Skip to content
EditalMD
Companies
EN

Privacy

What EditalMD keeps about the people who use it, for how long, which infrastructure it shares, and how to request access or deletion.

Who processes the data

EditalMD is run by the same house as the other products listed in the footer. Requests about personal data go to contato@editalmd.com and are answered by e-mail.

What this product keeps

  • Without an account, your lists live in a guest: a token issued by the house account, stored here only as a hash (SHA-256). The abuse limit per network stays in memory, without recording the network.
  • Document evaluation: hash of the agent's credential, validity, the premium document granted, requests and basic results; kept for recovery and quota control.
  • Email alerts go to your account's verified email, read from it at each send; the alert does not store the address (older ones keep the one from that time, shown masked).
  • Saved tenders, alerts (terms, CNAE, state, municipalities, procurement types, exclusions, values, channel), watches, deliveries and webhook secrets. The draft of your interests stays in this browser.
  • Count of emails per day per owner, to respect the sending ceiling.
  • Access charges: document, total, USDC address, public transfers and the hash of the lookup token. The browser keeps your token to resume the payment, and a private cookie to reopen the purchased document.
  • The global payment registry keeps what you bought (document, alert or watch, receipt and date); only the account's lists and alerts stay here. The library and the history are private.
  • Guest or account companies: CNPJ, imported registration profile (legal name, status, size, legal nature, municipality, capital and CNAE codes) and the selected company. This record does not include partners, CPF or contacts.
  • PDF supporting documents sent for the company and private results of the participation analysis, including evidence excerpts, reasons and suggested actions. These documents may contain the personal data you send.
  • Account: e-mail, password, passkeys, sign-in codes and sessions are kept by the account system shared by our products, in its own database — this product keeps only the account id next to what is yours. Without an account, a signed guest token stored in your browser owns what you create; signing in moves it to your account.
  • Pay-per-call payments (x402) settle on the Base network, which is public by design; here we keep the transaction reference and the amount for reconciliation and accounting.
  • Prepaid credit: the token is stored only as a SHA-256 hash with its balance and movements; whoever holds the token holds the credit, and it cannot be recovered by e-mail.
  • Contact: your message, the e-mail you give and the reply go through Amazon SES to the product mailbox.

For how long

  • Imported companies, the selection and documents stay tied to this browser's guest until you link an account. Removing a company in Companies does not change Receita Federal's public database.
  • You can remove the attachments in Companies; that deletes the original and its revision and invalidates earlier analyses. Checkpoints and records of calls already made stay private for processing integrity. Removing only the company link does not delete these files.
  • Saved tenders can be removed at any time. Alerts, watches and deliveries stay until deleted by their operations. The access code lets you resume this data in another browser.
  • Documents extracted from PNCP stay in the catalog. Each buyer pays for their own access, even when it is ready; five examples are free and the pilot offers temporary individual grants per agent.
  • Charges and address indexes are kept so that addresses are not reused and to allow reconciliation; blockchain transfers are public and permanent.
  • The purchase record is durable to allow recovery through the account; it does not expire with the session.
  • Sign-in codes expire within minutes; the account session ends when you sign out or when it expires.
  • Per-network rate-limit counters (guest, contact, sign-in code) expire on their own within minutes or hours.
  • Payment and credit records stay as long as accounting requires.

Infrastructure and third parties

  • Servers we operate run the service and store your data. Cloudflare provides DNS only.
  • Amazon Web Services (SES) sends transactional e-mail on behalf of the product.
  • Interface libraries (Bootstrap) are served from the product's own domain, not from a third-party CDN.
  • Google Analytics 4 measures pages and events only after the first interaction (tap, click or key), with ad storage denied and no sale or sharing for advertising.
  • PayAI (x402 facilitator) verifies and settles payments on the Base network; the paying wallet is yours, and its address is public on-chain.
  • Credits for the public acts: the National Public Procurement Portal (PNCP) and the issuing bodies. Documents keep their reference, date and hash for checking.
  • When you request a participation analysis, your attachments and the necessary evidence may be sent to the AI providers Mistral and OpenAI for reading and analysis. We ask OpenAI not to store the response (store=false). There is no external legal research in this version.

Cookies and browser storage

  • When you sign in, the account session lives in an HttpOnly cookie on this domain; without an account, the guest token stays in your browser and identifies what you created.
  • Screen preferences (theme, filters) stay in the browser's local storage and never leave it.
  • There is no advertising cookie and no cross-site tracking.

IP address

To limit abuse, the IP address goes into a hash with a secret salt. The approximate country and city come from a geolocation database (MaxMind GeoLite2) looked up on our server, without sending the address to anyone. The raw IP is not stored, except where this page says otherwise.

Your rights

You can request access, correction or deletion of what exists about you by writing to contato@editalmd.com. We answer within the terms of the Brazilian data protection law (LGPD) and, where it applies, the GDPR. Data from public sources (official registries) stays at the source; only the copy here is removed.

Last updated: September 21, 2026.