Controller: DualState Security Systems — responsible for the DualState Enveloper, DualState Reader and PrivacyPDF Studio apps and for the relay services described below.
Data Protection Officer (DPO, art. 41 of the LGPD): contact us through the official e-mail below. In the subject line write “DPO/LGPD” and describe your request (confirmation, access, correction, deletion, etc.). We reply within 15 days (art. 19, II).
Official e-mail (support + DPO/LGPD): dualstate@outlook.com.br
Official portal: https://dualstate.com.br
Complaints to the authority: you may also file a petition with the ANPD (Brazilian National Data Protection Authority).
Important: the apps are designed so that the content of your files (text, images, document encryption keys) stays on your device and under your custody. We do not sell personal data, show ads, or use advertising trackers in the executables.
Roles (arts. 5, VI–VII): when a document contains third-party data (clients, patients, counterparties), you are the controller of that content and must have your own legal basis to process it. Our apps act as a tool/processor: they help protect and transport, but they neither transfer nor eliminate your LGPD obligations over the content.
| Category | Purpose | Legal basis (LGPD) | Retention |
|---|---|---|---|
| Microsoft account / Entra ID (account identifier, e-mail when displayed) — Online/Store edition | Authenticate you to the relay and bind grants to the Studio owner | Contract performance (art. 7, V) — providing the contracted service | Session on the device until you sign out; on the relay, the identifier accompanies the audit records below |
DualState ECOSYSTEM relay (RAM-only): pairing room INVITE_*, presence announcements and handshake — volatile memory only |
Enable real-time remote release | Contract performance (art. 7, V) | No persistence: discarded from RAM when the room closes/expires (single use, ~48h). Nothing on disk or database. Recipient activity (opens, capture attempts, prints, extractions: blindId, event, document and time only) stays in a RAM buffer up to 48h, visible to the document owner — and the Reader tells the recipient on screen. |
SISTEMA_1 relay (Azure, blind metadata): docId, blindId, vaultHash, validUntil, studioId, blocks, invites (code, validity, uses), Studio ownership, blind audit (docId, blindId, event, timestamp, actor), subscription (firstSeen of the trial) |
Grant/revoke access, prevent fraud and over-plan use, audit access, bill the subscription | Contract performance (art. 7, V) and legitimate interest in security and fraud prevention (art. 7, IX) | Grants until validUntil or revocation; invites until validity/use; audit for the operational period and then deletion; subscription until cancellation + legal periods. No document content and no keys — only opaque metadata |
| Store subscription (plan SKU, trial/active/expired status — processed by Microsoft) | Unlock plan features (30-day trial, monthly, annual) and reader limits | Contract performance (art. 7, V) | While the subscription is in force + legal/tax periods; payment is processed by the Microsoft Store |
| Offline license (holder informed by you, HWID when used, validity) — sideload edition | Activate the lifetime/trial edition without internet | Contract performance (art. 7, V) | On your device; local signature validation, no sending to servers |
| On-device data (paired contacts, DPAPI-sealed keys, cached tickets, session JWT) | Make the app work offline and protect the vault with Windows Hello | Contract performance (art. 7, V); consent when pairing contacts (art. 7, I) | Until you delete in the app/uninstall; keys are lost on OS profile change (DPAPI behavior) |
| Support messages you send us | Provide and improve support | Legitimate interest (art. 7, IX) / consent (art. 7, I) | As long as needed for support + legal periods |
What NEVER travels on the relay: document keys, private keys, original or public texts, token maps. The relay only receives the opaque metadata above.
You may request: confirmation and access; correction; anonymization, blocking or deletion of excessive data; portability; deletion after consent; information about sharing; revocation of consent; objection; review of automated decisions.
The apps are not directed at children. If a document contains minors’ data, the controller of that content must observe art. 14 (parental consent / best interest) — the tool does not replace that obligation.
We keep data only as long as needed for the purposes above and legal obligations (tax, consumer, security). Once the purpose ends, we delete or anonymize. On-device caches are erased on sign-out/uninstall; DPAPI keys follow the OS profile lifecycle.
Relevant changes will be announced on the portal and, when applicable, in the app. The date at the top indicates the current version. Portuguese, English and Spanish versions carry the same content (in case of divergence, Portuguese prevails).
For questions, support, security audits or LGPD requests:
Official e-mail (support + DPO/LGPD): dualstate@outlook.com.br
Official portal: https://dualstate.com.br