Last updated: September 24, 2026.

Privacy Policy.

Convex Robótica values transparency in how we handle data. This page describes how we collect, use and protect your information.

In this policy

Privacy at a glance

You control your data

Request access, correction or deletion through the privacy contact.

Login without sharing passwords

Google, Microsoft and Facebook authenticate you through Supabase Auth.

No advertising tracking

The current implementation contains no Meta Pixel or Conversions API.

Technical flow confirmed in the current implementation.

1
Choose a provider
You select Google, Microsoft or Facebook in the Client Area.
2
External authorization
The provider presents its own authentication and permission screen.
3
Supabase Auth
Supabase receives the authorized response and creates or links the identity.
4
Convex profile
Convex stores email and name when those data are provided.

Social login by provider

Convex starts the flow; authentication occurs with the provider and returns to Supabase Auth.

Provider	Scope defined by the project	Data that may be returned	Revocation
Google	No additional scope in code	Identifier, name and email, when made available and authorized	Google Account settings
Microsoft / Azure	email	Identifier and email; other metadata only when made available and authorized	Microsoft account permissions
Facebook	No additional scope in code	Identifier, name and email, when made available and authorized	Apps and Websites in Facebook settings

Scope and data controller

This policy covers the public website, Client Area and connected Convex features. Convex Robótica determines the purposes described here and acts as controller for account, request and product data. The code does not identify a named data protection officer, company registration number or publishable address, so none is assumed. Privacy questions and requests may be sent to fw@convex-robotica.com with enough information to locate the account, without passwords or unnecessary documents.

Categories of data

Depending on the feature, Convex may process name, email, phone or WhatsApp, company, registration and address details, account identifiers, preferences, requests, messages, files, billing data and operational records. Territorial products may include area names, geometries, hectares, crops, dates, observations, photographs and analysis results. Collection follows the action performed: visiting a page does not produce the same data set as creating an account, registering an area, using AI or purchasing a service.

How data is obtained

Data comes from forms, uploaded files and images, Client Area actions, authorized identity provider responses and results generated by requested services. Technical records are also created for sessions, security, usage limits, task execution and error diagnosis. External integrations may return authenticated identity, searched location, weather, satellite statistics or AI output. Convex uses each response in the context of the feature that requested it.

Purposes and legal grounds

Data supports authentication, profiles, contacts, service delivery, support, payments, reports, maps, analysis and application protection. Depending on context, processing may rely on contract performance or requested steps, legal obligations, exercise of rights, a properly assessed legitimate interest or consent when required. The repository does not record the legal assessment for every purpose; Convex must confirm the appropriate LGPD basis for each concrete operation.

Account, Supabase Auth and Convex profile

Authentication is handled by Supabase Auth, which maintains identity, session and metadata returned by the selected method. Email and name may populate the Convex profile, together with phone, company and address later supplied by the user. Social account passwords remain with Google, Microsoft or Facebook. Product records are linked to an internal user identifier so authorization rules can separate accounts.

Google login

Google login starts Supabase signInWithOAuth without additional scopes declared in code. Google presents its own screen and determines available information according to account, application configuration and authorization. The response may include identifier, name and email. Convex receives the authorized result through Supabase, never the Google password. Revoking the app in Google Account settings stops future authorization but does not automatically delete Convex records.

Microsoft/Azure login

Microsoft login uses the Supabase Azure provider and explicitly requests the email scope. Microsoft authenticates the person and may return an identifier, email and other authorized metadata. The project does not request mailbox, calendar or file access in code. Convex never receives the Microsoft password. Removing Microsoft permission stops future authorization, while deletion of existing Convex data requires a separate privacy request.

Facebook login

Facebook login uses Supabase signInWithOAuth with no extra scopes declared in code. Meta conducts authentication and displays permissions. The response may include identifier, name and email when available and authorized. No Meta Pixel, Conversions API or behavioral advertising use was found. Removing Convex under Facebook Apps and Websites prevents new access but does not erase information already linked to the Convex account.

Forms, contacts and requests

Public and authenticated forms may receive identity, contact, company, need description, service type, dates, estimated budget and other visible fields. Convex uses them to respond, organize service, prepare proposals, track status and retain request history. Users should avoid unnecessary sensitive data. Anyone submitting information about another person or property should have authority to provide it.

Nexa M1 and AI features

Nexa M1 sends the user's text and, when requested, available account or area operational context directly from the server to the DeepSeek API to generate the answer. That context may include property or monitored-area data, analyses, indices, reports, alerts and weather when available and relevant to the request. The system also stores the complete prompt and usage metadata in usage_records.input_metadata. DeepSeek retention, processing region, training use and human review are not established by the code, so this policy makes no promise about them.

Nexa Vision and satellite analysis

Nexa Vision processes area geometry, period, interval, declared crop and spectral statistics through Sentinel Hub/Copernicus. Text generation sends DeepSeek the hectares, period, optional crop and calculated index series to produce a technical report. Results, image paths, layers and reports may be stored in Supabase for authenticated history. External retention, training use and human review by DeepSeek are not confirmed in the repository.

Niros, areas and field observations

Niros shares the account and backend used by the Client Area. Confirmed features link users to monitored areas and can record field observations, category, severity, status, coordinates and submitted photographs. These support operational tracking and area history. Photos and descriptions may expose people, equipment or location, so only necessary and authorized content should be sent. Continuous location collection or permanent device access is not asserted because the reviewed implementation does not prove it.

Maps, addresses and location

Map and address features may use Mapbox and Google Places. Search text, coordinates, geometry and request technical information can reach the relevant provider to locate, draw or display an area. Convex stores geometries and registration details required by the product. These integrations do not by themselves mean continuous tracking. Provider terms, processing regions and retention are governed by their own policies.

Billing, subscriptions and payments

When services are purchased, Convex keeps subscription status, billing references, payments and reconciliation events. Confirmed integrations include Asaas and Stripe in specific flows. Transaction data reaches the selected processor; full card numbers should be handled by its secure interface, not free text. Tax, fraud prevention and dispute duties may require records, but the code does not define one publishable retention period.

Supabase, storage and files

Supabase provides authentication, database controls and file storage. Profiles, areas, analyses, requests, observations, subscriptions and report references may be held there. Private files can use time-limited signed URLs, and database policies seek to restrict records to authorized users. Production region, subprocessors and transfer safeguards depend on Convex configuration and contracts and cannot be verified from the repository alone.

Other providers and communications

The code also contains integrations for weather data, WhatsApp communications and Lovable hosting. A provider receives data only when the corresponding configured feature is invoked, such as a destination and message or coordinates for a forecast. Code presence does not prove every integration is active in production. Convex should maintain its contractual processor inventory and provide specific information on request.

Cookies, sessions and local storage

The application uses technical storage for authentication and preferences. Supabase may persist the browser session; a manual language choice is stored in localStorage and a cookie, and authenticated components may keep sidebar state in a cookie. Code defines durations for those preferences, while session duration depends on authentication configuration. No Meta Pixel, Conversions API or first-party behavioral advertising cookies were found. Blocking technical storage may prevent login or saved preferences.

Technical data, security and abuse prevention

Requests create technical data needed for internet operation, such as time, headers, network address available to the server, route and error details. Chat applies size validation, origin checks, rate limits and concurrency controls; protected routes require authentication and authorization. These records support account protection, troubleshooting and abuse prevention. The code does not prove all technical data is anonymous or define a uniform log retention period.

Sharing and international transfers

Convex does not state that it sells or rents personal data. Information may reach operators needed for authentication, hosting, database, payments, maps, messages, satellite and AI, or authorities under a valid duty. Some providers operate internationally, so processing outside Brazil may occur according to contracted configuration. Regions, clauses and transfer mechanisms are not visible in the repository and require Convex confirmation.

Retention, deletion and anonymization

There is no single retention period or general self-service account deletion button in the code. Data remains while needed for the account, service, requested history, security or applicable duties, with different cycles by category. Request deletion at fw@convex-robotica.com from the registered email. Convex must verify identity, assess records that must remain and communicate the outcome. Revoking social login does not perform this process.

LGPD data subject rights

Under the LGPD, data subjects may request processing confirmation, access, correction, anonymization, blocking or deletion where applicable, regulated portability, sharing information and review of relevant automated decisions. Consent questions and revocation may also apply. Send requests to fw@convex-robotica.com. Convex may request proportionate identity evidence to prevent unauthorized disclosure or alteration.

Security, links, changes and contact

The application uses HTTPS, authentication, authorization, input validation and access segregation, but no system is risk free. Users should protect devices and accounts and report concerns. External links follow their own policies. This notice may change with products, providers or law, and the displayed update date identifies the current version. Send privacy, access, correction, objection or deletion requests to fw@convex-robotica.com without passwords, tokens or credentials.

Frequently asked questions

Does Convex receive my social password?

No. Your password remains with Google, Microsoft or Facebook.

Does revoking the app delete my account?

No. Revocation prevents new authorizations, but deletion of data held by Convex must be requested by email.

How do I request deletion?

Email fw@convex-robotica.com and identify the email used for registration.

Is there advertising tracking?

The current code does not implement Meta Pixel, Conversions API or behavioral advertising cookies.