Privacy policy
Updated 5 October 2026
What we collect, why, and what you can demand of us about it. It covers the pubdesk.app site and the system delivered to publishers.
1Who is responsible for the data
The controller is Pubdesk (Sound Riffs Produção Ltda.), CNPJ 59.653.769/0001-51, Belo Horizonte, MG, Brazil. To exercise any right described here, or to reach the data protection officer: [email protected].
2This site uses no cookies and no trackers
No cookie, no pixel, no behaviour analytics, nothing stored in your browser. That is why there is no cookie banner: there is nothing to accept.
The server keeps a technical, temporary record of the network address of requests — that is what keeps the site up and blocks abuse. It is not used to profile anyone.
3What we collect when you ask for a trial
What you type into the form: name, publishing company, email, phone and, if you want, a message.
What arrives with the request: the language you read the site in, the approximate country (inferred from the connection) and the page you came from.
If you tick the news box, we also keep the date and the exact text you read when ticking it — so we can show what was agreed to, and on what terms.
4What we use it for
To deliver the trial you asked for and to talk to you about it. That is the purpose of the form, and it says so.
To send product news — only if you ticked the box. They are deliberately separate: the email with your access still arrives without the news consent, because it is the answer to what you asked for.
To bill you and meet tax obligations, once you become a customer.
5Leaving the news list
Every news email carries a leave link in the footer that works in one click and without logging in. Leaving is permanent and does not depend on us replying.
Leaving the news does not stop service emails — access to your environment, the end-of-trial notice, billing. For those, the way out is closing the account.
6The data a publisher uploads
Statements, works, writers and contracts stay in that publisher's own storage, separate from every other one. We do not use that content for anything beyond providing the service: we do not cross data between customers, we do not train anything on it and we do not sell any of it.
When a publisher registers a songwriter, it passes us that person's data. There the publisher is the controller and we act on its instructions — including to delete, when it asks.
The songwriter reaches their portal through a personal signed link, valid only for their own publisher's environment.
7Who we share with
Nobody, for marketing. We never sell, rent or hand over personal data.
To operate we use suppliers that process data on our behalf, by category: cloud hosting and storage; email delivery; payment processing; and an artificial intelligence service that answers questions inside the system. All under contract, and only with what the task requires.
The named list of suppliers and the countries they operate in is available to anyone who asks at [email protected].
Some of those services operate outside Brazil, which makes this an international transfer. It happens with the safeguards the Brazilian data protection law requires.
8How long we keep it
Trial request not taken up: 2 years, so we know you have spoken to us before.
Customer data: for as long as the relationship lasts, and 90 days after it ends, for you to export.
Tax and accounting records: for as long as the law requires, even after you leave.
News consent and leave requests: kept while you are on the list, and the record of leaving stays afterwards — it is what stops you being added back by mistake.
9Your rights
You may ask for: confirmation that we process your data, access to it, correction of anything wrong, a copy in a readable format, deletion of whatever we are not obliged to keep, information about who we share it with, and withdrawal of consent.
Write to [email protected]. We answer within 15 days. We do not charge for it and we do not ask why.
10Security
Passwords are never stored as text. Administrative access is restricted and logged. Each publisher's environment has its own storage, and a credential for one does not open another.
If an incident happens that could put you at risk, we tell you and the authority, as the law requires — and we say what happened, not a softened version.