Privacy Policy

This Privacy Policy (“Policy”) describes how Sireeus Softworks (“Sireeus”, “we”, or the “Controller”) processes personal data related to Kerry Studio and the associated channels: the desktop app, the site kerry.studio, and the online services used for licensing, download, and updates.

It applies to users, subscribers, customers, prospective customers, and others who interact with those channels, to the extent their personal data is processed.

The official language is Brazilian Portuguese. This English text is a courtesy translation; if the versions differ, the Portuguese version controls.

This Policy does not replace the Subscription Terms, the License to use, or the Cancellation and Refunds Policy. It should be read together with those documents.

The Controller’s legal name is Sireeus Softworks Ltda, registered in Brazil under CNPJ 68.882.332/0001-80, with registered office at Rua Thereza Scanavez Lamberti, 280, CXPST 109, Sala 567, Parque da Barra I, São Joaquim da Barra, SP, Brazil, ZIP 14.606-366. The trade name is Sireeus.

1. Who the Controller is

1.1. The party responsible for personal-data processing carried out by Sireeus in its own activities is:

Sireeus Softworks Ltda
Trade name: Sireeus
CNPJ (Brazilian tax ID): 68.882.332/0001-80
Registered office: Rua Thereza Scanavez Lamberti, 280, CXPST 109, Sala 567, Parque da Barra I, São Joaquim da Barra, SP, Brazil, ZIP 14.606-366
Product: Kerry Studio (desktop software)
Product site: https://kerry.studio
Company site: https://sireeus.com
General email: contact@sireeus.com
Support email: support@sireeus.com
Privacy and data-subject rights: contact@sireeus.com

1.2. For processing Sireeus carries out itself, the company acts as Controller.

1.3. Certain vendors process data on behalf of Sireeus (processors) or for their own activities (independent controllers), depending on the service. The main ones are the legal seller (merchant of record, not a payment gateway or Sireeus’s payment provider) of the relevant subscription and Cloudflare (infrastructure). The identity of the legal seller is the one shown at checkout and in the commercial documents of that subscription.

1.4. Kerry Studio is the product name, not the legal entity.

2. What Kerry Studio is

2.1. Kerry Studio is a cross-platform desktop application for administering, querying, and operating databases.

2.2. It runs on the user’s computer.

2.3. As a rule, Sireeus does not host or store on its own servers the databases, files, queries, scripts, or other content the user works with in the app.

2.4. Using the Software to access a database does not mean that database’s content is transmitted to or stored by Sireeus.

2.5. This Policy covers personal data actually processed by Sireeus and certain vendors in operating the Software and the digital channels — not, as a rule, data that lives in databases the user administers locally.

2.6. Three surfaces do not process the same data:

2.7. Sireeus is not the controller of processing by: (i) the legal seller of that subscription, to the extent it acts as legal seller (merchant of record); (ii) Cloudflare, to the extent it runs infrastructure under its own policy; (iii) the AI client on the user’s computer, if the user turns on the local assistant integration — that client may send to its own model data the user exposes; that traffic does not go through Sireeus servers.

3. What personal data is processed

Sireeus follows data minimization and processes only what this Policy requires. In current operation, the following may be processed:

3.1. Email. The address tied to the legal seller’s account / license may be used to identify the subscription; bind the license to the customer; authenticate and validate; communicate about the subscription; provide support; send information needed for the Software to work; meet a legal duty; prevent and investigate fraud and unauthorized use.

Sireeus does not currently run a marketing list or a newsletter form on the site. If promotional messages are ever sent, they will follow applicable law and this Policy will be updated.

3.2. Device identifier (Machine ID). The app reads a technical device identifier to bind and validate the license to the authorized computer.

It may be used for technical identification of the licensed machine; initial and periodic validation; stopping the same license on an unauthorized machine; fraud prevention; licensing security.

3.2.1. The Machine ID is not used to identify the contents of databases the user accesses.

3.2.2. It does not give Sireeus remote access to the computer.

3.2.3. It does not, by itself, allow access to files, databases, or information stored on the device.

3.2.4. Combined with the license key and email, the Machine ID is not anonymous: it identifies that license’s computer. It is not used for advertising.

3.3. License key. Entered by the user in the app and used to validate and update.

3.4. Data obtained from the legal seller on validate. Customer name and email, to the extent the legal seller returns them to Sireeus, to check that the key matches the account.

3.4.1. License-to-use record. Sireeus stores the account identifier held with the legal seller, the License to use version, and the date of the acceptance record. The legal basis is contract performance (LGPD art. 7, V), not consent (art. 7, I). Email, name, and payment remain with the legal seller.

3.5. Site and download data. Language preference in the browser. On installer download, technical data needed for a bot check, file delivery, and abuse prevention, plus aggregate counts of platform and country. The site uses Cloudflare Web Analytics for aggregate usage and performance metrics (visits, page views, country, browser or device type, load times). Cloudflare receives the technical measurement request — the IP address is part of ordinary HTTP traffic — and states that it discards the IP at the point of presence, with no visitor registry. Sireeus only consults aggregate reports, without identifying a person. IP addresses are not kept as a Sireeus metrics registry.

3.6. Update data. Technical data needed to deliver the correct update, and aggregate operational counts, without identifying a person.

3.7. Support communications. Message content and attachments sent voluntarily to the channels in section 27.

3.8. The hosting infrastructure may process ordinary connection metadata. When the site loads, the browser may fetch typefaces from a third party (Google Fonts), which receives that ordinary connection data. Sireeus does not build a browsing profile from that.

4. Data Kerry Studio does not collect in normal operation

4.1. The app was not designed to send the user’s databases to Sireeus. There is no usage telemetry in the app: open screens, queries run, databases connected, and crash reports are not sent.

4.2. Sireeus does not receive, as part of ordinary license validation or updates:

• database contents;
• connection credentials;
• queries and results;
• files, workspaces, and other content the user creates or stores in the app.

4.3. Those items stay on the device, under the user’s control. Sireeus has no copy unless the user sends them to Sireeus (for example in a support request). Exporting to a third party or turning on the local AI assistant integration does not give Sireeus that data: Sireeus does not provide the assistant, and that traffic does not go through its servers.

4.4. Diagnostic Mode. Opt-in, off by default. It may write a record on the user’s computer. It is not sent automatically to Sireeus.

4.5. Automatic upload of crash reports to Sireeus servers is off.

4.6. If a future feature requires additional categories, Sireeus will update this Policy.

5. Subscription and payment (legal seller)

5.1. The Kerry Studio subscription is contracted through a legal seller (merchant of record). The legal seller is not a payment gateway or Sireeus’s payment provider: it is the seller of record of the transaction vis-à-vis the customer. The identity of the legal seller applicable to each subscription is the one shown at checkout, in the transaction confirmation, and in the commercial documents of that contract. Sireeus may use one or more legal sellers, including at the same time. The legal seller commercializes the subscription as a digital service to the customer; Sireeus grants the license to use the Software. The legal seller bears the legal duties of the commercial transaction — including tax, invoicing, and consumer duties, to the extent of applicable law — in each country where it operates as seller of the subscription.

5.2. Data needed for contracting, billing, payment, commercial documents, transaction taxes, subscription management, and refunds may be processed directly by the legal seller, in its role as legal seller and under that seller’s own terms and policy.

5.3. Sireeus does not need to receive or store full card data or other sensitive payment-financial data to validate the license.

5.4. The legal seller provides its own tools for customers to manage the subscription, including viewing the subscription and cancellation, in the customer portal indicated at checkout and in the transaction email. Ordinary cancellation in that portal follows the Cancellation and Refunds Policy. That portal does not deactivate the authorized machine.

5.5. Cancellation, invoice, or payment-method requests go first to the customer portal of the legal seller indicated at checkout and in the transaction email. Refund or withdrawal requests go first to support@sireeus.com. Renewal, cancellation, and refund rules are in the Cancellation and Refunds Policy. Requests about Kerry Studio use and what Sireeus processes: sections 20 and 27.

6. Purposes

Personal data may be processed to:

a) license — confirm the license exists, is authentic, and is in force;
b) machine control — bind the license to the authorized computer;
c) security — prevent fraud, piracy, abuse, and licensing circumvention;
d) updates — deliver and check Software updates;
e) site and download operation — serve pages and the installer, tell bots from humans, limit abuse;
f) aggregate operational statistics — capacity, site usage, and download/update counts, without identifying a person;
g) support — answer technical or commercial requests;
h) communications needed to perform the contract;
i) legal, regulatory, administrative, or judicial duties;
j) regular exercise of rights in judicial, administrative, or arbitral proceedings.

Sireeus does not sell personal data and does not use it for behavioral advertising.

7. Legal bases

Processing may rest, depending on purpose and circumstances, on the bases in Brazil’s Law No. 13.709/2018 (LGPD), including:

• performance of a contract or pre-contractual steps (art. 7, V);
• legal or regulatory duty (art. 7, II);
• regular exercise of rights (art. 7, VI);
• legitimate interest, when it applies and after weighing the data subject’s rights and freedoms (art. 7, IX);
• consent, when the law requires it (art. 7, I);
• other bases the law provides.

7.1. Sireeus does not use consent as a generic fallback when another adequate basis applies. Diagnostic Mode on the device, being opt-in and not uploading on its own, relies on consent as to generating the local record.

8. Legitimate interest

8.1. Where it applies, legitimate interest may support, among other things, security; fraud and piracy prevention; protection against abusive use of the license and of downloads; serving the site and installer; aggregate operational statistics, including site usage; defense of the company’s rights.

8.2. In those cases Sireeus seeks necessity, adequacy, and proportionality, considering data subjects’ legitimate expectations (art. 10). A data subject may submit a request under section 20. They may object to processing based on a waiver of consent if that processing violates the Law (art. 18, §2).

9. License validation

9.1. The Software periodically talks to Sireeus online services for the licensing model.

9.2. The communication may currently include: license key; associated email; Machine ID; technical activation data. It uses a protected connection.

9.3. Validation may occur at activation and periodically while the license is in force, including when the app checks for updates.

9.4. The purpose is to check that the license is valid and is being used under the contracted conditions.

9.5. That communication is not used to access the contents of databases the user administers.

9.6. The app communicates with Sireeus’s online services. Sireeus may consult the legal seller of that contract to confirm that the subscription is in force. The Machine ID and binding to the authorized computer are handled by Sireeus. Deactivation of the authorized machine starts in the app, not in the legal seller’s customer portal.

10. Machine ID and privacy

10.1. The Machine ID is a technical device identifier for per-machine license control.

10.2. Sireeus does not use it to build a behavioral profile, monitor professional activity, or access information stored on the device.

10.3. It is processed only as needed for licensing, security, fraud prevention, and subscription duties.

10.4. Exposure of the identifier is limited to what this Policy’s purposes require.

11. Sharing

Sireeus may share only what is strictly necessary with:

11.1. Legal seller — commercializing the subscription as legal seller (merchant of record), billing, payment, transaction documents and taxes, commercial relationship, refunds; also confirming, when needed, that the subscription is in force. The identity of that holder’s legal seller is the one shown in the relevant contract.

11.2. Cloudflare — infrastructure: hosting, network, file delivery, security, availability, and aggregate site-usage metrics.

11.3. Service providers — technology, security, support, hosting, communications, or other services needed to operate, if engaged, only what the engagement needs.

11.4. Public authorities — when required by law, a court order, or a competent authority.

11.5. Professional advisers — lawyers, accountants, auditors, and others bound by confidentiality, when needed.

11.6. Site typefaces — when pages load, the browser may fetch fonts from Google’s servers (Google Fonts), which receive ordinary connection metadata and process it under Google’s own policy.

There is no sharing for third-party marketing.

12. Legal seller as merchant of record

12.1. In the commercial structure adopted, the subscription is contracted through a legal seller (merchant of record). That seller does not act as a payment gateway or payment provider on Sireeus’s behalf. Sireeus may use one or more legal sellers, including at the same time; each subscription is bound to the legal seller of that contract, identified at checkout and in the commercial documents.

12.2. As seller of record, it processes data directly to contract the subscription, process the transaction, issue commercial documents, meet tax and other legal duties in the countries where it operates as seller, and manage payments and refunds. The legal seller’s commercialization of the subscription is a digital service to the customer; Sireeus remains the grantor of the license to use the Software.

12.3. Certain processing by the legal seller is subject to that seller’s own policy and terms.

12.4. Sireeus does not control every processing the legal seller carries out as legal seller and/or merchant of record.

12.5. Users should also read the privacy documents of the legal seller identified at contracting. The data subject may ask Sireeus with whom the data have been shared (LGPD art. 18, VII).

13. Cloudflare

13.1. Sireeus uses Cloudflare infrastructure and services for the site, online services, and Software distribution.

13.2. Those functions include: serving the site, the installer, and updates; license validation; security; availability; aggregate site usage and performance metrics.

13.3. Data sent to those services is limited to what each purpose needs.

13.4. Sireeus does not use Cloudflare to host the user’s databases in ordinary Kerry Studio operation.

14. International transfers

14.1. Digital vendors may be outside Brazil or use infrastructure in other countries. The site, online services, and Software distribution use Cloudflare infrastructure, which may operate abroad. The legal seller may also process data outside Brazil. Site typefaces may be served from Google servers abroad.

14.2. When an operation is an international transfer under the LGPD, Sireeus will use a legally valid mechanism, following ANPD rules.

14.3. Transfers are limited to data needed for this Policy’s purposes, with adequate safeguards.

14.4. They may rest, as the case requires, on an adequacy decision, standard contractual clauses, binding corporate rules, or another legally admitted ground (LGPD arts. 33 to 36).

14.5. Assessment of relevant transfers sits with Sireeus. This Policy may be updated if vendors or the law change.

15. Retention

15.1. Data is kept for as long as needed for the purposes, subject to legal, regulatory, and contractual duties.

15.2. After the contract ends, certain data may be kept as long as needed for legal, tax, and accounting duties; regular exercise of rights; fraud prevention; security; audit; administrative or judicial orders.

15.3. When no purpose or duty remains, data under Sireeus’s control will be deleted or anonymized, where technically applicable.

15.4. In general terms:

16. Information security

16.1. Sireeus adopts technical and administrative measures that are reasonable and proportionate to the data it actually processes, under LGPD article 46.

16.2. Those include protected communications with Sireeus services, limiting what Sireeus receives, and, in the app, using the operating system’s protected store for credentials when available.

16.3. No system on the internet is absolutely secure.

16.4. The user is responsible for the device, credentials, network, and databases. If the user exports personal data from a database, LGPD compliance for that use is theirs.

17. Security incidents

17.1. If an incident involving personal data may cause relevant risk or harm to data subjects, Sireeus will take the steps required by law and ANPD regulation, especially LGPD article 48, to the extent the incident reaches data Sireeus processes.

17.2. It will assess nature, scope, consequences, and risks to decide the measures.

17.3. When the law requires it, Sireeus will notify the ANPD and affected data subjects.

17.4. An incident only on the user’s disk or database does not automatically go through this channel — that risk sits in the environment the user runs.

18. Data-subject rights

Under the LGPD (art. 18, I to IX) and applicable rules, a data subject may, as the case requires:

• confirmation that processing exists (item I);
• access to the data (item II);
• correction of incomplete, inaccurate, or outdated data (item III);
• anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data (item IV);
• portability, subject to legal requirements and ANPD rules (item V);
• deletion of data processed on the basis of consent, subject to art. 16 (item VI);
• information about public and private entities with which data has been shared (item VII);
• information about the option not to give consent and the consequences of refusal (item VIII);
• withdrawal of consent, under art. 8, §5 (item IX).

A data subject may also object to processing based on a waiver of consent if that processing violates the Law (art. 18, §2), and request review of an automated decision that affects their interests (art. 20).

19. Automated decisions

19.1. License validation is automatic and may accept or refuse the key on that device, based on the information the legal seller returns (art. 20). There is no credit grant and no advertising profile. On request, Sireeus will provide adequate information about the criteria and procedures used, subject to trade and industrial secrets (art. 20, §1).

19.2. If a refusal is wrong, the user should contact support. Sireeus does not take a solely automated decision with a relevant legal effect beyond allowing or denying use of the licensed software.

20. How to exercise rights

20.1. Requests: contact@sireeus.com, with a subject that identifies the request (for example “LGPD — access”).

20.2. To protect data subjects, Sireeus may ask for reasonable information to confirm identity before fulfilling certain requests.

20.3. Requests are free of charge (art. 18, §5). Where possible, action is immediate (art. 18, §§ 3 and 4). Confirmation that processing exists and access, as a complete statement, follow the 15-day period in art. 19, II. Other requests follow the Law and ANPD regulation.

20.4. What lives only on the user’s computer Sireeus cannot access or erase remotely. That right is exercised in the app (delete data, uninstall, turn diagnostics off).

20.5. Subscription, invoices, and cancellation: the legal seller’s portal indicated at contracting first. Refund and withdrawal: support@sireeus.com first; see the Cancellation and Refunds Policy.

20.6. A data subject may also petition Brazil’s ANPD (art. 18, §1) and consumer-protection bodies (art. 18, §8).

21. Children’s data

21.1. Kerry Studio is aimed mainly at professionals, developers, database administrators, and companies.

21.2. The Software and the site are not directed at children or adolescents. Sireeus does not knowingly collect children’s data.

21.3. If it learns of processing incompatible with the applicable rules, it will take appropriate steps, including deleting what is under its control.

22. Cookies and similar technologies

22.1. The Kerry Studio site does not use advertising cookies or social pixels. It uses Cloudflare Web Analytics for aggregate page usage and performance metrics. That product does not use cookies or browser storage to identify the visitor, does not build an advertising profile, and does not follow the data subject across other sites.

22.2. It may store the language preference in the browser, strictly needed for the interface. That value is not sent to Sireeus online services.

22.3. On installer download, a bot check and short-lived mechanisms needed to deliver the file are used. That is not advertising tracking.

22.4. The desktop app uses technical licensing mechanisms (including the Machine ID). They must not be confused with website cookies.

22.5. If the site later uses marketing cookies or an analytics tool that identifies the visitor, this Policy will be updated and, where required, transparency and consent measures will be adopted.

23. Local assistant integration

23.1. The user may, if they choose, turn on a local integration with an AI assistant of their choosing on their own computer. Sireeus does not provide the assistant or the model.

23.2. Data the user exposes to that integration (for example a catalog or query results) may be sent by the user’s AI client to the model’s provider. Sireeus does not receive that data.

23.3. That provider is an independent controller or processor. The user decides whether to turn the integration on.

24. Marketing and communications

24.1. Sireeus may send communications needed to perform the contract, including about the subscription, license, security, updates, material changes, and support.

24.2. Marketing messages, if they are ever sent, will follow applicable law. There is no promotional signup on the Kerry Studio site today. The legal seller may send its own transactional messages about the subscription.

24.3. When it applies, the user may ask Sireeus to stop promotional messages using the email in section 27.

25. Changes to this Policy

25.1. This Policy may be updated to reflect Kerry Studio, new vendors, new features, the law, ANPD guidance, or changes in processing practices.

25.2. Material changes will be communicated by reasonable means when needed — for example a notice on the site or in the app.

25.3. Continued use alone is not tacit acceptance of a new clause that requires consent.

25.4. The current version is on this page. The date at the top is the version in force.

26. Other documents and governing law

26.1. Contracting the subscription is in the Subscription Terms. License, use of the Software, intellectual property, and liability are in the License to use. Cancellation, renewal, and refunds of the subscription are in the Cancellation and Refunds Policy.

26.2. This Policy is interpreted under Brazilian law, especially the LGPD, without prejudice to mandatory foreign rules when they legally apply.

26.3. Applicable ANPD regulations and guidance will also be observed.

27. Contact

Sireeus Softworks Ltda
CNPJ (Brazilian tax ID): 68.882.332/0001-80
Registered office: Rua Thereza Scanavez Lamberti, 280, CXPST 109, Sala 567, Parque da Barra I, São Joaquim da Barra, SP, Brazil, ZIP 14.606-366
Privacy and data-subject rights: contact@sireeus.com
Product support: support@sireeus.com
Subscription, invoice, and cancellation: the customer portal of the legal seller indicated at checkout and in the transaction email. Refund and withdrawal: support@sireeus.com — rules in the Cancellation and Refunds Policy
Data Protection Officer / privacy channel: Sireeus Softworks Ltda — contact@sireeus.com

This Policy takes effect on the date stated at the beginning of the document.