PISTONIX
Legal document

Privacy Policy

Last updated: October 13, 2026

This Privacy Policy describes how Pistonix ("we", "our") collects, uses and protects the personal data of visitors to pistonix.com.br. It is aligned with Brazil's General Data Protection Law (LGPD, Law 13.709/2018).

1. Who we are

Pistonix is a brand under active development, headquartered in Passo Fundo, RS — Brazil. The official communication channel is contato@pistonix.com.br.

2. Data we collect

We collect only what is strictly required to operate the site and the waitlist:

  • Waitlist: email (required), name and bike model (optional), provided voluntarily through the form at /en/contact. The reservation form also records which ECU model you intend to reserve and a free-text notes field (up to 1000 characters) — write there only what you want kept on record.
  • Automatic technical data: a cryptographic hash of the source IP (SHA-256 + salt) and request timestamp, used only to limit form abuse. The raw IP is never stored.
  • Usage metrics: aggregated, anonymous data collected via two cookie-free tools with no persistent fingerprinting: Cloudflare Web Analytics and Umami (self-hosted analytics on our own server, analytics.servicespomatti.com). Neither stores your IP address nor builds an individual profile.

3. How we use it

  • Send product updates, roadmap and basemap announcements by email.
  • Prioritize waitlist subscribers when pre-orders for the first batch open.
  • Limit form abuse (per-IP-hash rate limiting, dedupe by email).
  • Understand site usage patterns to improve content and UX.

We do not use your data for: targeted advertising, sale to third parties, building commercial profiles or sharing with marketing partners.

4. Legal basis

Waitlist data is processed based on the data subject's consent (LGPD Art. 7º, I), expressed when submitting the form. Technical data and aggregated metrics are processed based on legitimate interest (LGPD Art. 7º, IX) for security and service improvement.

5. With whom we share

We run our own stack. Data is stored on:

  • A self-hosted Postgres database (vps-pomatti) — the server is in the United States, see section 5.1 — operated by Pistonix.
  • Cloudflare as CDN and reverse proxy. Cloudflare may retain access logs per their own policy.
  • Mailu (self-hosted mail server) to deliver signup notifications.
  • Umami (self-hosted analytics on our own server) for aggregated, anonymous usage metrics, with no cookies.

We do not share your email with any marketing third party, external CRM or ad platform.

5.1. International data transfer

The self-hosted server referred to above (vps-pomatti) is physically located in the United States. That means the waitlist data — email, name, bike model, the notes field on the reservation form and the IP hash — is stored outside Brazil, and the LGPD treats this as an international transfer (art. 33).

We state it here because you have the right to know where your data is, and because until 2026-09-20 this page and the product pages said the server was in Brazil. That was wrong, and it was corrected as soon as we verified it. No other fact in this policy changed: we still do not share your email with any ad platform, external CRM or marketing tool, and the server is ours rather than a third party's.

Your rights under section 7 apply in full regardless of where the data sits. If you would rather not have your data stored outside Brazil, ask for deletion by email and it will be done.

6. Retention

Waitlist data is kept while you wish to receive our communications. You can request deletion at any time by email. The IP hash is stored alongside the signup for as long as the signup exists — it is the only signal that lets us recognise a flood of registrations — and is deleted together with the signup when you request deletion.

7. Your rights

Under the LGPD you have the right, at any time, to:

  • Confirm whether we are processing your data.
  • Access the data we hold about you.
  • Correct incomplete, inaccurate or outdated data.
  • Request anonymization, blocking or deletion.
  • Withdraw consent and request removal from the list.
  • Request portability of your data in a structured format.

To exercise any of these rights, email contato@pistonix.com.br with the subject "LGPD — [requested right]". We respond within 15 days.

8. Security

We apply reasonable technical and organizational measures: TLS on all requests, environment-scoped credentials, cryptographic hashing for sensitive data (IP), periodic database backups. No system is 100% secure — in case of an incident affecting your data, we will notify you by email within a reasonable timeframe.

9. Cookies

The site does not use tracking cookies. Cloudflare Web Analytics and Umami do not use cookies. Cookies that may be set by Cloudflare for attack mitigation (e.g. __cf_bm) are essential and do not track browsing behavior.

10. Changes to this policy

We may update this policy as the product evolves. The "Last updated" date at the top of this page always reflects the current version. Material changes will be communicated to waitlist subscribers by email at least 15 days in advance.

11. Data Protection Officer contact

Given the early stage of the project, the single point of contact for privacy matters is the founder. Email: contato@pistonix.com.br.