Privacy Policy
Last updated:
This Policy explains how Pidgely ("we"), an email API for developers operated by Caotec Serviços em Tecnologia Ltda, processes personal data on the pidgely.com website, in the waitlist and early-access program, and when it delivers email for its customers. It follows Brazil’s General Data Protection Law (Law No. 13,709/2018, "LGPD") and, where applicable, the EU General Data Protection Regulation ("GDPR").
In short: we do not sell data, we run no ads or tracking on this site, and we never use the emails our customers send for our own purposes.
1. Who is responsible
| Item | Information |
|---|---|
| Company | Caotec Serviços em Tecnologia Ltda, operator of Pidgely |
| CNPJ (Brazilian company ID) | 25.171.456/0001-45 |
| Address | Rua Doutor Procópio Toledo Malta, 750, Loteamento Habitacional São Carlos 1, São Carlos/SP, CEP 13563-002 |
| Data Protection Officer (DPO) | Cendy Andreoli de Oliveira · privacy@pidgely.com |
| General contact | contact@pidgely.com |
We play two different roles:
- Controller for data about our own visitors, waitlist sign-ups, customers and their team members (for example, the email you use to sign up).
- Processor (operator, under the LGPD) for the personal data inside the emails our customers send through Pidgely, such as recipient addresses and message content. In that case the customer is the controller: it decides who receives what, and it is responsible for having a legal basis to email its recipients. We process that data only to deliver the service and according to the customer’s instructions.
2. Data we process
| Category | Data | Role |
|---|---|---|
| Waitlist | Email, company (optional), intended use, language, whether you agreed to product news, date of sign-up | Controller |
| Customer account | Name, email, company, team members, sending domains and their DNS settings, API keys (stored in protected form), plan, usage and billing details | Controller |
| Support and contact | Messages you send us and our replies | Controller |
| Security records | Technical request records (such as IP address, time, route and result) used to protect the service, limit abuse and investigate incidents | Controller |
| Email sent through Pidgely | Sender and recipient addresses, subject, content, headers and attachments of each message | Processor, on behalf of the customer |
| Delivery data | Delivery events (delivered, deferred, bounced, complained, unsubscribed), receiving server responses, bounce and complaint reports, suppression lists and webhook deliveries | Processor, on behalf of the customer |
What we do not do: we do not read message content for marketing, profiling or advertising, and we do not use recipient addresses to contact anyone. Automated checks on outgoing mail (for example, to block malware or abusive sending) exist only to protect the platform and its users.
3. Purposes and legal bases
| Purpose | Legal basis (LGPD art. 7 / GDPR art. 6) |
|---|---|
| Keep the waitlist and invite you to early access | Your request (pre-contractual steps) |
| Send product news, launch updates and tips | Consent, only if you tick the box; withdraw any time |
| Create and run your account, deliver email, bill and provide support | Performance of contract |
| Process email data for customers (delivery, events, suppression, webhooks) | On the customer’s instructions, under the contract with them |
| Protect the service: authentication, rate limits, abuse prevention, sandbox and automatic pausing of risky senders | Legitimate interest in a secure, reputable sending platform |
| Comply with legal and tax obligations and defend rights | Legal obligation and regular exercise of rights |
4. Who we share data with
We share data only with providers that help us run the service (sub-processors), each limited to its role and bound to protect the data:
| Provider | Purpose |
|---|---|
| Railway | Hosting of the pidgely.com website |
| Infrastructure providers | Servers, databases, storage and backups that run the API and the mail servers |
| Payment provider (when paid plans open) | Processing payments and invoices |
Delivering an email necessarily means handing it to the recipient’s mail server (for example, Gmail or Outlook). We do not use a third-party sending service: Pidgely delivers mail with its own servers.
We do not sell, rent or share personal data with advertisers or data brokers. The current list of sub-processors is available on request at privacy@pidgely.com.
5. International transfers
Some providers may store or process data outside Brazil (for example, in the United States or the European Union). These transfers are necessary to provide the service and rely on the safeguards in the providers’ terms (LGPD art. 33; standard contractual clauses where the GDPR applies). Ask the DPO for details.
6. How long we keep data
| Data | Period |
|---|---|
| Waitlist | Until you join, ask to leave, or we stop the program |
| Marketing consent | Until you withdraw it |
| Customer account | While the account exists; deleted within 30 days after closure |
| Message content | Only for a short period needed to deliver, retry and troubleshoot, then deleted automatically |
| Delivery events and suppression lists | While the customer account exists (suppressions protect recipients who opted out) |
| Billing records | For the period required by tax law |
| Security records and backups | For a limited time, then overwritten on a rolling basis |
7. Your rights
You may, free of charge: confirm whether we process your data; access, correct or update it; request anonymization, blocking or deletion; request portability; withdraw consent; obtain information about sharing; object to processing based on legitimate interest; and petition Brazil’s data protection authority (ANPD) at gov.br/anpd or your local authority.
Write to privacy@pidgely.com. We reply within 15 days and may ask you to confirm your identity.
If you received an email sent through Pidgely, the sender is our customer and controls that data. Use the unsubscribe link in the message or contact the sender; you can also write to us and we will forward your request.
8. Security
- Encrypted connections (HTTPS/TLS) to the website and the API.
- API keys and signing keys stored in protected form; access restricted to the minimum necessary.
- Webhooks signed so customers can verify they came from us.
- Isolation between customer accounts and automatic controls against abusive sending.
No system is 100% secure. If an incident may cause relevant risk, we will notify the ANPD, affected customers and data subjects as required by law.
9. Website and cookies
The website has no analytics, advertising or tracking. It sets a single cookie, only when you pick a language, to remember that choice. Details in the Cookie Policy. Our rules for emails we send you are in Communications and marketing.
10. Children
Pidgely is a business service for developers and is not directed to children. We do not knowingly collect data from anyone under 18.
11. Changes
We may update this Policy. The date at the top shows the current version; material changes will be announced by email to customers before they take effect.