Privacy Policy

Last updated: June 2025

Todas Labs respects and protects the privacy of everyone who interacts with our services. This policy clearly explains what data we collect, why and how we use it.

1. Who we are

Todas Labs (CNPJ 43.886.006/0001-10) is a non-profit civil society organization based in Brazil. We work at the intersection of technology, justice and human rights, focused on supporting women, LGBTQIA+ people, indigenous peoples and quilombola communities who are victims of digital violence.

Contact: DPO@todasasletras.org

2. What data we collect

We collect only the data strictly necessary to provide our services:

Contact form: name and email address provided voluntarily.
Helpline: information shared by the person during the support process, including a description of the situation and contact details. This data is handled with absolute confidentiality.
Acha Spyware: data extracted from the person's mobile device, sent directly to the forensic analysis team. No data is stored on Todas Labs servers without explicit consent.
Event registration (e.g. CryptoPunk Rio): name, national ID number (RG) and email, collected via a Google Forms registration form. The ID number is used exclusively for entry control at the event venue. The email is used to stay in touch with registered attendees before, during and after the event.
Website browsing: we do not use tracking cookies, third-party analytics tools or any behavioral monitoring mechanism.

3. How we use your data

To respond to messages sent via the contact form.
To provide support and referrals through our helplines.
To perform forensic device analysis within the Acha Spyware service.
We never sell, share or transfer personal data to third parties for commercial purposes.

4. Legal basis (LGPD)

Data processing by Todas Labs is based on the following legal grounds under Brazil's General Data Protection Law (Lei nº 13.709/2018):

Consent (art. 7, I): for data collected via the contact form and helplines.
Legitimate interest (art. 7, IX): for the secure operation of our services and protection of the people we serve.
Protection of life and physical safety (art. 7, VII): in cases involving digital violence.

5. Confidentiality in support services

All information shared through our helplines is treated with absolute confidentiality. No support data is publicly disclosed or shared with third parties without the explicit consent of the person involved, except as required by law.

6. Data sharing

Collected data is not sold, rented or transferred to third parties. In exceptional cases, data may be shared with:

Partner organizations for case referrals, always with the person's consent.
Competent authorities, when required by legal obligation.
Operational service providers, such as Google Forms (event registration), subject to those platforms' own privacy policies.

7. Data retention and deletion

Data is kept for as long as necessary to provide the service or as required by law. You may request deletion of your data at any time by emailing DPO@todasasletras.org.

8. Security

We adopt technical and organizational measures to protect data against unauthorized access, loss or leakage. The tools we develop, such as Acha Spyware, were designed with privacy by design principles.

9. Your rights

Under the LGPD, you have the right to:

Confirm whether your data is being processed.
Access your data.
Correct incomplete, inaccurate or outdated data.
Request anonymization, blocking or deletion of your data.
Withdraw your consent at any time.

To exercise any of these rights, contact us: DPO@todasasletras.org

10. Changes to this policy

This policy may be updated periodically. Significant changes will be communicated on the website. We recommend reading this document regularly.

11. Contact

Questions, requests or complaints related to privacy can be sent to DPO@todasasletras.org.