Privacy Policy — Ocara

Last updated: October 13, 2026

Ocara ("Ocara", "we", "us") is a collective work management platform available at https://ocara.app and https://minha.ocara.app (the "Platform"). This Privacy Policy explains how we collect, use, store, share and protect personal data, in compliance with the Brazilian General Data Protection Law — Law No. 13,709/2018 ("LGPD", Lei Geral de Proteção de Dados Pessoais).

By using the Platform, you declare that you have read and understood this Policy.

Google Tasks integration? See section 5 (Google user data: summary and Limited Use).

1. Who we are (Controller)

The Ocara platform is developed and operated by:

Company name: IDOPTER LABS TECNOLOGIA LTDA
CNPJ (Brazilian company tax ID): 11.055.433/0001-60
Address: Avenida Roberto Camelier, 558, Jurunas, CEP 66033-640, Belém/PA
Data Protection Officer (DPO) contact: [email protected]

References to "Ocara" or "we" in this Policy refer to Idopter Labs Tecnologia Ltda.

For registration and usage data of the Platform, Ocara acts as the controller. For content entered by customers in their workspaces (tasks, comments, attachments), Ocara acts as the processor, processing the data according to the customer's instructions; the customer is the controller of that data.

2. Data we collect

2.1. Data you provide

Registration: name, e-mail, password (stored in encrypted form) and, optionally, profile picture and job title.
Organization account: company name, CNPJ and billing data.
Payment: billing data processed by payment partners; we do not store the full card number.
Content: tasks, projects, comments, files and any other information that you or your organization enter into the Platform.
Support: messages and information sent in support requests.

2.2. Data collected automatically

Access and usage data: IP address, date and time of access, browser type, device, operating system, pages visited and actions performed on the Platform. Application access logs are kept in accordance with the Marco Civil da Internet (Brazilian Internet Civil Rights Framework, Law No. 12,965/2014).
Cookies and similar technologies: we use essential cookies (authentication and security) and, depending on your settings, performance analytics cookies. You can manage cookies in your browser settings; essential cookies are necessary for the Platform to work.

2.3. Data from third-party service integrations

If you choose to connect your Google Tasks or Todoist account to Ocara, we also process the data described in section 5 (Google) and the equivalent Todoist data: the access token, the identifier and e-mail of the connected account, and the tasks in the chosen list. None of this is collected if you do not connect an account.

3. Purposes and legal bases

Purpose	Legal basis (LGPD, art. 7)
Create and manage your account; provide the contracted services	Performance of a contract
Process payments and issue invoices	Performance of a contract; compliance with a legal obligation
Comply with legal and regulatory obligations (tax, Marco Civil)	Compliance with a legal obligation
Ensure security, prevent fraud and abuse	Legitimate interest
Improve the Platform and analyze usage in aggregate form	Legitimate interest
Send communications about the service (notices, updates, security)	Performance of a contract
Send marketing communications	Consent (revocable at any time)
Handle support requests	Performance of a contract
Defense in judicial, administrative or arbitration proceedings	Regular exercise of rights

When processing is based on legitimate interest, it will be carried out only to the extent necessary and with respect for your expectations and rights.

4. Data sharing

We do not sell personal data. We may share data with:

Infrastructure and service providers (cloud hosting, transactional e-mail, payment processing, analytics), which are contractually obliged to protect the data and process it only according to our instructions;
Members of your organization, according to the permissions configured in the workspace;
Public authorities, when required by law, court order or a request from a competent authority;
Corporate transactions (merger, acquisition, reorganization), in which case you will be informed.

4.1. Subprocessors

The main providers that process data on our behalf are:

Fly.io: application and database hosting (Brazil);
Tigris: storage of files and attachments;
Resend: sending and receiving transactional e-mails;
Asaas: payment processing;
Rollbar: error monitoring;
Google Analytics: usage analytics, only if you consent to analytics cookies;
Cloudflare Turnstile: bot protection on forms.

If a workspace administrator configures an AI credential (Anthropic, OpenAI or Google Gemini), the content of the card on which the agent runs is sent to the chosen provider, using the workspace's own credential. Data obtained from Google Tasks is never sent to these providers.

4.2. Data location and international transfer

The Platform is hosted on Fly.io infrastructure on servers located in Brazil, where account data and User Content are stored.

Auxiliary services (such as sending transactional e-mails, processing payments or support tools) may involve the processing of personal data outside Brazil. In these specific cases, we adopt the safeguards provided for in arts. 33 et seq. of the LGPD, such as contractual clauses that ensure an adequate level of protection.

5. Google integration (Google Tasks)

Ocara is a project management platform for software teams. It optionally offers synchronization of your personal tasks with Google Tasks. The connection only happens when you start it in My area → Integrations and grant access on Google's consent screen.

Google data we access (OAuth scopes requested):

https://www.googleapis.com/auth/tasks: read, create, edit and delete Google Tasks tasks and subtasks. The data actually accessed is: the names of your task lists (so you can choose which one to sync) and, in the chosen list, the title, notes, due date, status and hierarchy (subtasks) of each task;
openid and email: identify the connected Google account (unique identifier and e-mail address), to display it to you and to prevent the same account from being connected twice.

How we use this data:

solely to synchronize your personal tasks between Ocara and Google Tasks, in the direction you configure (import, export or both), and to show you the synchronization status;
Google data is not used for advertising, profiling, sale to third parties or to train artificial intelligence or machine learning models, is not sent to AI providers, and is not used to generate content, images or other media;
no one at Ocara reads the content of your Google tasks, except with your explicit consent, for security purposes, to comply with the law, or when necessary to operate the synchronization (support requested by you).

Protection of Google data (security mechanisms):

Encryption at rest: Google access and refresh tokens are encrypted with AES-256-GCM (authenticated encryption, with a random initialization vector on every write) before being written to the database. Tokens are never stored in plain text;
Key management: the encryption key is kept outside the database, as a production environment secret, and the system does not start without it. Keys are versioned, which allows them to be rotated without exposing the data already stored;
Encryption in transit: all communication with Ocara and with the Google APIs uses TLS, and the Platform enforces HTTPS with HSTS in production;
No exposure in logs: tokens are flagged as sensitive and omitted from logs; the technical reason for a synchronization failure is recorded only internally and is never shown or stored together with the content of your tasks;
Isolation and access control: imported tasks remain in your personal area, visible only to you and not shared with other members of your organization; tokens are read only by the synchronization process of your own account and are never returned to the interface, the public API or external integrations;
Minimum necessary: we request only the scopes listed above and access only the list you choose to synchronize;
Storage in Brazil: data is kept in a database hosted on servers in Brazil (section 4.2), with access restricted by internal access controls;
Incident response: in the event of a security incident affecting Google data, we will notify the affected data subjects and the ANPD (the Brazilian National Data Protection Authority), as set out in section 8, and will revoke the tokens involved.

Sharing: we do not transfer or disclose data obtained from Google to third parties, except (i) to infrastructure providers that process it on our behalf, as set out in section 4, (ii) to comply with a legal obligation or (iii) as part of a corporate transaction, with prior notice to you.

How to revoke access and delete data:

you can disconnect the account at any time in My area → Integrations. When you disconnect, we revoke the token with Google, delete the tokens and synchronization links, and stop accessing your account; you can also choose to remove from your personal area the tasks that were imported from it (the permanent deletion of those tasks occurs when the account is closed or upon request to the DPO);
you can also remove access directly at myaccount.google.com/permissions;
to request deletion of the Google data we hold, write to [email protected]; we respond within 15 days. When the account is closed, integration data is deleted as set out in section 7.

Google user data: Limited Use

Ocara's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy , including the Limited Use requirements.

6. Data subject rights (LGPD, art. 18)

You may, at any time, request:

Confirmation that processing exists;
Access to your data;
Correction of incomplete, inaccurate or outdated data;
Anonymization, blocking or deletion of unnecessary or excessive data, or data processed in violation of the LGPD;
Data portability;
Deletion of data processed on the basis of consent;
Information about the sharing that has taken place;
Information about the possibility of not providing consent and the consequences of refusal;
Revocation of consent;
Review of automated decisions, where applicable.

To exercise your rights, contact the DPO at [email protected]. We will respond within the periods set by law. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

7. Retention and deletion

We keep personal data only for as long as necessary for the purposes of this Policy, observing:

Account data and content: kept while the account is active. The account is closed upon request to the DPO (section 11); after the request, the data is deleted or anonymized within 90 days, unless a legal retention obligation applies;
Integration data (tokens and synchronization links): deleted when the account is disconnected or, at the latest, together with the account data, within 90 days after closure;
Access logs: kept for at least 6 months (Marco Civil da Internet);
Tax and billing data: kept for the periods required by tax legislation;
Data necessary for the regular exercise of rights: kept for the applicable limitation periods.

8. Security

We adopt appropriate technical and organizational measures to protect personal data, including encryption in transit (TLS) and at rest, access control, activity logging and secure development practices. No system is completely immune to risk; in the event of a security incident that may cause relevant risk or harm, we will notify the affected data subjects and the ANPD, in accordance with art. 48 of the LGPD.

9. Data of minors

The Platform is intended for professional use by people over 18 years of age. We do not knowingly collect data from children and adolescents. If we identify an account created under these conditions, the account will be closed and the data deleted.

10. Changes to this Policy

We may update this Policy periodically. Material changes will be communicated by e-mail or a notice on the Platform, with the update date indicated at the top of this document. Continued use of the Platform after the changes implies acknowledgment of the new version.

11. Contact

Questions about this Policy or about the processing of personal data may be sent to the DPO (Data Protection Officer):

E-mail: [email protected]
Address: Avenida Roberto Camelier, 558, Jurunas, CEP 66033-640, Belém/PA