Privacy Policy

Last updated: 11 October 2026

1. Who we are

LUCAS CARVALHO PEREIRA LISO DESENVOLVIMENTO DE SOFTWARE LTDA, CNPJ 57.205.287/0001-03, operates Polku from Brazil.

Business address: Rua Agostinho Gomes, 485, apt 1805, São Paulo, SP, CEP 04206-000, Brazil.

Privacy contact: support@polku.work.

This Policy explains how we handle personal information in our website, application, integrations, and support communications.

We determine the purposes of processing account, billing-administration, security, and support information. For personal information that an organization places in its workspace for its own purposes, that organization generally acts as controller and we process it to provide the service under its instructions. Workspace administrators control membership and access; this Policy does not replace the organization's own privacy notice.

2. Information processed

Depending on how you use Polku, the service processes:

• Account information: name, email address, authentication records, and security settings.
• Workspace information: organization and team membership, roles, responsibilities, tasks, journeys, documents, comments, attachments, time records, and other content submitted by authorized users.
• Integration information: authorized integration identifiers, access credentials, and linked repository, commit, pull-request, review, and check metadata when that integration is enabled.
• Billing information: customer and subscription identifiers, billing contact details, subscription status, selected seats, and transaction or refund records received from our payment partner. Payment-card details are submitted in the partner's secure checkout; Polku receives transaction information rather than the full payment-card number or security code.
• Technical information: IP addresses and request information processed by our infrastructure, browser and device information available in requests, session records, operational logs, and security events.
• Support information: your correspondence and the details you choose to provide when requesting assistance.

Information can come from you, authorized workspace users, connected integrations, our payment partner, and the infrastructure serving your requests. Avoid submitting personal information that is unnecessary for your organization's work, especially sensitive personal information.

3. Purposes and legal bases

We process information to provide accounts and collaboration, synchronize workspace content, administer subscriptions, respond to requests, maintain service security, diagnose problems, and meet legal obligations.

Under Brazil's LGPD, the applicable basis depends on the purpose: performance of a contract or requested pre-contractual steps; compliance with legal obligations; exercise of rights; or legitimate interests such as proportionate security and service administration, balanced against your rights. Where consent is required, we request it for the specific purpose and allow its withdrawal. Merely visiting the website does not authorize unrelated processing. See the LGPD.

For workspace content processed on an organization's instructions, the organization is responsible for identifying its applicable legal basis and informing the people concerned.

4. Cookies, browser storage, and website measurements

The application uses cookies for authentication and session security. Browser storage also supports preferences, local workspace data, synchronization, and offline operation. The marketing website stores your theme preference locally.

The marketing site records aggregate page views and counts of clicks on login and registration links. These application-generated measurements do not intentionally include account names, email addresses, or workspace content. Infrastructure can separately process request and security information.

You can manage cookies and stored site data through your browser. Clearing them may sign you out or remove local preferences, cached data, and unsynchronized work. Use a trusted device for workspace access.

5. Recipients and service providers

We share personal information only as necessary for the purposes described in this Policy, with the following categories of recipients:

• Infrastructure and security providers: hosting, database operations, content delivery, storage, synchronization, service monitoring, and protection against abuse.
• Payment and transaction partners: checkout, recurring billing, tax administration, fraud prevention, payment disputes, and refunds.
• Communication and support providers: delivery, routing, storage, and handling of service messages and support correspondence.
• Integrations authorized by your organization: connected repository services, MCP clients, and other tools receive information within the access you authorize.
• Authorized workspace members: information is available according to the permissions granted by your organization.
• Authorities and other legally authorized recipients: disclosures required by law or necessary to establish, exercise, or defend lawful rights.

We may appoint or replace providers as operational needs change. Such changes do not authorize new, incompatible purposes of processing or reduce your statutory rights. Providers acting on our instructions must be subject to appropriate confidentiality, security, and data-protection obligations.

The payment partner is identified in the checkout or billing environment, where its applicable transaction and privacy terms are made available. Where a recipient determines its own purposes of processing, those purposes are governed by its own privacy terms and applicable law.

You may request information about the entities with which your personal information has been shared and the purposes of that sharing by emailing support@polku.work. We do not sell personal information for advertising.

When you connect an AI tool through MCP, that tool may receive authorized workspace information. Review its provider's privacy terms and data settings; connecting it does not make its provider part of Polku.

6. International processing

Our providers may process information outside Brazil. Transfers must use a mechanism permitted by applicable data-protection law, including relevant contractual safeguards where required. You can ask our privacy contact for information about the providers, locations, and transfer mechanisms applicable to your data. See the ANPD's international-transfer guidance.

7. Retention and deletion

Retention depends on the purpose and applicable obligations. Account and workspace information is retained while needed to provide the service; billing records may be retained for accounting and legal obligations; security records and support correspondence may be retained as needed for their operational purpose or a dispute.

Canceling a subscription does not automatically delete the workspace. Request deletion through our privacy contact. We assess your request and any legal exceptions, and explain limitations where records must be retained. Browser copies and information previously exported to third parties require separate handling. Ask us for the retention period applicable to a particular record.

8. Your rights

Subject to applicable conditions, you may request confirmation and access, correction, portability, information about sharing, and anonymization, restriction, or deletion of unnecessary or unlawfully processed data. You may withdraw consent and request deletion of consent-based data, subject to legal retention exceptions; ask about consequences of refusing consent; object to processing where legally available; and request review of qualifying automated decisions. See the ANPD's explanation of data-subject rights.

Send requests to support@polku.work. We may verify your identity or authority before disclosing or changing information. For organization-controlled workspace content, we may coordinate with the organization. You may also contact the ANPD or the competent data-protection or consumer authority.

9. Security, children, and changes

We apply technical and organizational safeguards appropriate to the service and handle incidents as required by law. No online service can eliminate every security risk. Report suspected incidents to our contact address.

Polku is a professional service and is not directed at children. Contact us if you believe a child has provided personal information without appropriate authorization.

We will update this Policy when practices or legal requirements change and communicate material changes as required. The date above identifies the latest revision.