1. Introduction
This Privacy Policy describes how Strucit collects, uses, shares, stores and protects information about the users of its platform.
Strucit is a solution for planning, documenting, modeling and managing information technology infrastructure, data networks and Wi-Fi environments, available as desktop, mobile and web applications.
This policy is designed to meet the Brazilian General Data Protection Law (LGPD), the General Data Protection Regulation (GDPR, European Union and European Economic Area), the UK GDPR (United Kingdom), PIPEDA (Canada) and U.S. state privacy laws such as the CCPA/CPRA (California).
By using Strucit, the user acknowledges this Privacy Policy and agrees to the processing of their data as described here.
2. Who we are
Strucit is provided by Bits – Assistencia Tecnica de Equipamentos de Informatica e Perifericos Ltda. (“Bits TI”), a Brazilian company registered under CNPJ 37.165.414/0001-80, with its registered office at Setor Habitacional Arniqueira (Águas Claras), SHA Conjunto 4, Chácara 57a, Lote 09, Brasília/DF, CEP 71.994-295, Brazil. Bits TI acts as the controller of the personal data processed in providing the services described in this policy, except where it acts solely as a processor on behalf of corporate customers (see Annex III).
For questions about privacy or to exercise legal rights, data subjects may contact us through the channels listed at the end of this policy.
3. Scope of this policy
This policy applies to:
- the Strucit website;
- the desktop applications;
- the mobile applications;
- the web applications;
- the APIs and integrations provided by Strucit;
- support, customer service and customer relationship services.
It does not apply to third-party services reached through external links.
4. Data we collect
4.1 Data provided by the user
We may collect:
- name;
- email;
- phone number;
- company;
- job title or role;
- billing address;
- payment information;
- login credentials;
- documents or files voluntarily uploaded.
4.2 Data generated by using the platform
We may collect:
- access logs;
- IP address;
- device identifiers;
- operating system;
- language;
- time zone;
- application performance information;
- error and crash logs;
- information about feature usage.
4.3 Technical infrastructure data
Depending on the features used, the user may store or process information about:
- network topologies;
- equipment inventories;
- diagrams;
- infrastructure configurations;
- Wi-Fi coverage maps;
- technology asset information;
- technical documentation;
which may contain personal data when entered by the user.
4.4 Cookies and similar technologies
Strucit may use cookies, pixels, local storage and equivalent technologies for:
- authentication;
- security;
- personalization;
- usage analysis;
- improving the user experience;
- statistics and metrics.
The user can control these technologies through their browser or device settings.
5. Local operation and cloud operation
5.1 Free accounts
In certain free modes, project data may remain stored exclusively on the user’s device.
In that case:
- Strucit may have no access to the content of the projects;
- processing may take place entirely in the user’s local environment;
- responsibility for backups, device protection and data preservation may rest with the user.
5.2 Subscriptions and cloud features
In paid plans, or in specific synchronization, collaboration, backup or remote processing features, information may be transmitted to and stored in cloud infrastructure operated directly by Strucit or by contracted service providers.
In these situations, Strucit may process the data strictly for:
- providing the contracted services;
- synchronization across devices;
- controlled sharing;
- backup;
- data recovery;
- technical support;
- operational monitoring;
- platform security.
6. Confidentiality of infrastructure content
Diagrams, topologies, inventories, floor plans and network configurations may be sensitive information from the standpoint of the operational security of the user and their organization.
Strucit processes this content only to provide the services requested by the user and does not use it for marketing, for training artificial intelligence models or for reselling data without the user’s express authorization.
7. Purposes of processing
Data may be used to:
- provide the contracted services;
- create and manage accounts;
- process payments;
- authenticate users;
- provide support;
- respond to requests;
- improve features;
- develop new features;
- prevent fraud;
- detect security incidents;
- comply with legal and regulatory obligations;
- exercise rights in judicial, administrative or arbitration proceedings.
8. Legal bases
Where applicable, processing will rely on one or more of the following legal bases:
- performance of a contract;
- compliance with a legal obligation;
- regular exercise of rights;
- credit protection;
- legitimate interest;
- consent;
- protection of life or safety;
- other cases provided for by law.
9. Data sharing
Strucit may share data with:
Service providers
- cloud providers;
- payment processors;
- authentication services;
- analytics platforms;
- communication providers;
- technical support vendors.
The current list of these providers is in Annex I.
Authorities and public bodies
When required by law, court order or a legitimate request from a competent authority.
Corporate transactions
In the event of a merger, acquisition, corporate reorganization or sale of assets.
Strucit does not sell users’ personal data.
10. International transfers
Data may be processed or stored in countries other than the one where the user is located.
Where an international transfer takes place, Strucit will adopt appropriate mechanisms to ensure protection consistent with applicable law, including:
- appropriate contractual clauses;
- safeguards recognized by competent authorities;
- mechanisms legally authorized for international transfers.
The mechanisms used in each jurisdiction are described in Annex II.
11. Data retention
Data will be kept:
- for as long as needed to provide the services;
- to comply with legal obligations;
- to meet regulatory requirements;
- to resolve disputes;
- for the regular exercise of rights.
Once the legitimate purposes have ended, data may be deleted, anonymized or kept as required by law.
Specific periods:
| Data | Period |
|---|---|
| Account and cloud-saved projects | For as long as the account exists |
| Cloud projects after a paid plan ends | Those beyond the free plan’s limit are permanently deleted 7 days after the plan ends, keeping the most recently edited, with prior notice by email |
| Deleted accounts and projects | Removed from the live database at once; kept in automatic backups for up to 7 days and in weekly backups for up to 8 weeks, with no other use |
| Account deletion record (identifiers and dates, no email) | 1 year, as proof of the deletion |
| Email address of people invited to projects or organizations | Kept after the invitation expires and may be used for communications about Strucit under section 15; the person may ask for its deletion at any time |
| Tax and billing documents | For the period required by law |
| Technical logs and data held by providers (Annex I) | According to each provider’s policy |
12. Information security
Strucit adopts appropriate technical and administrative measures to protect data against:
- unauthorized access;
- improper alteration;
- destruction;
- loss;
- leakage;
- misuse.
These measures may include:
- encryption;
- access control;
- authentication;
- monitoring;
- environment segmentation;
- audit logs;
- backups.
Despite these efforts, no system is completely immune to security risks.
13. Data subject rights
Under applicable law, the user may request:
- confirmation that processing takes place;
- access to the data;
- correction of incomplete or inaccurate data;
- anonymization;
- blocking;
- deletion;
- portability;
- information about sharing;
- withdrawal of consent;
- objection to processing where applicable.
Requests may be sent through the contact channels provided by Strucit.
14. Children’s and teenagers’ data
Strucit’s services are aimed mainly at professionals, companies and organizations, but they may also be used by minors, for example as members of the Organization of an employer or an educational institution, under the responsibility of that entity or of their legal guardian.
- Purchases: paid plans, subscriptions and other purchases may only be contracted and paid for by adults with full legal capacity under applicable law or by duly authorized representatives of a legal entity. Minors may not contract or pay for subscriptions. When a minor needs a paid plan, it must be purchased by their parent, legal guardian, or the organization (for example, a school or company) they belong to.
- Consent: below the minimum age of digital consent set by the law of the user’s country (for example, under 13 in the United States, between 13 and 16 in the European Union depending on the country, and children under 12 in Brazil), creating an account and processing data require the consent of a parent or legal guardian.
- Best interest: minors’ data is processed in their best interest, limited to what is needed to provide the service, and is not used for targeted advertising.
Parents or legal guardians may request access to, correction of or deletion of a minor’s data through the contact channels in this policy.
15. Communications and marketing
Strucit may send communications about:
- the user’s account;
- the operation of the platform;
- the security of the service;
- news and updates.
Where required by law, promotional communications will be sent only with consent or another applicable legal basis.
The user may unsubscribe from promotional messages at any time.
16. Third-party services and integrations
The platform may integrate with third-party services and applications.
Processing carried out by those providers is subject to their own privacy policies and terms of use.
17. Changes to this policy
Strucit may update this Privacy Policy from time to time.
Material changes may be communicated through the platform, the website or the registered contact channels.
18. Contact and data protection officer
Questions about privacy, data protection or the exercise of rights may be sent to:
- Email: legal@strucit.com
- Website: https://strucit.com
Where required by applicable law, Strucit will keep the details of its Data Protection Officer (DPO) up to date here.
Annex I — Sub-processors
Providers that process personal data on Strucit’s behalf:
| Provider | Purpose | Data processed |
|---|---|---|
| Cloudflare, Inc. | Hosting of the website and application, content delivery, abuse protection, real-time collaboration and access statistics | Technical access data (IP, browser, pages); content of projects open for collaboration |
| Microsoft Corporation (Azure) | Database and backups | Account, organization and cloud-saved project data |
| Clerk, Inc. | Authentication and account management | Name, email, login credentials, sessions |
| Stripe, Inc. | Payment and subscription processing | Billing and payment data |
| Sendinblue SAS (Brevo) | Transactional email | Name, email, message content |
This list may be updated as providers are added or replaced.
Annex II — International transfers
- Brazil (LGPD): transfers based on the cases in Article 33 of the LGPD, including standard contractual clauses approved by the ANPD.
- European Union and European Economic Area (GDPR): adequacy decisions of the European Commission (including the EU-U.S. Data Privacy Framework, where the provider is certified) or standard contractual clauses approved by the European Commission.
- United Kingdom (UK GDPR): UK adequacy regulations (including the UK Extension to the Data Privacy Framework) or the International Data Transfer Agreement / Addendum to the EU standard contractual clauses.
- Canada (PIPEDA): contractual protections ensuring a level of protection comparable to that required by Canadian law.
Annex III — Processing of corporate data
Strucit as controller. Strucit acts as controller of account, billing, platform usage, support and communications data, processed to provide and manage the services.
Strucit as processor. When a customer organization uses Strucit, the personal data that it and its members enter in projects and organization content (for example, names of people in charge, contacts or equipment identifiers) is processed by Strucit on behalf of that organization and according to its instructions. In these cases, the customer organization is the controller and is responsible for the legal basis of the processing towards data subjects.
Organizations that need a data processing agreement (DPA) may request one through the contact channels in this policy.