Privacy Policy – migram.app

Qualymax Software takes your privacy seriously. This policy explains, plainly, what data we process, why we process it and what your rights are, under the LGPD (Brazilian General Data Protection Law, Law No. 13,709/2018). This English version is a translation provided for convenience. If there is any conflict, the Portuguese version prevails.

01Who we are

Qualymax Software develops software and apps and is the controller of the data processed in the services covered by this policy:

this site, migram.app, the Migram product site;
the Migram plugin for WordPress and its related services (Migram PRO and Migram Cloud).

Qualymax Software’s other products (Qualymax, Conota and Keepet) have their own terms and policies.

02Data collected on this site

This site presents Migram and contains the Migram PRO subscription form; the data requested in that form is described in the “Migram PRO subscription” section below. The site has no user registration and no login area, and it does not use audience analytics, advertising or tracking tools. It is built on WordPress and hosted by Hostinger.

Technical access logs: like any web server, the host automatically logs data such as IP address, date and time, browser and page visited. These logs are used only for security, abuse prevention and operation of the site, and are kept for the period required by the Marco Civil da Internet (Brazilian Civil Rights Framework for the Internet, Law No. 12,965/2014).
Contact by e-mail: if you write to us, we will use your name, e-mail address and the content of your message only to reply to you.

03Migram plugin for WordPress

Migram is a WordPress plugin that creates backups of the site where it is installed and can store them in the Google Drive of the Google account the site administrator chooses to connect or, on PRO Cloud plans, in Migram Cloud.

IN SHORT

Migram accesses only the files it creates itself in Google Drive.
This access exists only to store the site’s own backups.
This data is not sold or shared with anyone.

What Google data Migram accesses

When Google Drive is connected, Migram requests only the https://www.googleapis.com/auth/drive.file permission. With this permission, the plugin can see and manage only the files and folders it has created. Migram does not read, list, change or delete any other file in your Google Drive, and does not access e-mails, contacts, calendar or any other data in your Google account.

What this data is used for

Exclusively to upload, list, restore and remove the backups of the WordPress site where the plugin is installed. The data is not used for advertising, profiling, behavioral analysis or to train artificial intelligence models.

Sharing

Data obtained through Google APIs is not sold, rented or shared with third parties. It travels only between the WordPress site where the plugin is installed and the Google Drive of the connected account.

Storage and deletion

Backups are kept in the Google Drive of the connected account, under the control of that account’s owner.
The authorization credentials granted by Google are stored on the WordPress site where the plugin is installed and serve only to keep the connection with Drive.
You can revoke access at any time by disconnecting Google Drive in Migram’s settings or at myaccount.google.com/permissions. To delete the backups, simply delete the files created by Migram in your Google Drive.

Google API Services User Data Policy

Migram’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Migram Cloud (PRO Cloud plans)

On PRO Cloud plans, the site’s backups are stored by Qualymax in Cloudflare R2, in data centers in the United States (international transfer, article 33 of the LGPD). Since backups contain the site’s database, they may include personal data of third parties. For that data, the site owner is the controller and Qualymax is the processor, under the data processing agreement in the Migram Terms of Use.

With each backup we store only the file name, size, date and the site’s domain.
The content of the backups is not opened or used for any other purpose.
Backups are deleted when the administrator deletes them or 30 days after the subscription ends.

Usage data and error reports (optional)

If the site administrator allows it (the default is not to send), the plugin sends anonymous usage data to help improve Migram: a random site identifier, the domain, the WordPress, PHP and Migram versions, the language and, for each backup or import, the type, result, size and duration. Site content, user data or file names are never sent. Permission can be withdrawn at any time in Migram → License.

When an error occurs, the administrator can choose to send an error report; before sending, the plugin shows exactly the text that will be sent (the error message and technical information about the server).

04Migram PRO subscription

To subscribe to Migram PRO at migram.app/en/pro-plan, we ask for a registration with:

name (or company name), e-mail and WhatsApp;
for customers in Brazil, CPF or CNPJ (Brazilian individual or company taxpayer number) and address (the postal code, CEP, is looked up in the public ViaCEP service to fill in the address and the municipality code);
for customers in other countries, the country.

What we use it for

processing the payment and sending the license key;
issuing the service invoice (nota fiscal) (customers in Brazil), a legal obligation;
providing support and notices about the subscription (renewal, payment failures);
sending news about Migram and Qualymax only if you tick that option when registering; you can unsubscribe whenever you want.

Card details are entered directly in Stripe, which processes the payment; Qualymax has no access to the card number. If a partner referred you to Migram, the partner’s code (for example, ?ref=PARTNER) is linked to the subscription to calculate the commission.

How long we keep it

Subscribers’ data is kept while the subscription exists and, afterwards, for the period required by tax law (as a rule, 5 years). Registrations started without a completed payment are deleted within 12 months.

06Cookies

This site uses only one functional cookie, pll_language, which remembers the chosen language to show the pages in that language. It does not use analytics, advertising or tracking cookies. For this reason, we do not show a cookie consent banner.

When you arrive through a partner’s referral link, the site stores in your browser (localStorage), for up to 30 days, only that partner’s code (migram_ref). This data does not identify you and is deleted when the subscription is completed.

07Security and retention

We adopt technical and organizational measures to protect data, such as encrypted connections (HTTPS) and restricted access to information. Data is kept only for as long as needed to fulfill the purposes described in this policy or legal obligations, and is then deleted or anonymized.

08Your rights

Under article 18 of the LGPD, you can request at any time:

confirmation that processing takes place and access to your data;
correction of incomplete, inaccurate or outdated data;
anonymization, blocking or deletion of unnecessary or excessive data;
data portability;
information about whom the data has been shared with;
deletion of the data and withdrawal of consent, where applicable.

To exercise your rights, write to [email protected]. You can also file a complaint with the ANPD (Brazilian National Data Protection Authority).

09Changes to this policy

This policy may be updated to reflect changes in our services or in the law. The date of the last update is always shown at the top of this page.

10Contact

Questions about this policy or about the processing of your data:

[email protected]

Privacy Policy.