Privacy Policy

Viadocs acts exclusively as a data processor. The B2B customer (e.g., law firm, accounting firm, real estate agency) is the sole Data Controller who determines which documents are collected and for what purpose.

We have no access to the decision-making about what information is requested or how that data will be used by the controller. Our role is strictly technical: providing the secure infrastructure for document collection and direct transfer.

Documents uploaded by users are immediately and directly streamed to the B2B customer's designated Google Drive. Viadocs does not store persistent copies of documents on its servers.

No files remain cached on our infrastructure after upload completion. Files transit in encrypted form directly from the user's browser to Google's APIs, without intermediate storage on our systems.

The maximum temporary retention period during the upload process is a few seconds, strictly necessary for secure transmission.

Viadocs acts as a secure conduit. We hold zero civil or criminal liability for downstream storage, distribution, security practices, leaks, or management of documents once they are delivered to the B2B customer's Google Drive.

Once a file is successfully delivered to the designated folder in the Data Controller's Google Drive, all responsibility for subsequent processing falls exclusively on the B2B customer (Data Controller).

We recommend that all our B2B customers maintain their own clear privacy policies and terms of use for their end users.

All files are encrypted in transit using industry-standard TLS protocols during direct transfer from the browser to Google's APIs.

Customer portal authentication is protected by a 4-digit password based on the first digits of the CPF, ensuring only the authorized recipient can access the requested documents.

We do not use third-party tracking cookies. The only cookie used is an HTTP-Only, secure, temporary (24-hour) session cookie to maintain authenticated access after PIN validation.

We do not sell, share, or transfer personal data to third parties, except as strictly necessary for performing the direct transfer service authorized by the Data Controller.