Privacy Policy
Version 1.0 draft, November 2026. Applies worldwide, alongside the Portuguese version for Brazil.
1. Controller and contact
CBS Tech LTDA (CNPJ 54.785.095/0001-25), Curitiba, Brazil, is the controller of the account, license, purchase and support data of OcclusaLab. Privacy requests: support@occlusalab.com.
2. Two separate kinds of data
- Your clinical files (models and projects) are opened and processed locally on your computer or browser. In the normal workflow they are not sent to CBS Tech. You are the controller of your patients' data and must have a legal basis to process it. A dental model can identify a person even without a name, so removing the name does not make it anonymous.
- Online service data is the data we need to run your account, license, payment and support. The rest of this policy is about it.
3. What we process and why
| Data | Purpose | Legal basis |
|---|---|---|
| Email, account ID, sign-in and recovery records | Account and authentication | Contract |
| Device identifier, public cryptographic key, session and license records, computer replacements | Limit use to two computers and one at a time | Contract |
| Plan, amount, dates, payment status, cancellation and acceptance records (never full card numbers) | Link payment to access | Contract; legal obligation for tax records |
| Support messages | Answer your requests | Contract; legitimate interest |
| IP address, browser, technical logs | Security and abuse prevention | Legitimate interest |
| Language preference (browser storage) | Remember your language | Necessary for the service |
Operational emails (sign-in, payment, renewal notice) are part of the service. We do not send marketing without separate consent. We do not sell personal data. We do not use advertising or behavioral tracking on the account pages or the Viewer.
4. Service providers
Supabase (authentication and license records), Paddle (payments outside Brazil, as Merchant of Record and independent controller for payment data), Asaas (payments in Brazil), Resend (transactional email), Cloudflare (hosting, website delivery and email routing) and Google (support mailbox). Each receives only what its function needs.
5. International transfers
These providers may store or process data outside your country, including in the United States and the European Union. Transfers rely on the safeguards available under applicable law, such as Standard Contractual Clauses. You can ask us for details.
6. Retention
Account and license data are kept while you use the service and then for as long as needed for security, legal obligations and the defense of rights. Billing records may be kept for the periods required by tax law. Deleting your online account does not delete your local files or copies you shared.
7. Your rights
Depending on where you live (for example under the GDPR, UK GDPR or Brazil's LGPD), you may request access, correction, deletion, restriction, portability and objection, and withdraw consent where consent is the basis. Write to support@occlusalab.com. We may ask for proportionate proof of identity. You may also complain to your data protection authority.
8. Security and incidents
We use access controls, encrypted connections, separation of license data and device-bound authentication. No system is risk-free: protect your computer, password and backups. If an incident affects your personal data, we will notify the authorities and affected people as the law requires.
9. Changes
We will announce relevant changes before they take effect. Each version shows its date.