Privacy Policy

1. About this document

This Privacy Policy describes how IA Technology Software LTDA (hereinafter "IA Technology", "GoSoft" or "the Company") collects, uses, stores and protects the personal information of users of the gosoft.app platform and its associated subdomains (e.g., cliente.gosoft.app).

By using our services, the user accepts the practices described in this document. If the user does not agree with any of its provisions, we recommend not to use the platform.

This document complies with the Brazilian General Data Protection Law (LGPD — Law No. 13.709/2018) and, where applicable, with the European Union General Data Protection Regulation (GDPR).

2. Identification of the controller

The data controller is IA TECHNOLOGY SOFTWARE LTDA, a company incorporated in the Federative Republic of Brazil, with registered offices in São Paulo and registered with the Brazilian Federal Revenue Service.

The operation originated in Bolivia in 2018, with INTELIGENCIATECHNOLOGYCOMPANY S.R.L. (Tax ID 371384025, FUNDEMPRESA registration 00404502, Santa Cruz de la Sierra). Nevertheless, the controller towards data subjects is the Brazilian entity identified above, regardless of the country in which the client is located.

Applicable legal framework

Processing is governed by Brazil's Lei Geral de Proteção de Dados Pessoais (LGPD), Law No. 13,709/2018, under the competence of the Autoridade Nacional de Proteção de Dados (ANPD), without prejudice to the rights that each data subject's local legislation may afford them.

3. Who decides and who executes: controller and processor

This is the most important distinction in this document, because it determines who each person should contact, depending on the data concerned.

It follows that the accuracy of the information recorded is the responsibility of the real estate company, and that a buyer wishing to access, correct or delete their data must contact the company with which they contracted. IA Technology Software LTDA cooperates with that company in handling such requests, but does not decide on them.

IA Technology acts as controller, by contrast, in respect of data relating to its own commercial relationship: the contact details of its clients, those of visitors to its websites and those of persons installing the mobile application.

4. Data we collect

Only the data necessary to provide the service is collected.

System users (client company staff)

• Registration: full name, email address, mobile number and job title.
• Access: IP address, browser, operating system and login records.
• Credentials: passwords are stored using irreversible encryption. No one, including IA Technology, can read or recover them.
• Usage: operations carried out within the system, with the traceability described below.

Property buyers (uploaded by the client company)

• Name, identity document, contact details and address.
• Contractual information: contracts, payment plans, instalments, receipts and portfolio status.
• Attached documents the company chooses to upload: scans, receipts, photographs.

This data is supplied and administered by the real estate company, which declares that it has sufficient legal basis to process it and to incorporate it into the platform.

Account holders

• Full name and document number of the primary holder and the substitute holder designated for the operational continuity of the account.

Sensitive data

No sensitive data is collected — racial origin, religious beliefs, biometric or health data — unless the data subject voluntarily includes it within the contractual documentation uploaded by the client company.

5. Free evaluation and training data

To enable the 30-day free evaluation, the interested company submits information relating to its own business:

• Company and project name and logos.
• Project plan in PDF.
• Property inventory spreadsheet, with title reference, area and price.

This information is used solely to set up and operate the evaluation. It is not used for any other purpose, is not shared with third parties and is not added to any commercial database.

Training. Training sessions are held by video call and are recorded. The recording is delivered to the client company for internal reference. The image and voice of participants may appear in it.

Retention. Where the company does not contract, the information submitted for the evaluation is deleted together with the trial environment and no copy is retained. The training recording is delivered to the client and likewise not retained.

6. Mobile application data

The GoSoft Realty application, available on Google Play, is aimed at the property buyers of the companies using the platform.

• Access data: those the buyer uses to identify themselves, as recorded by the real estate company.
• Data displayed: their payment plan, instalments, receipts and history. This is recorded and maintained by the real estate company, which is its controller.
• Device identifier: on accepting notifications, the application registers a technical device identifier required to deliver alerts. It is used solely for that purpose and is removed when the application is uninstalled or notifications are disabled.

The application does not access the device's contacts, gallery or location, and contains no advertising or third-party commercial trackers.

It may be used from any country in the world, without the geographical restriction applied to access to the management system.

7. Data of visitors to our websites

When browsing our websites, the following data is collected:

• Quotation form: at gosoft.app, anyone downloading a quotation provides their name, email address, telephone number and country. That data is used to send the quotation and to follow up commercially on the enquiry.
• Technical browsing data: IP address, device type, browser, language and pages visited, collected through the analytics tools described in the cookies clause.
• Security: the websites and the platform operate behind protection services that analyse traffic to prevent attacks, which involves processing each visitor's IP address.

Contact details submitted through the forms are not sold or transferred to third parties, and the data subject may request their deletion at any time.

8. How we use data

The collected data is used exclusively to:

• Provide and maintain the GoSoft platform services.
• Process real-estate contracts, payment plans and documentation generated by the system.
• Send operational notifications (due-date alerts, contract status changes, receipts).
• Improve the platform based on aggregated and anonymized usage patterns.
• Comply with legal obligations and respond to requests from competent authorities.

We do not use user data for advertising purposes, we do not sell it nor do we transfer it to commercial partners.

9. Email and WhatsApp notifications

Client companies may contract the sending of automated notifications by email and WhatsApp to their buyers: arrears notices, payment confirmations and other communications.

• The data used — the buyer's name, telephone number and email address — is that recorded in the system by the real estate company.
• IA Technology acts as processor: it sends the messages on behalf of the company, which determines recipients, content and frequency.
• The client company declares that it has legal basis to contact those persons by those means and is solely responsible for the content of the messages.
• Sending via WhatsApp involves processing of the telephone number by the corresponding messaging provider, under its own policies.

Notifications within the mobile application do not form part of this service and are free of charge.

10. Google Drive integration

GoSoft offers an optional feature to create and organize folders for contractual documents directly in the user's Google Drive. This integration uses the official OAuth 2.0 protocol from Google and requires the user's express authorization.

Official tutorial — how to link your Google account and create project folders from GoSoft · Watch on YouTube

GoSoft does not store the user's Google password. Access is granted exclusively through OAuth tokens, revocable at any time from the Google account.

The scopes that GoSoft requests from the user's Google account are:

With these permissions, GoSoft performs only the following actions:

• Create a folder named after the real-estate project in the user's Google Drive.
• Upload documents generated by the system (contracts, payment plans, PDF receipts) to that folder.
• Internally store only the folder ID for future uploads.

GoSoft does not read, access, modify or delete any existing file in the user's Google Drive beyond the files created by the application itself. This is technically guaranteed because the drive.file scope is the most restrictive in the Google Drive scope family.

The user may revoke access at any time at: myaccount.google.com/permissions.

What is stored in Google Drive and what is not

Structured data — sales, payment plans, receipts and portfolio — resides in the GoSoft Realty database and is not stored in Google Drive. Drive stores files: the PDFs generated by the system and the attachments the company uploads alongside a contract.

Scope of access

The only Drive permission requested is drive.file, Google's most restricted scope: it grants access only to the files the application itself creates or that the user opens with it. GoSoft cannot access the rest of the content of the user's Drive.

Ownership and custody

The Drive account belongs to the real estate company and is governed by Google's terms. The content stored there, and the decision as to what is uploaded, are its own, as is its custody. GoSoft does not retain copies of those files on its servers and does not back them up, and cannot recover them if the user deletes them or revokes authorisation.

11. Data sharing

Data may be shared only in the following situations:

• Service providers: hosting infrastructure, database and email services, all bound by confidentiality agreements.
• Google LLC: when the user authorizes sign-in or Google Drive integration (Section 4).
• Legal obligation: when required by law, court order or competent authority.
• Business transfer: in case of merger, acquisition or sale of assets, with prior notice to users.

We never share personal data with third parties for marketing purposes without the user's express consent.

Processors

To provide the service we rely on providers that process data on our behalf, under confidentiality and security obligations:

We do not sell personal data, we do not transfer it to commercial partners and we do not use it for advertising purposes.

12. International data transfer

Information is hosted in data centres located in the United States, Brazil and Germany. Accordingly, personal data processed by the platform may be stored and processed outside the country in which the data subject or client company is located.

• The transfer takes place in order to perform the contracted service and with the contractual safeguards required of each provider.
• By accepting the Terms and Conditions and this Policy, the client consents to such international transfer.
• Regardless of the hosting country, the controller remains IA Technology Software LTDA, subject to the LGPD and to the competence of the ANPD.

13. Public visibility of project information

The user (client of GoSoft) acknowledges and accepts that, as part of the platform's operation, the following information may be displayed in public areas of the system, accessible without authentication:

• Public client map: a map of the world available at realty.gosoft.app/admin-sys-getproyectosmapa/... and similar URLs that displays the geographic location of GoSoft client companies and their real-estate projects, including the company's commercial name. The map does not display sensitive data of end-customers and is intended only for commercial and reference purposes.
• Public client portals: each GoSoft client may optionally enable public pages within its own subdomain (e.g., cliente.gosoft.app) showing the catalog of available properties — including locations on a plan, prices, property numbers and descriptive characteristics. Sold or reserved properties may also be displayed in a different status. These pages do not reveal personal data of the buyers (name, ID, contracts, payments).
• Public commercial documents: when a client of GoSoft generates individual links to PDF documents (sale proposals, payment plans), those links may be opened by anyone who has the URL. The client is responsible for managing and sharing these links.

GoSoft does not display in any public area: full names of buyers, identification documents, signed contracts, payment history, telephone numbers or private email addresses of end-customers.

A client of GoSoft who wishes to disable the public visibility of a particular project or property may request the change at any time through the support channels listed in Section 12.

14. Traceability and audit records

Every record in the system retains three traceability marks: who created it, who last edited it and who cancelled it, each with its date and time.

• Their purpose is traceability and internal control for the client company, which can consult them from within the system.
• They record the authorship and timing of each action, not the detail of what was modified: no version history or prior values are retained.
• These marks form part of each record and are retained for as long as the record exists.

For this reason, the name of the user who performed an operation may persist in the audit trail even after the associated operational record is deleted. This retention serves traceability purposes and compliance with legal obligations, and constitutes a legitimate limitation on the right to erasure.

15. Storage, security and retention

Security measures

• Encrypted communication via HTTPS/TLS at all access points.
• Passwords stored with irreversible encryption; they are neither readable nor recoverable by anyone.
• Database access restricted by credentials and private networks.
• Access control by user, module and business unit, administered by the client company itself.
• Access monitoring and login validation.

No computer system is invulnerable. The above measures are reasonable and in line with industry standards, but they do not entirely eliminate risk, as set out in the Terms and Conditions.

Backups

The infrastructure has backups intended for disaster recovery — hardware failures, loss of a data centre or equivalent incidents. Those backups do not allow the restoration of individual records deleted by the client company itself: deletion carried out from the system is final and irreversible.

Retention period

• During the relationship, information is retained for as long as the account remains active.
• Once the licence ends or is not renewed, it is retained for at least 12 months from the last payment.
• Within that period, the client company may reactivate access by paying for one month in order to consult its information; the period then runs afresh from that payment.
• After 12 months, the information may be permanently deleted.
• The client company may request export of its information within 30 days following termination.
• Only data that a legal obligation requires to be kept will be retained for longer periods.

16. Data subject rights

In accordance with the LGPD and applicable laws, the user has the following rights regarding their personal data:

• Confirmation and access: know whether we process their data and obtain a copy.
• Correction: request the update of incorrect or outdated data.
• Deletion: request the deletion of their data, except for legal obligations.
• Portability: receive their data in a structured, machine-readable format.
• Withdrawal of consent: revoke granted permissions at any time.
• Objection: object to processing based on legitimate interest.
• Information about sharing: know with whom we share their data.

To exercise any of these rights, the user may contact the Company through the channels listed in Section 12.

17. Cookies, analytics and tracking

Our own cookies

• Session: keep the user authenticated while browsing.
• Preference: store the language, visual theme and selected business unit.
• Security: protect against cross-site request forgery (CSRF) and validate that the person logging in is human.

Third-party analytics

Our websites use Google Analytics, an analytics service provided by Google LLC, to understand in aggregate how pages are browsed: sections visited, device, language and approximate country.

• It is used solely for statistical purposes and to improve the site.
• It is not used for behavioural advertising, no commercial profiles are built and that data is not sold.
• Google processes that information under its own policies, and users may prevent its collection through Google's opt-out add-ons or their browser settings.
• Measurement covers both the public websites and certain screens of the management platform. Under no circumstances is contract, payment or buyer data sent to Google: what is measured is navigation (page visited, device, language and approximate country).

Users may configure their browser to block cookies, although this may prevent the platform from working correctly.

18. Minors

The GoSoft Realty platform is a business management tool aimed at legal entities and their professional users. It is not intended for minors, and data is not knowingly collected directly from them.

Where, by reason of the nature of a real estate transaction, the client company must record the data of a minor — for example, as holder or co-holder of a contract — that company is responsible for obtaining authorisation from those exercising legal representation over them, in accordance with applicable law.

If we become aware that a minor's data has been collected without due authorisation, we will take reasonable steps to delete it at the controller's request.

19. Changes to this policy

This Privacy Policy may be updated periodically to reflect changes in our services or legal requirements. When substantial changes are made, users will be notified by email or through a prominent notice on the platform.

The date of the latest update is always shown in the header of this document. Users are advised to review this policy periodically.

20. Contact

For inquiries, requests related to personal data or to exercise the rights described in Section 9, the user may contact us through the following public channels: