Dhrive

Last update: May 18, 2026

Privacy Policy

Cyos Technologies LTDA (operating the Dhrive brand) processes your personal data in compliance with the Brazilian General Data Protection Law (LGPD, Federal Law No. 13.709/2018). This Policy describes which data we collect, for which purposes, on which legal grounds, with whom we share it, how long we keep it, and how you can exercise your rights.

1. Data Controller

The controller of your personal data is Cyos Technologies LTDA, registered under CNPJ 52.933.533/0001-20, operating the Dhrive brand.

2. Data Protection Officer (DPO)

You can reach our DPO at dpo@dhrive.com.br to exercise any of the rights set forth in Article 18 of the LGPD or to clarify any question about how your data is treated.

3. Personal data we collect

We collect the following data depending on how you interact with the platform:

When browsing the site:

  • IP address
  • Device data (browser, operating system, language)
  • Pages visited and navigation duration
  • Strictly necessary cookies for site operation (see Cookies Policy)

When joining the early access waitlist:

  • Email
  • Name (optional)
  • Company (optional)
  • Preferred language
  • Source of the sign-up (site section)
  • Consent record: date, time, and version of the Policy accepted

When completing onboarding for Dhrive CFO:

  • Company CNPJ, legal name, and trade name
  • CNAE (Brazilian economic activity code)
  • Tax regime
  • Estimated revenue range

4. Purposes of processing

We process your data for the following purposes:

  • Operate the Dhrive platform and its services
  • Communicate updates about early access and product news, when you have given consent
  • Personalize the experience based on language and company profile
  • Prevent fraud, abuse, and ensure platform security
  • Comply with legal, regulatory, or competent authority obligations

5. Legal basis

Each purpose is supported by one of the legal grounds in Article 7 of the LGPD:

  • Pre-contract procedures and contract performance (Art. 7, V): to set up and operate your platform account and process onboarding.
  • Consent (Art. 7, I): to send communications about early access, marketing, and to activate non-essential cookies.
  • Legitimate interest (Art. 7, IX): for fraud prevention, platform security, and continuous service improvement. You can object to this processing by contacting the DPO.
  • Legal obligation compliance (Art. 7, II): to comply with ANPD or other competent authority determinations.

6. Data sharing

We share your data only with operators that provide services essential to the platform operation:

  • Supabase Inc.: database and authentication. Stores the data you provide, on Amazon Web Services infrastructure. Subject to a Data Processing Agreement (DPA).

We do not sell your data to third parties. When analytics or marketing tools are integrated, this Policy will be updated with the detailed list of those integrations, and consent will be re-requested if needed.

7. International data transfer

Part of the data is processed on servers located outside Brazil (United States), through Supabase Inc. and Amazon Web Services. This transfer relies on Article 33, V and VII, of the LGPD: specific consent of the data subject and necessity for contract performance. We adopt contractual clauses and technical measures appropriate to ensure the level of protection required by Brazilian law.

8. Data retention

We keep your data for the period required by the purposes for which it was collected, or as required by law:

  • Early access waitlist data: until your removal upon request or for 24 months after sign-up, whichever comes first.
  • Onboarding and platform usage data: while the account is active and for up to 5 years after closure, for tax and accounting audit purposes.
  • Access and navigation logs: up to 6 months, for security and fraud prevention.
  • Consent records: while consent is active and for 5 years after revocation, to demonstrate compliance.

9. Your rights as a data subject

The LGPD grants you the following rights, exercised free of charge at any time:

  • Confirmation that your data is being processed
  • Access to your data
  • Correction of incomplete, inaccurate, or outdated data
  • Anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data
  • Portability of data to another service provider
  • Deletion of data processed based on your consent, except for the cases in Article 16 of the LGPD
  • Information about public and private entities with whom we share your data
  • Information about the option to refuse consent and its consequences
  • Withdrawal of consent, as set forth in Article 8, §5, of the LGPD

To exercise any of these rights, send an email to dpo@dhrive.com.br describing your request. We will respond within the applicable legal deadline.

10. Information security

We adopt technical and organizational measures to protect your data against unauthorized access, loss, alteration, or destruction: TLS in transit, encryption at rest, role-based access control, continuous monitoring, and incident response processes. In the event of an incident affecting personal data, we will notify the ANPD and the affected data subjects within the deadlines required by law.

11. Children and adolescents

Our services are intended for adults and businesses. We do not intentionally collect data from children (under 12) or adolescents (12 to 18). If we identify that such data has been provided without adequate consent, we will arrange for its immediate deletion.

12. Changes to this Policy

This Policy may be updated to reflect changes in our services, integrations, or legal obligations. The date of the last update appears at the top of this document. Material changes will be communicated prominently on the platform and, where applicable, by email.

13. Brazilian Data Protection Authority (ANPD)

You may also file a complaint with the ANPD at www.gov.br/anpd. Before doing so, we recommend reaching out directly so we can address your concern quickly.