---
title: "Privacy policy | RivalNote"
description: "How Mazacode LTDA handles data for RivalNote and this website. Draft pending legal review."
image: "https://rivalnote.com/og-image.png"
---

# Privacy policy

What this site and the RivalNote service do with data. Draft, pending legal review.

**Draft, pending legal review.** This text describes how RivalNote handles data. It has not been reviewed by a lawyer and may change before it takes effect.

Last updated: 6 October 2026

## Who is responsible

RivalNote is operated by Mazacode LTDA, CNPJ 45.655.559/0001-98, Florianópolis/SC, Brazil. Mazacode LTDA is the controller of the personal data described here. To make a privacy request, use the WhatsApp conversation link on this site and say that it is a privacy request.

## This website

This site sets no cookies, runs no analytics or advertising tags, has no forms and loads no third-party fonts, scripts or images. The only contact route is a link that opens WhatsApp, which is run by Meta under its own terms and privacy policy. If you message the founder, we see your phone number, your profile name and what you write.

The site is served through Cloudflare, whose account setting adds Cloudflare Web Analytics (a script from static.cloudflareinsights.com that records aggregate traffic without cookies).

## Data the service holds

This applies once you have a RivalNote account.

- **Account data:** the e-mail address and name from your Google sign-in.
- **Competitor data:** the names and URLs of competitors you add, and any business context, watch terms and settings you enter.
- **Team data:** the e-mail addresses of colleagues you invite.
- **Usage data:** the features you use and when.
- **Payment data:** handled by Stripe. We keep a Stripe customer reference, not card numbers.
- **Technical data:** IP addresses in server logs, kept for 30 days for security and abuse prevention.
- **Generated data:** snapshots of public competitor pages, the insights written from them and your digests.

## Why we use it

To run the service you asked for (contract), to keep it secure and prevent abuse (legitimate interest), and to send marketing e-mail only where you agreed (consent). Under the Brazilian LGPD and the GDPR these map to performance of a contract, legitimate interests and consent.

## Who receives it

| Recipient | Purpose | Data |
| --- | --- | --- |
| Stripe | Payments | E-mail, billing details |
| Anthropic (Claude) | Writing and scoring insights | Competitor page text, competitor context, watch terms, business context you entered |
| OpenAI | Fallback when Claude is unavailable | The same as above |
| Google | Sign-in | Profile e-mail and name |
| Slack | Alerts, only if you connect it | Insight summaries |
| Twilio SendGrid | E-mail delivery of digests and service notices | E-mail address, message content |
| Hosting infrastructure | Running the service | All of the above, encrypted in transit |

Your e-mail address and payment details are not sent to the AI providers. We do not sell personal data.

## How long we keep it

Account data is kept while the account is active. Deleting the account removes your account, competitors, snapshots, insights, signed-in devices and push registrations. Server logs are kept for 30 days. Stripe keeps payment records for as long as the law requires.

## Your rights

Under the LGPD and, where it applies, the GDPR, you can ask for access, correction, portability, deletion, restriction or objection, and you can withdraw consent. In the dashboard, Settings, Export my data downloads your data as JSON, and Settings, Delete account removes it. For anything else, use the WhatsApp conversation link. We answer within the period the applicable law sets.

## Cookies

This site sets none. The signed-in service uses only the session cookies it needs to keep you signed in, and no advertising or tracking cookies.

## Changes and complaints

If we change this policy in a material way, we will tell account holders before the change takes effect. You can also complain to the Brazilian data protection authority (ANPD) or to the authority in your country.