Fragmenta
כניסה

Fragmenta

מדיניות פרטיות

עדכון אחרון: 20.10.2026 · Ler em português

מסמך זה מתפרסם בפורטוגזית ובאנגלית. להלן הגרסה האנגלית.

This policy explains which personal data Fragmenta processes, why, who we share it with and what your rights are. It applies to the fragmenta.io website, to Fragmenta on the web and to the desktop and mobile apps. It was written to comply with Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and the European Union's General Data Protection Regulation (GDPR).

1. Who is responsible

The data controller is BRUNO CORREA FRUTUOZO SERVICOS ADMINISTRATIVOS LTDA, registered in Brazil under CNPJ 48.321.784/0001-86, with its registered office at Avenida Senador Laurindo Minhoto, 515 - CEP: 18271-480 - Tatuí/SP - Brazil ("Fragmenta", "we", "us"). Our data protection officer can be reached at [email protected].

When a company uses Fragmenta (Team plan or a company created in the app), the company is the controller of the content its users put on its boards, and we act as a processor, handling that content only to provide the service. Requests about that content can be made to the company's administrator.

2. What data we process

Account

  • Name, email address and, if you choose, a profile photo.
  • Password: we only store a hashed version, never the password itself.
  • Your chosen language and notification preferences.
  • If you sign in with Google, Microsoft or Apple: name, email address and your account identifier with that provider. We never receive your password for that provider. With Apple, if you choose to hide your email, we receive an Apple relay address that forwards to yours; we also keep an encrypted Apple token, used only to end the link with Apple when you delete your account.

What you put in Fragmenta

  • Boards, columns, tasks, descriptions, comments (including previous versions of edited comments), checklists, custom fields, dates, labels and attachments.
  • Who you share each board with, and the boards' activity history.
  • Automations, templates, webhooks and calendar links you set up.

This content is used only to display, sync and store your work. We do not read it for other purposes, we do not use it for advertising and we do not use it to train artificial intelligence models.

Companies

  • Company name, verified domain, members, roles (admin, member) and invitations.
  • The company administrator can see every board in the company. Personal boards you don't bring into the company stay yours alone.

Payment

  • Payments are handled by Stripe. Card details go straight to Stripe; we never receive them.
  • We store the plan, subscription status, number of billed users and the customer and subscription identifiers at Stripe.
  • Stripe processes name, email, billing address and country to charge you and calculate taxes, under the Stripe privacy policy.

Devices and technical use

  • Sessions: access tokens for your signed-in devices, to keep you signed in and let you sign out of a device.
  • Mobile notifications: a device identifier (a Firebase Cloud Messaging token on Android or an Apple Push Notification service token on iOS). You can turn notifications off on the device.
  • IP address, used temporarily to limit sign-in attempts and protect the service against abuse, and server technical logs (date, time, address requested and errors), kept for a short time to fix problems and investigate security incidents.
  • In the apps, a copy of your boards is kept on the device so they work offline. In the browser, the session is kept in the browser's local storage. Signing out removes the session.

Website

  • The website uses a single cookie, "lang", which remembers the language you chose. We do not use tracking cookies, visitor analytics or advertising.
  • The country you visit from is used only to show prices in the right currency, and is not stored.

3. Why we use it and on what legal basis

  • Providing the service (creating your account, storing and syncing your content, sending account emails and the notifications you chose, billing your subscription): performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
  • Security and preventing fraud and abuse (limiting sign-in attempts, technical logs): legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
  • Tax and legal obligations (payment and invoice records): compliance with a legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)).
  • Mobile notifications: your consent, given through the device permission, which you can withdraw at any time.

We do not sell personal data and we do not use it for advertising.

4. Who we share it with

We only share data with providers that help us run the service, and only what they need:

  • Stripe: payments, subscriptions and taxes.
  • Google (Firebase Cloud Messaging) and Apple (Apple Push Notification service): delivering mobile notifications.
  • Google, Microsoft and Apple: sign-in, if you choose to use them.
  • Hosting, network, file storage and email delivery providers, which store or transmit data on our behalf.

Data also goes wherever you send it: people you share a board with, webhook addresses you set up and calendars that subscribe to your calendar link. We may also disclose data when required by law or a court order.

5. International transfers

Some providers (such as Stripe, Google, Apple and Microsoft) process data outside Brazil and the European Union, including in the United States. In those cases, the transfer relies on the safeguards provided for in the LGPD (art. 33) and the GDPR, such as standard contractual clauses.

6. How long we keep it

  • Account and content: for as long as the account exists. When you delete your account, your boards, tasks, photo and access are erased right away; comments you left on other people's boards stay there, without your name and email ("Deleted account"). Backups are overwritten in their normal cycle.
  • Payment records: for the period required by tax law (in Brazil, generally 5 years).
  • Technical logs and IP addresses: for as long as needed for security, and at least 6 months for the access logs required by Brazil's Internet Civil Framework (Law 12,965/2014, art. 15).
  • Content on a company's boards: follows the company's decisions. If you leave the company, the content you created on its boards stays with the company.

7. Your rights

You can ask us at any time for: confirmation that we process your data, access, correction, anonymization, blocking or erasure of unnecessary data, portability, information about who we share it with, withdrawal of consent, objection to processing based on legitimate interests and deletion of your account.

  • You can change your name, email, photo, language and notifications directly in the app settings, where you can also delete your account (Settings → Delete account).
  • For any other request, including deleting your account without access to the app, write to [email protected] from your account's email address. We reply within 15 days.
  • You can also complain to Brazil's National Data Protection Authority (ANPD) or, if you are in the European Union, to the data protection authority of your country.

8. Security

We use encrypted connections (HTTPS) for all traffic, store passwords only as hashes, use session tokens that expire and can be revoked, and restrict access to our servers. No system is completely secure; if an incident may put you at risk, we will notify you and the authorities as the law requires.

9. Children

Fragmenta is not intended for anyone under 16. If you learn that a child has given us personal data, contact us so we can delete it.

10. Changes to this policy

We may update this policy. The date of the current version is shown at the top. When a change is significant, we will let you know by email or in the app before it takes effect.

11. Contact

Privacy questions and requests: [email protected].