Vision4Ops processes corporate cloud billing data provided by the client — not personal data of end consumers. This notice explains what we collect, why, how long we keep it, and your rights under the LGPD (Brazil) and applicable U.S. law.
1. Definitions
Controller: Vision4Ops LLC, incorporated in the State of Florida, USA ("Vision4Ops", "we", "us") — the entity that determines the purposes and means of processing personal data.
Data Subject: any natural person whose personal data is processed by Vision4Ops — typically corporate users (employees of client companies).
Personal Data: any information relating to an identified or identifiable natural person.
Processing: any operation performed on personal data, such as collection, storage, use, or deletion.
2. Types of Data Collected
We collect the following categories of personal data:
- Account and contact data: corporate email address, name, and company name — provided at registration.
- Cloud billing data: cloud cost records provided by the client from their cloud provider — these records contain service and resource identifiers, not personal data of end users.
- Platform usage data: actions taken within the platform (features used, session events) — collected automatically to improve our services.
- Access data: IP address, collected temporarily for security purposes (abuse and fraud prevention), retained for a maximum of 1 hour.
3. Purposes of Using Personal Data
We use personal data exclusively for the following purposes:
- Provide, operate, and improve the Vision4Ops platform.
- Authenticate users and protect accounts against unauthorized access.
- Generate FinOps analytics, AI-powered recommendations, and cost optimization reports from cloud billing data provided by the client.
- Respond to support and service requests.
- Comply with legal obligations applicable to the company.
We do not sell, rent, or share personal data with third parties for marketing or advertising purposes.
The legal bases for processing under the LGPD are: performance of a contract (Art. 7º, V) for service delivery; legitimate interest (Art. 7º, IX) for security and product improvement; and legal obligation (Art. 7º, II) for legally required record retention.
4. Sharing of Your Personal Data
We share personal data only with cloud infrastructure providers engaged to operate the platform, all of which maintain adequate data protection standards and contractual guarantees. These providers act solely as processors under our instructions and may not use the data for their own purposes.
As Vision4Ops operates in the United States, personal data is transferred internationally. For data subjects in Brazil, such transfers are conducted in compliance with LGPD Art. 33, with appropriate contractual safeguards in place with all providers.
We do not disclose personal data to public authorities except when required by law or court order.
5. Retention of Your Personal Data
- Account and contact data: retained for the period necessary to provide the services and for up to 24 months after contract termination, or for as long as required by applicable law.
- Cloud billing data provided by the client: retained for the period necessary to provide the services and for up to 24 months after contract termination, then permanently deleted.
- Platform usage data: retained for up to 90 days, then automatically deleted.
- Access data (IP address): maximum 1 hour, automatically deleted.
6. Cookies
Vision4Ops uses only technically essential session tokens required for authentication and platform operation. We do not use tracking, advertising, or behavioral analytics cookies. A cookie consent banner is displayed on our institutional website informing of this use.
7. Your Rights Regarding the Processing of Your Personal Data
Under the LGPD (and applicable U.S. law), you have the right to:
- Access: request confirmation of whether we process your data and obtain a copy of it.
- Correction: request correction of inaccurate, incomplete, or outdated data.
- Deletion: request erasure of personal data processed with your consent or without legal basis (subject to legal retention requirements).
- Portability: receive your data in a structured, interoperable format.
- Information about sharing: know with which public or private entities we share your data.
- Objection: object to processing carried out on a basis other than consent, in case of non-compliance with the LGPD.
- Revocation of consent: where processing is based on consent, withdraw it at any time, free of charge.
To exercise any of these rights, contact privacy@vision4ops.com. We will respond within 15 business days as required by the LGPD. You may also file a complaint with the ANPD (Autoridade Nacional de Proteção de Dados) at www.gov.br/anpd.
8. Security of Your Personal Data
We adopt technical and organizational measures appropriate to the level of risk, including encryption of data in transit and at rest, role-based access controls, continuous monitoring, and regular security reviews. Access to personal data is restricted to authorized personnel with a documented need. In the event of a security incident involving personal data, we will notify affected users and the competent authority within the legally established timeframes.
9. Links to Other Sites
Our platform and website may contain links to third-party sites. We are not responsible for the privacy practices of these sites and recommend that you read their respective privacy notices before providing any personal data.
10. Data Protection Officer (DPO)
Vision4Ops LLC has designated a person responsible for data protection matters. For any privacy-related questions, requests, or complaints, contact:
privacy@vision4ops.com
Vision4Ops LLC · State of Florida, USA
11. Updates to This Privacy Notice
We may update this Privacy Notice periodically to reflect changes in our practices or applicable legislation. Material changes will be communicated by email to the registered account holder at least 14 days before taking effect. The current version will always be available at vision4ops.com/privacy.html. Continued use of the platform after the effective date of the updated notice constitutes acceptance of the new terms.