Privacy

Privacy Policy

Effective 8 September 2026

This policy explains, in plain language, what data Canindé processes, why, who it is shared with, and what you can ask for at any time. It covers the web system and the Android app “Canindé Administração”.

1.Who this applies to

Canindé is a management and point-of-sale system (ERP and POS) for coffee shops, bars, restaurants and bakeries. It has two parts: the web system, used on the register and back-office computers, and the Android app “Canindé Administração”, used to follow the operation from the floor. This policy covers both.

Canindé is a work tool. The people who use it are the staff of the establishment that hired Canindé — the owner, the manager, the cashier, the kitchen. There is no public signup: nobody creates an account on their own from the website or the app store. The account is created by the establishment, for the people who work there.

That splits responsibility in two. For the user-account data — name, email, password, permissions — Canindé is the controller, and this policy describes how we look after it.

For the establishment’s operational data — sales, orders, tabs, inventory, reports — Canindé is only the operator. That data belongs to the contracting establishment, which decides what to do with it; we process it following its instructions and the service agreement.

2.Data we process

This is the complete list of personal data tied to your user account. There is nothing else.

Data	Where it comes from
DataName and email	Where it comes fromEntered by the establishment when it creates your account.
DataPassword	Where it comes fromChosen by you. Nobody can read it — not even our team. If you forget it, it is reset, never recovered.
DataCompany and permissions	Where it comes fromWhich establishment your account belongs to and what it may do there, as the manager decides.
DataNotification token	Where it comes fromGenerated by the device itself when you allow notifications in the app. It does not identify you outside Canindé.
DataSession token	Where it comes fromIssued when you sign in, so the system does not ask for your password on every screen.
DataAccess and audit logs	Where it comes fromGenerated by the system as it is used: date, time and origin of sign-ins, and the authorship of operations.
DataApp version	Where it comes fromReported by the app itself when it connects.

3.What we do not collect

So there is no doubt, Canindé does none of the following:

We do not collect your location and we do not use GPS.
We do not access the device’s contacts, photos, microphone or camera.
We show no advertising and we do not use your data for ads.
We do not track you across third-party apps or websites.
We do not sell personal data. Not ever, to anyone.

The only permissions the Android app requests are notifications and vibration — both exist to deliver operational alerts.

4.Why we process it

The data above is processed for these purposes, and no others:

To grant access to the system and keep your session open while you work.
To control permissions, so each person sees and does only what the establishment authorised.
To record the authorship of operations — indispensable for cash and inventory movements, where it must be clear who entered what.
To send operational alerts: an order ready, a register opened, an event that needs attention.
To issue tax documents, when the establishment issues invoices through the system.
To investigate fraud and security incidents.
To keep the system running and to warn when a mandatory app update is required.

5.Legal bases

The processing described here rests on the following legal bases under the LGPD (Law 13.709/2018):

Performance of a contract — art. 7, V: Granting access, keeping the session, controlling permissions and recording the authorship of operations is the very service the establishment hired. Without it there is no system.
Compliance with a legal obligation — art. 7, II: Issuing and keeping tax documents follows deadlines and formats set by Brazilian tax law. That is not our choice to make.
Legitimate interest — art. 7, IX: Security and audit: the access and authorship records, and the investigation of incidents. We process only what is necessary for that purpose, and nothing beyond it.

6.Who we share with

The list is short, and each line has a practical reason:

With whom	What is sent	Why
With whomNotification infrastructure provider	What is sentThe device’s notification token and the content of the alert.	WhyIt is what makes the notification reach your phone.
With whomAuthorised tax invoicing provider	What is sentThe data on the issued invoice.	WhyTo transmit the NFC-e to SEFAZ, when the establishment issues invoices through the system.
With whomPublic authorities	What is sentOnly what is required.	WhySolely under a legal or judicial order.

Outside that list there is no sharing. We send no data to advertisers, to data brokers, or to third-party analytics tools, and we do not sell personal data.

7.Security

Our commitment about this data is short and checkable:

Your data travels and is stored protected.
Access is restricted to what is necessary: each person reaches only the data they need for their work, at the establishment they belong to.
We keep access and authorship records, and those are what let us investigate misuse.

No system is immune. If a relevant security incident occurs, we will notify the affected data subjects and the ANPD, on the terms and within the deadlines of the LGPD.

8.How long we keep it

Account data: Kept for as long as the account exists. Once the account is closed, it is deleted or anonymised.
Access and audit logs: Kept for as long as needed for the security of the system and for compliance with the applicable legal obligations.
Tax documents: Kept for the period Brazilian tax law requires, even after the account is closed. This is a legal obligation: we cannot waive it at the data subject’s request.

Once the period is over, the data is deleted or anonymised.

9.Your rights

The LGPD guarantees you, over your personal data, the right to:

Confirm that processing exists, and access the data.
Correct incomplete, inaccurate or out-of-date data.
Request the anonymisation, blocking or deletion of data that is unnecessary, excessive, or processed outside the law.
Request portability of the data to another provider.
Know who your data has been shared with.
Withdraw consent, for the processing that rests on consent.

To exercise any of them, write to contato@appcaninde.com.br. We answer within 15 days. We may ask you to confirm your identity before acting — that is a protection for you, so that nobody obtains or changes your data by impersonating you.

10.Deleting your account

Write to contato@appcaninde.com.br with the subject “Exclusão de conta”, giving the registered email and the name of the establishment. We answer within 15 days.

Deleting removes your name, your email, your password and your notification token.

What remains, and why:

Tax documents already issued, for the period Brazilian tax law requires.
The establishment’s operational records — sales, orders, movements. They belong to the contracting company, not to your personal account.

A staff member’s account can also be deleted by the establishment’s manager, directly inside the system, without writing to us.

11.Minors

Canindé is a work tool, intended for adults or for properly contracted apprentices, registered by the establishment’s manager.

We do not knowingly collect children’s data, and the app is not directed at children.

12.Changes

When this policy changes, the effective date at the top of this page changes with it.

Relevant changes are announced inside the app before they take effect, so you have time to read them.

13.Controller and contact

The controller of the data described in this policy is:

Legal name: ATHENA SERVIÇOS EM INFORMÁTICA
Type: Empresário Individual (sole trader)
Trade name: SAPIENZA SOLUÇÕES EM TECNOLOGIA
Registered seat: Brasília — DF, Brazil

Questions about this policy, or requests for access, correction or deletion — talk to us:

We answer within 15 days.