Privacy Policy

Safelys is operated by RUDU CONSULTORIA EM TECNOLOGIA LTDA, registered under CNPJ 59.850.188/0001-00. For the activities described here, RUDU is the controller of personal data.

This policy applies to the Safelys platform, including account access, training, certificates, public certificate verification, and our support channels.

We process account and identity data, authentication and session records, organization role and permission data, training enrollments, learning progress, assessment results, certificate records, renewal information, and the operational evidence needed to investigate security events and meet audit requirements.

• We use contractual necessity to provide accounts, authentication, sessions, multi-factor authentication, permissions, essential service emails, training access, enrollment, progress, assessments, certificates, renewals, and necessary sharing between the worker, company, and training provider involved in that training.
• We use legitimate interests, after assessing necessity and impact, to prevent fraud, protect the platform, and maintain append-only audit records.
• We retain relevant evidence when necessary for the regular exercise of rights in judicial, administrative, or arbitral proceedings.
• We will request specific, revocable consent before enabling optional external media or optional aggregate product analytics.

We limit access by role and organization. A company and the training provider involved in a worker's training may receive only the minimum data needed to administer that training, its evidence, and its certificate. Unrelated organizations do not receive access.

We do not make internal Safelys administrator identities, sessions, or actions visible in tenant-facing platform experiences.

We use the following approved service providers to operate Safelys:

• Managed PostgreSQL database for persistent platform records.
• Resend for essential transactional email.
• ZapSign for certificate-signing evidence and verification.
• Bunny Stream and Storage for approved training media.
• YouTube is a conditional provider with Production playback disabled.

An approved provider may process personal data outside Brazil. Before the first Production deployment, we will validate the relevant provider locations, subprocessor arrangements, and transfer safeguards. When applicable, international processing will follow the requirements of Brazilian data protection law.

We keep data for as long as needed to provide the service, preserve certificate and audit evidence, handle a request or dispute, and meet a legal duty that specifically applies. We then delete or anonymize it when appropriate.

We use access controls, role separation, tenant scoping, security monitoring, and append-only audit records. No control can remove every risk, so we investigate reported incidents and take proportionate action.

You may request confirmation of processing, access, correction, anonymization, blocking or deletion when applicable, portability, information about sharing, and withdrawal of consent.

To submit a privacy request, contact us at contato@safelys.com.br.

YouTube external media is not enabled for Production playback.

Before a future release makes external media available, it must be disabled by default. If you refuse it, Safelys must not load that provider's player, script, thumbnail, API, or other resource in your browser. The controls must let you change this choice later.

If Safelys enables YouTube in a future release, YouTube may receive Basic User Data when its player loads and playback data later. It may use cookies or local storage, and it can show advertising, recommendations, provider controls, or links that navigate away from Safelys.

We use YouTube only to load the external media you choose to play. Privacy-enhanced mode may use youtube-nocookie.com, but it is not a no-data, no-cookie, or no-ad guarantee.

A future external-media choice will not grant course access or approve a source.

Individual learning evidence is part of the training service and is not optional analytics. Optional aggregate product analytics will remain disabled until we approve its provider, region, and event inventory. If enabled later, it will require your specific consent and can be withdrawn.

The current Safelys launch does not request health, accident, fitness, biometric, trade-union, or other sensitive personal data through attachments or problem reports. Any future feature that needs sensitive data will undergo a separate legal-basis, access, retention, and policy review before release.

We may update this policy when Safelys or applicable requirements change. The current version and effective date appear at the top of this page.