Privacy Policy

1. Scope and responsibility

This policy covers the site, the sign-in and the Kine Quote platform. Edilson Lino is the controller of the data handled by Kine Quote for as long as the operation runs as an individual. The channel for privacy questions and requests is comercial@kinequote.com.

When a customer company enters data about its own customers, it defines the purpose of that processing and must have the applicable legal basis. Kine Quote handles that data only to deliver the contracted features when it is processed in its infrastructure.

2. Definitions

The terms below are the ones used by the LGPD itself, and they carry that meaning throughout this page.

• Data subject: the natural person the data refers to.
• Controller: who decides how and why the data is processed.
• Processor: who processes the data on the controller behalf and following its instructions.
• Processing: any operation on personal data — collecting, using, accessing, storing, sharing, deleting.
• ANPD: Brazilian National Data Protection Authority, the body that enforces the law.

3. Account and platform data

At sign-in, your email and password are used to authenticate access through Supabase. The password is never displayed or stored by the Kine Quote interface. You can also sign in with Google; in that case Google confirms your identity and tells us your name and email.

In the dashboard there may be data entered by the user, such as customer information, contact details, tax ID, machine and material parameters, company settings and quote values. DXF files opened in the dashboard — in Quotes and in Nesting — are read and analyzed in the browser itself; the file content is not sent to any server. In Quotes, the result of the calculation becomes part of the quote. In Nesting, the parts (outline and file name) and the layout are kept in the browser's storage, so they are not lost when you switch screens, until you click Start over; the server only receives a record of each export (type, date and who exported), to count the plan limit. The nestings you save are kept only in this browser until you delete them. Quote this nesting carries each part's name, quantity and price into the quote — never the drawing.

To make sure each account is open on only one device at a time, at every sign-in we record in Supabase the session identifier, the sign-in and last-access times and the device's browser and operating system (the so-called user agent). We keep one record per user, replaced at each new sign-in. Supabase itself may also record IP address and browser when authenticating, for account security. If you ask for a password reset, Supabase sends the link to the account's email. To unlock the free trial we ask you to confirm a mobile number by SMS: the number is stored in your account, in Supabase, and sent to Twilio, which sends the code. Each number confirms only one account.

If you turn on two-step verification, Supabase stores your authenticator app's key in order to check the codes. Changes to prices, permissions, plan, portal and ERP integration are recorded with their author and time, and only the account owner can see them.

4. Browser data and public forms

Customers, quotes, parameters and company settings are kept in your account, in Supabase (section 7), and follow the account on any device. The browser only keeps the Nesting layout in progress, a copy of the preferences described in section 5, so the screen opens faster, and the time of your last activity, used to end the session after 1 hour without use. The nestings you save are also kept in the browser (section 3).

The presentation form on the home page sends the fields you fill in. They are: full name, company, country, WhatsApp (stored in international format, with the country code), email, city/state, line of business, whether you already work with laser cutting, how you quote today and, when provided, cutting table size and machine power. No other data is collected with this submission — we do not record IP address or browser identifier with the form.

Purpose: to contact you to present Kine Quote and understand your company's needs. It is commercial contact requested by you, based on the legitimate interest provided for in art. 7, IX, of the LGPD. The data is not sold, transferred or used for advertising.

Where it is kept: in the Supabase database, in the same environment described in section 7. The form writes, and nothing on the site can read what was written — reading happens only through Kine's administration.

For how long: up to 24 months from submission, or less if the contact ends earlier or you ask for deletion. To request deletion or a copy of your data, write to comercial@kinequote.com; the full rights are in section 10.

The form on the /começar page creates an account. To do so it sends full name, what you want to be called (optional), company, mobile number, email and the chosen password. The password is handled directly by Supabase, which stores it encrypted — Kine Quote does not display, record or have access to it.

Purpose: to create and maintain your access to the platform, and to let us contact you about the account. For how long: as long as the account exists. When it is closed, the registration data is deleted upon request through the channel in section 10.

Quote portal. When a customer company turns on its portal, whoever submits a request provides name, email and, optionally, phone, and chooses material, thickness and quantity. The DXF file is read on the server only to calculate measurements and price; we keep the file name and the measurements, not the drawing. The company that owns the portal is the controller of this data, and Kine Quote acts as processor. Requests are deleted automatically 12 months after submission.

5. Cookies and technical data

We use essential cookies to keep the authenticated session. With “Keep me signed in” checked at sign-in, the session lasts up to seven days; unchecked, it ends when the browser is closed. In either case, the session ends after 1 hour without use. A cookie stores this choice. When you choose a site language, we store a cookie with that choice, valid for one year; it only holds the language code. Dashboard preferences — theme, font size, motion, notifications, the name you chose and the avatar — are kept in your account, in Supabase, so they apply on any device; the browser keeps a copy so the screen opens faster.

The project has no advertising pixel and no third-party analytics tool. We use Sentry to monitor errors: when something fails, the technical data needed for diagnosis — such as the page, the browser and the error message — is sent to the service. Sign-in, sign-up and password reset use Cloudflare's Turnstile to stop bots: it analyzes technical signals from the browser and the connection, such as IP address and device characteristics, and is not used for advertising.

6. Purposes and legal bases

We process data to authenticate access, provide the platform, bill the subscription, send to the ERP what you tell us to send and answer requests related to the service. The legal basis is the performance of a contract or the preliminary procedures to it, at the data subject's request — art. 7, items V and VI of the LGPD.

We also process the minimum necessary for security, abuse prevention, failure diagnosis, change logging and compliance with legal obligations. Here the bases are legitimate interest (art. 7, IX) and compliance with a legal or regulatory obligation (art. 7, II).

We do not use your data for advertising, we do not send newsletters, we do not build behavioral profiles and we do not make automated decisions about you.

7. Services involved

We do not sell personal data or transfer it for commercial purposes. It only passes through the services Kine Quote needs to work: Supabase stores account and platform data, on servers in Brazil (São Paulo region); Vercel hosts and delivers the pages; Sentry receives technical error and performance events; Cloudflare checks, at sign-in, sign-up and password reset, that the user is not a bot; Twilio sends the SMS confirmation code; Google confirms your identity when you choose to sign in with it; and Asaas processes the billing of the subscription and of extra quotes — it receives the company name, the CPF or CNPJ and the email, and payment is made on its own page: the card number never passes through Kine Quote. Each has its own privacy policy.

When your company turns on the ERP integration (today, Omie), the customer and approved-quote data — name, CPF or CNPJ, contact, items and amounts — is sent to the ERP for each order you ask it to create. The ERP key is stored encrypted in the Supabase vault and never comes back to the screen.

Your account and quote data is stored in Brazil. Page hosting, error monitoring, bot verification, SMS delivery and Google sign-in run on infrastructure outside the country; in those cases the international transfer follows the safeguards of articles 33 to 36 of the LGPD.

8. Security

The site uses a secure connection and protection headers, and requires authentication for the dashboard. Each company only sees its own data, with isolation enforced in the database and tested at every change. The account is open on one device at a time, the session ends after 1 hour without use, and you can turn on two-step verification. ERP keys are stored encrypted, sensitive changes are recorded, and an encrypted backup is made every week, outside Supabase.

No system is infallible. In the event of a security incident that may cause relevant risk or damage, we will notify the ANPD and the affected data subjects, as required by art. 48 of the LGPD.

9. Retention and deletion

Data kept only in the browser stays there until you remove it, clear the browser data or use a different profile. Account data and technical data are kept for as long as necessary to provide the service, answer requests and comply with legal obligations.

Some data is deleted automatically, every day: quote portal requests 12 months after submission; payment events received from Asaas, 12 months later; contacts from the presentation form and the change log, 24 months later.

After an account is cancelled, its data is kept for 90 days and then deleted. The period exists to allow second thoughts and reactivation without losing history; within it, immediate deletion can be requested at any time.

You can request deletion or clarification about retention through the privacy channel below. Deletion may be limited when there is a legal obligation to retain or a need for the regular exercise of rights.

10. Your rights

Art. 18 of the LGPD grants you, at any time and upon request:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of data that is unnecessary, excessive or processed outside what the LGPD allows;
• portability to another provider, upon express request;
• deletion of data processed on the basis of your consent;
• information about who we share your data with;
• information about the option not to consent and what happens if you refuse;
• withdrawal of consent, where the processing relies on it;
• objection to processing carried out in breach of the law;
• review of decisions taken solely by automated means, where any exist — today Kine Quote takes none;
• to lodge a complaint with the ANPD.

To exercise these rights, write to comercial@kinequote.com.

11. Data Protection Officer (DPO)

In compliance with art. 41 of the LGPD, the Personal Data Protection Officer for Kine Quote is Edilson Lino, reachable at comercial@kinequote.com. Write with “LGPD” in the subject line: it separates the request from the sales flow and shortens the reply.

Requests are answered within the deadlines set by the LGPD and by ANPD regulation.

12. Who it is for

Kine Quote is a product for companies — metalwork shops, fabricators and laser cutting services — and for their representatives over 18. It is not intended for children or adolescents, and we do not knowingly collect data of that nature.

13. Changes to this policy

This policy may be updated to reflect changes in the product, in the data flows or in the law. The date at the top of the page marks the most recent revision.

14. Governing law and venue

This policy is governed by the laws of the Federative Republic of Brazil. The courts of the district of São Paulo/SP are the agreed venue for any disputes, without prejudice to the competence of the ANPD or to the rights the law grants the data subject to complain wherever it is available to them.