Privacy Policy — Sirius LiDAR (subscription)

Version 1.0 — sold through Paddle on siriuslidar.com — 9 October 2026 (Brazilian General Data Protection Law, Law No. 13,709/2018 — LGPD). English translation for reference; the Portuguese version prevails.

Controller: Sirius Soluções Geoespaciais Inova Simples (I.S.), CNPJ 68.164.899/0001-11, with registered office at Avenida Doutor João Batista Soares de Queiroz Júnior, 120, apto. 93, Edifício Araruama, Jardim das Indústrias, São José dos Campos/SP, CEP 12240-000, Brazil.

Contact channel for data subjects (ANPD Resolution CD/ANPD No. 2/2022, art. 11): contato@siriuslidar.com. As a small-sized processing agent, Sirius is exempt from appointing a data protection officer; this channel receives complaints, requests and communications from data subjects and from the ANPD.

1. Your work data stays on your computer

Sirius LiDAR processes point clouds, models, contours, drawings, orthophotos and project information exclusively on your computer. None of these files is sent to Sirius or to third parties. The project information and the logo you register are stored locally, in the application’s data folder. If you voluntarily send us files or screenshots, for example in a support request, they are used only for that request and deleted when it is closed.

2. Data processed for the license

To activate the license and periodically check that the subscription is active, the program connects to Sirius’s license server, hosted by Cloudflare, and sends only:

(a) the license key;
(b) a pseudonymous technical identifier of the computer, generated from hardware characteristics and transformed by a cryptographic function (hash), which does not contain your name, the computer name or any of your files;
(c) the IP address, which is inevitably transmitted in any internet connection and may be logged by the server provider for security and fraud prevention.

Purposes: to activate and validate the subscription, limit use to the number of computers contracted, allow the license to be moved to another computer and prevent unauthorized use of the key. Legal basis: performance of the license contract (LGPD, art. 7, V) and, for fraud prevention, legitimate interest (art. 7, IX). Note: these data are needed for the license to work; without them the program cannot be activated (art. 9, §3). Sirius does not use these data to track your behavior or for advertising.

3. Purchase and subscription data

The purchase is processed by Paddle.com Market Limited, based in the United Kingdom, which acts as reseller (merchant of record). To sell, charge, issue the invoice and collect taxes, it collects your name, e-mail, country, billing address and payment details directly from you, as an independent controller, under its own privacy policy. Paddle informs Sirius of your name, e-mail, country, plan and subscription status, so that Sirius can issue and manage your license. Sirius does not receive your card details. Sirius uses these data, and the payment history visible in Paddle’s dashboard, to provide support, process refunds and manage your license (art. 7, V), to comply with legal obligations (art. 7, II) and to exercise its rights in any legal proceedings (art. 7, VI).

4. International transfer

Purchase data are collected directly by Paddle on the payment page and processed in the United Kingdom and, by its subcontractors, in other countries. License data are kept on Sirius’s license server, hosted by Cloudflare, which may process them in the United States and other countries. To the extent there is an international transfer from Sirius or on its behalf (including the support e-mail, hosted by Google), it is based on the need to perform the contract you requested (LGPD, art. 33, IX, together with art. 7, V). You may request more information about these transfers through the channel above.

Sirius does not sell or rent your data. They are shared only with: (i) Paddle, for sales, billing and refunds, and Cloudflare, which hosts the website and the license server; (ii) Google (Gmail), which hosts our support e-mail; (iii) public authorities, when there is a legal obligation or court order; and (iv) legal and accounting advisers, under a duty of confidentiality, when necessary.

6. Retention periods

(a) License key and technical identifier: while the subscription is active and for up to 12 (twelve) months after it ends, to allow reactivation and support; after that, they are deleted or anonymized by Sirius as far as it is concerned.
(b) Purchase data and payment history: kept by Paddle under its own policy. Sirius keeps the necessary records for the applicable limitation and tax period (generally 5 years after the end of the relationship), to comply with legal obligations and defend itself in any proceedings (art. 16, I, and art. 7, VI).
(c) Support e-mails: up to 2 (two) years after the last contact.

After these periods, the data are deleted or anonymized.

7. Your rights

Under art. 18 of the LGPD, you may request, free of charge:

confirmation that your data are processed;
access to the data;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;
portability;
deletion of data processed with consent;
information about the entities with which we share your data;
information about the possibility of not consenting and its consequences;
withdrawal of consent.

You may also object to processing based on legitimate interest if it breaches the LGPD. Send your request to contato@siriuslidar.com; we may ask you to confirm your identity and will reply within the legal deadlines. For data held by Paddle (payment, billing address), you may also exercise your rights directly with Paddle; Sirius will help forward your request. Data needed to comply with a legal obligation or to exercise rights may be kept (art. 16). You may also petition the Brazilian National Data Protection Authority (ANPD) and consumer protection bodies.

8. Communications

Receipts and payment notices are sent by Paddle; renewal, price, product and security notices are sent by Sirius, directly or through Paddle (performance of the contract, art. 7, V). Marketing e-mails, if any, are only sent with your consent (art. 7, I), which you may withdraw at any time through the unsubscribe link.

9. Security

We take reasonable technical and administrative measures, proportionate to our size, to protect the data: encrypted communication (HTTPS) with the license server, restricted access to dashboards with two-factor authentication and no storage of card details. No system is completely immune to incidents.

10. Children and adolescents

Sirius LiDAR is professional software intended for people over 18 and for companies. We do not knowingly collect data from children or adolescents. If we identify such data, it will be deleted.

11. Cookies

The program does not use cookies, tracking or advertising tools. The siriuslidar.com website does not use tracking cookies. Paddle’s payment page may use its own cookies, necessary for the payment, under its own policy.

12. Incidents

If a security incident occurs that may create a relevant risk or damage to you, we will notify the ANPD and you within the regulatory deadlines (ANPD Resolution CD/ANPD No. 15/2024), stating what happened, the data affected and the measures taken.

13. Changes

This policy may be updated. The current version and its date are published on siriuslidar.com. Relevant changes will be communicated by e-mail or in the program itself before they take effect.