Privacy Policy

1. Data Processing Agents — Controller and Processor

For registration, payment, and support data (name, email, phone, country, date of birth, billing data), Porty Consultoria e Treinamento Ltda - ME (CNPJ 58.540.700/0001-59) acts as controller: it decides the purpose of this processing.

For personal data of third parties that may be contained within the .xer file you upload (names of personnel, team members, suppliers), Gamtty acts as processor: you, as the customer, are the controller of that data, and Gamtty only processes it mechanically, on your instructions, to generate the requested spreadsheet.

2. Data We Collect

• Registration: name, email, phone (verified by SMS), country, date of birth, password (hashed) or login via Google/Microsoft/GitHub
• Payment: processed by Stripe — Gamtty does not store card data
• Content of the uploaded .xer file: may contain project data, schedule, resources, activity names and codes, business information, and, depending on what you included in the source file, personal data of third parties and other Primavera P6 technical metadata. Gamtty has no control over what you enter in the file and is not responsible for the inclusion of third-party data made by you, nor for any privacy violation of employees, collaborators, or other data subjects whose data appears in a user company's schedule — in this case Gamtty acts as processor, and you (or the company that entered the data) are the responsible controller
• The .xer/.xlsx files themselves: active conversion files are deleted within 30 minutes of processing completion or failure, except for temporary technical retention in logs, security backups, or evidence needed for fraud prevention, security, or legal compliance
• Data extracted from the file (project name, WBS, task names and dates): stored in our database, with no predefined retention period as of now. You may request deletion of this data by emailing suporte@gamtty.com
• Optional: marketing opt-in, unchecked by default
• Record of acceptance of the Terms of Use, Privacy Policy, and recurring billing terms: version of the document accepted, date and time, IP address, and browser used, kept as proof of consent
• Aggregate site audience data: number of visits, page views, referral source, and country, collected by a measurement tool that uses no cookies and performs no individual identification — we do not use this data to profile anyone

3. Purpose and Legal Basis

We process your data for contract performance (converting the file, billing the subscription), compliance with a legal or tax obligation, consent (marketing communications), and legitimate interest in keeping a record of proof of acceptance and in aggregate site audience measurement, under Article 7 of Brazil's General Data Protection Law (LGPD).

4. Date of Birth — Specific Purpose

We collect your date of birth exclusively to (a) confirm that you meet the minimum age requirement of 18 to contract the service, based on contract performance (LGPD Art. 7, V); and, when you opt in to receive marketing communications, to (b) segment campaigns by age group, based on your consent (LGPD Art. 7, I). We do not use your date of birth for any other purpose.

5. International Data Transfer

Stripe, Twilio, Google, Microsoft, and GitHub process data outside Brazil, depending on the service you use (payment, SMS verification, or login). This transfer relies on the necessity of contract performance and on the standard contractual clauses and data processing agreements already maintained by these providers, under Article 33 of the LGPD. If you are located in the European Union or the United Kingdom, the GDPR or UK GDPR may also apply — we rely on these same contractual safeguards from our providers.

6. Retention

We keep your account data for as long as the account exists, plus an additional period when required by a tax or legal obligation. Files and data extracted from conversions follow what is described in item 2.

7. Your Rights

Under Article 18 of the LGPD, you may request confirmation of the existence of processing, access, correction, anonymization or deletion, portability of your data, and revoke previously given consents — by emailing suporte@gamtty.com.

8. Security

We use password hashing, encrypted connection (HTTPS), and restricted, auditable administrative access. We keep technical logs (access, errors, administrative action audits) separately from conversion files, for a limited period, exclusively for security, diagnostic, and legal compliance purposes.

9. Security Incidents

In the event of an incident that could pose a risk or relevant harm to data subjects, we will investigate, adopt containment measures, and notify Brazil's National Data Protection Authority (ANPD) and/or the affected data subjects, under Article 48 of the LGPD, within a reasonable timeframe.

10. Minors

The service is not intended for individuals under 18 years of age.

11. Changes to This Policy

We may update this policy periodically. Material changes will be communicated with reasonable prior notice.