Privacy Notice
How Moatgator handles personal data, in line with Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018).
Last updated:
法律审核中的草案。本文本尚不具约束力，可能会有变更。
This is a courtesy translation; the Portuguese version prevails.
This Privacy Notice explains how GZ Segurança e Defesa Cibernética LTDA ("Moatgator", "we") handles personal data when providing the runtime protection platform for mobile apps available at moatgator.com, app.moatgator.com, api.moatgator.com and related services. It follows Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018).
If versions in different languages conflict, the Portuguese version prevails.
Who is the controller
The controller of the personal data processed on this platform is:
- GZ Segurança e Defesa Cibernética LTDA
- CNPJ 40.988.106/0001-60
- ⟦full registered address⟧, Cascavel, Paraná, Brazil
- Privacy contact: privacidade@moatgator.com
When a customer (a company that uses Moatgator to protect its own app) sends us data about its end users through the SDK, that customer is the controller of that data and Moatgator acts as a processor, handling it only under the customer's instructions and the Data Processing Agreement (DPA).
Data Protection Officer
Our Data Protection Officer, under Article 41 of the LGPD, is ⟦name of the DPO⟧ and can be reached at dpo@moatgator.com, and receives requests from data subjects and from the National Data Protection Authority (ANPD).
What data we process
Account data (you, the Moatgator customer): name, email, password (stored only as a hash), organization, role, language and notification preferences, and authentication records (including the second factor). Sign-ins and administrative actions in the console are kept in the organization's audit trail with date, time, IP address and browser, for security and so the organization knows who did what. When you sign in with Google, GitHub or X, we receive the account identifier and the verified email from those providers.
Billing data: legal name, tax ID, address, billing email and invoice history. Card data is handled directly by the payment processor (Stripe) and never passes through or is stored on our servers.
Security telemetry (end-user data of our customers): when a customer's app sends an event (for example, "rooted device" or "instrumentation framework detected"), we receive a pseudonymized device identifier (a hash that rotates periodically, never the raw identifier), the event type and the technical signals behind it, and the OS, app and SDK versions. We do not collect name, phone, email, contacts, precise location, screen content or the customer app's data. The device's IP address is not stored: it is removed at ingestion, before the event is processed.
Site and console usage: pages visited, interface actions and technical browser information, used to run and improve the service and for security.
Public Scan data: when you upload an APK, AAB or IPA for the free analysis, we process the package to produce the report and delete it as described under retention.
AI investigation (optional): if your organization turns it on, aggregated or pseudonymized excerpts of telemetry (no device hash, IP or e-mail) are sent to Anthropic to produce the explanation requested. Questions typed into the documentation assistant also go to Anthropic, without IP or e-mail.
Why we process it and the legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and maintain your account and provide the contracted service | Performance of a contract (Art. 7, V) |
| Billing, invoicing and fraud prevention | Performance of a contract and legal obligation (Art. 7, V and II) |
| Process security telemetry to protect the customer's app | Performance of the contract with the customer (processor) |
| Send transactional email (verification, security, billing) | Performance of a contract and legitimate interest (Art. 7, V and IX) |
| Send security alerts and reports you can turn off | Legitimate interest, with opt-out (Art. 7, IX) |
| Improve and secure the platform | Legitimate interest (Art. 7, IX) |
| Comply with legal obligations and exercise rights in proceedings | Legal obligation and regular exercise of rights (Art. 7, II and VI) |
| Marketing communications | Consent, revocable at any time (Art. 7, I) |
Where we rely on legitimate interest, we balance it against your rights and limit processing to what is necessary. You can object to this processing through the channels below.
Sharing and processors
We do not sell personal data. We share data only with processors that help us run the service, under contract and confidentiality, and only as needed:
- Railway — hosting, database and file storage (US).
- Resend — transactional email (US).
- Amazon Web Services (Route 53) — DNS, no customer data.
- GitHub — sign-in with GitHub and the GitHub App (when you connect it).
- Google — sign-in with Google (when you choose it) and Play Integrity verification (when the customer configures Android Attest).
- Stripe — payments and billing (once billing is live).
- Anthropic — AI investigation and the documentation assistant (when turned on).
The full list, with purpose, data and country, is at Subprocessors. We give customers at least 30 days' notice before adding or replacing a processor that handles end-user data, as set out in the DPA. We may also disclose data when required by law, court order or a competent authority, and to protect rights, safety and the integrity of the platform.
International transfer
Today all platform data is processed in the United States (Railway, California), including data of organizations that picked another region at sign-up: separate infrastructure per region does not exist yet. Since the US has no adequacy decision from the ANPD, transfers use the ANPD standard contractual clauses (Resolution CD/ANPD No. 19/2024), under Art. 33, II, "b", of the LGPD. Details are in the DPA and the Subprocessors list.
How long we keep it
- Account data: while the account exists and for the period required afterward to meet legal obligations.
- Security telemetry: for the retention period of the customer's plan (7 to 365 days), after which events are deleted automatically.
- Console audit trail: for the period of the organization's plan (30 days on the free plan, up to 5 years on Enterprise).
- Server technical logs: a few days, per the hosting provider's retention.
- Billing and tax data: for the periods required by Brazilian tax law.
- Public Scan: the uploaded package and the report expire within 24 hours.
After these periods, data is deleted or anonymized, except where retention is permitted or required by law.
Your rights
Under Article 18 of the LGPD, at any time and free of charge you may: confirm the existence of processing and access your data; correct incomplete, inaccurate or outdated data; request anonymization, blocking or deletion of unnecessary data or data processed unlawfully; request data portability; request deletion of data processed under consent; learn with whom we share data; be informed about not consenting and its consequences; and revoke consent.
To exercise these rights, write to privacidade@moatgator.com. Some rights you exercise yourself in the console (export and deletion of your organization's data under Settings). If you are an end user of an app protected by Moatgator, direct your request to the app's developer (the controller); we support them as a processor. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).
Security
We apply technical and administrative measures to protect data, including encryption in transit and at rest, encryption of sensitive fields, role-based access, two-factor authentication for staff, a hash-chained audit trail and data minimization (device-identifier pseudonymization and not storing IPs in telemetry). No system is fully immune; we keep incident-response processes and, where applicable, notify data subjects and the ANPD as required by the LGPD. To report a vulnerability, see our disclosure policy.
Cookies
We use strictly necessary cookies for authentication and security (such as the console session cookie) and optional preference cookies (language and theme). We do not use third-party advertising cookies. See our Cookie Policy at moatgator.com/cookies.
Children
The platform is intended for companies and professionals. We do not target the services at children or knowingly collect data from minors.
Changes
We may update this Notice. When a change is material, we will notify you through the usual channels (by email or in the console) before the new version takes effect. The last-updated date is at the top of this page.
Contact
Privacy questions: privacidade@moatgator.com or the contact form. DPO: ⟦name of the DPO⟧, dpo@moatgator.com. GZ Segurança e Defesa Cibernética LTDA, ⟦full registered address⟧, Cascavel/PR, Brazil.