix failures.
When you subscribe to a plan
We ask for the data needed to issue the invoice, such as your CPF or CNPJ (Brazilian taxpayer ID) and address. Payment is made through Mercado Pago. We receive the payment confirmation and basic payer data, such as the name, but not the card number.
When you request a quote
The form on the custom development page asks for your name, company (if you wish to provide it), WhatsApp, email, the plan you are interested in and a description of what the system needs to do. Along with it, we record the page the request came from, the campaign that brought you (the link's utm parameters, when present), the date and time you accepted this policy and a code computed from the IP address (not the IP itself), to prevent spam and abuse.
We use this data to answer the request, schedule the diagnostic and send the proposal. The legal basis is the performance of preliminary procedures of a contract, at your request (article 7, item V, of the LGPD). Requests are kept in MAD Solutions' internal panel, and a copy arrives in our email. We do not use this data for any other purpose nor pass it on to third parties.
When you contact us
If you write to contato@madbuilder.com.br, we keep the conversation to reply and follow up on your request.
Your projects' data
Inside MadBuilder you store things that are yours: the diagram and the tables, the generated code, the access credentials to your database and servers, the records of the system you publish on MadCloud and the errors MadTrace collects from that system. This often includes personal data of third parties, such as your company's customers.
For this data, you are the controller and we are the processor: we process only what is needed to provide the service, following what you configure. We do not use the content of your projects for any other purpose. Database and server credentials are stored encrypted.
What we use it for
- Providing the service (performance of the contract): creating and maintaining your account, running the editor, the agent, the Online Test and MadCloud, processing payments and providing support.
- Complying with the law (legal obligation): issuing invoices, keeping records required by law and complying with orders from authorities.
- Protecting and improving (legitimate interest): detecting abuse and fraud, investigating incidents, fixing errors and understanding, in aggregate, which features are used.
- Notifying you: sending emails about your account, payments and changes to the service. News and offer emails only with an option to unsubscribe in every message.
Who we share it with
Only with those who need the data for the service to work, and only what is necessary:
- Cloudflare, which delivers the website and runs Zaraz. When enabled, the anti-bot check on the quote form (Turnstile) is also from Cloudflare.
- Google, through Google Analytics.
- Mercado Pago, which processes payments.
- AI providers, when you use the agent. The request and the necessary context (for example, the table structure and code snippets) go to the provider of the call. With your own key (BYOK), it is the provider you chose: Anthropic, OpenRouter, xAI, Z.AI or Ark, and the contract between you and them applies. On the Mad Coding Plan, they are MiniMax models.
- Infrastructure vendors, such as servers, databases and email delivery, which operate under contract and follow this policy.
- Authorities, when there is a legal obligation or a court order.
If the company goes through a merger or sale, the data may be transferred, and this policy continues to apply to it.
Data outside Brazil
MadCloud runs in the São Paulo region. Some vendors, such as Cloudflare, Google and the AI providers, may process data in other countries. In those cases, the transfer follows the cases set out in article 33 of the LGPD, and we choose vendors with data protection commitments compatible with Brazilian law.
How long we keep it
- Account and project data: for as long as the account exists. After it is closed, we delete or anonymize it, except what the law requires us to keep.
- Quote requests that do not become a contract: 24 months from the last contact. After that, we delete them. If the request becomes a contract, the contract's rules apply.
- Invoices and billing data: for the period set by tax law.
- MadCloud backups: 30 days.
- Technical logs: for as long as needed for security and to comply with Brazil's Civil Rights Framework for the Internet (Marco Civil da Internet).
Security
The platform has two-step verification, an audit trail and encrypted credentials. No system is 100% secure, so use a strong password that is only yours, and turn on 2FA. If an incident happens that could put you at risk, we will notify you and Brazil's National Data Protection Authority (ANPD), as the LGPD requires.
Your rights
Under the LGPD (article 18), you can request:
- confirmation that we process your data, and access to it;
- correction of incomplete, wrong or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed in violation of the law;
- portability to another provider;
- information about who we share it with;
- withdrawal of consent, when it is the basis for processing, and objection to processing based on other grounds.
Write to contato@madbuilder.com.br. This is the channel for any personal data matter. To protect you, we confirm your identity through the account email before showing, changing or deleting data. We reply within 15 days. If you are not satisfied, you can file a complaint with the ANPD.
For the data in your projects (your customers', for example), the request should go to you, as the controller. We help with whatever is needed.
Changes to this policy
When this policy changes, the date at the top changes with it. If the change is significant, we will notify you by email or through a notice on the platform before it takes effect.
See also the terms of use and the about the company page.
