Cookie Policy
Last updated: September 22, 2026
Legal name: Osmir Custodio Mariano Tecnologia da Informação Ltda | CNPJ: 53.636.099/0001-89 | Privacy e-mail: privacidade@vulnera.io This English version is provided for convenience. In case of any discrepancy, the Portuguese version prevails.
Summary in Plain Language
This summary is for informational purposes only and does not replace reading this Cookie Policy in full.
- What cookies are: small files that a site writes to your browser. We also use similar technologies, such as the browser's local storage, which work in a similar way and are given the same treatment here.
- Who manages them: Vulnera manages its own items. Partner companies (Sentry, New Relic, and, only with your authorization, Google) manage the items related to technical monitoring and audience measurement.
- Which ones we use: a single cookie on the site, to remember the language; local storage items on the platform, for login and preferences; and error and performance monitoring tools. Audience measurement and advertising cookies are only recorded if You authorize them.
- Why we use them: to keep You securely connected, remember your language and theme choices, identify technical failures, and, with your authorization, understand how visitors reach Vulnera.
- How to decline: through the cookie preferences panel, available in the footer of the site and the platform, or through your browser's settings. Declining the necessary items may prevent login and the operation of some features.
- Whether there is sharing: yes, with Sentry and New Relic, for technical monitoring, and with Google, only if You consent. These companies are located in the United States of America. There is no sharing with other companies.
- Index of clauses: (1) Effective date; (2) What cookies are; (3) Entity responsible and origin of cookies; (4) Categories of cookies used; (5) How cookies are used; (6) Rejection and deletion; (7) Data sharing; (8) International data transfer; (9) Privacy communication channel; (10) Governing law and forum.
1. Effective Date
This Cookie Policy was made available and takes effect as of 22/09/2026, and may be updated periodically to reflect technological, legal, or operational developments on the Vulnera site and platform. Material changes, particularly the addition of new categories of cookies, will be communicated to the User and, when they depend on consent, will only take effect after the User's manifestation.
2. What Cookies Are
Cookies are small text files recorded on the User's device (computer, tablet, or smartphone) when the User accesses a site, containing information that allows the browser to be recognized or choices to be remembered on subsequent visits. Under the Guia Orientativo sobre Cookies e Proteção de Dados Pessoais (Guidance Guide on Cookies and Personal Data Protection) of the Agência Nacional de Proteção de Dados (National Data Protection Authority, ANPD), cookies may collect personal and browsing data, and are subject to the provisions of Lei nº 13.709/2018 (the Brazilian General Data Protection Law, LGPD) whenever they enable the direct or indirect identification of a natural person.
2.1. Similar technologies. In addition to cookies, Vulnera uses the browser's own storage resources, known as localStorage and sessionStorage, which serve an analogous function. For the purposes of this Policy, the term "cookies" also covers these technologies, individually identified in the tables in Clause 4 and subject to the same rules on transparency, legal bases, and User rights.
2.2. Scope. This Policy applies to the three digital environments operated by Vulnera: the institutional site (vulnera.io), the platform accessed by registered users (app.vulnera.io), and the programming interface that serves the platform (api.vulnera.io), the latter with no cookies recorded. The term "User" covers both the site visitor and the registered platform user.
The User has the right to refuse, block, or delete cookies at any time, through the cookie preferences panel or through their browser's settings, as detailed in Clause 6 of this Policy.
3. Entity Responsible and Origin of Cookies
The cookies used by Vulnera are classified, as to their origin, into first-party cookies and third-party cookies. The party responsible for processing any personal data collected is Osmir Custodio Mariano Tecnologia da Informação Ltda, the holder of the Vulnera brand.
3.1. First-party cookies. These are cookies recorded and controlled directly by Vulnera, on its own domains, which acts as controller of any personal data collected through them, under art. 5º, VI, of the LGPD. No other company has access to them. This category includes the NEXT_LOCALE cookie, recorded on the institutional site, and the local storage items vulnera-theme and vulnera-consent, on the site, and vulnera.session, vulnera.theme, vulnera.locale, and vulnera.connection, on the platform.
3.2. Third-party cookies. These are cookies recorded through tools provided by partner companies engaged by Vulnera, which act as processors of personal data under art. 5º, VII, of the LGPD and process the data only in accordance with Vulnera's instructions. This category includes:
- sentryReplaySession, recorded by the tool of Functional Software, Inc. (Sentry), a company headquartered in the United States of America, for monitoring platform errors.
- NRBA_SESSION::*, recorded by the tool of New Relic, Inc., a company headquartered in the United States of America, for monitoring platform performance.
- _ga and _ga_KVK4JYRHFM, recorded by the Google Analytics 4 tool, of Google LLC, a company headquartered in the United States of America, exclusively after the User's consent, for audience measurement.
3.3. Google advertising cookies. Should Vulnera come to run ads or activate remarketing features, the advertising cookies described in Clause 4.3 will be recorded by Google LLC, including on Google's own domains. In that case, Google also processes the data for its own advertising purposes, acting as an independent controller, subject to its privacy policy, available at https://policies.google.com/privacy.
3.4. Cookies recorded on third-party pages. Two platform features direct the User to external pages, which record their own cookies on their respective domains, outside Vulnera's control: login with Google, which leads to accounts.google.com, under the responsibility of Google LLC, and the subscription payment, which leads to checkout.stripe.com, under the responsibility of Stripe, Inc. These cookies are governed by the respective companies' policies, available at https://policies.google.com/privacy and https://stripe.com/privacy.
4. Categories of Cookies Used
The cookies used by Vulnera are classified, as to purpose, into Necessary, Analytics, and Advertising cookies and, as to duration, into session cookies and persistent cookies. Analytics cookies intended for audience measurement and Advertising cookies are only recorded after the User's prior consent, obtained through the cookie preferences panel.
4.1. Necessary Cookies. These are essential to the operation of the site and the platform, enabling authentication, navigation, and the preservation of choices made by the User, such as language and theme. They do not store identifiers for tracking, do not record the pages visited, and do not feed browsing profiles. Because they are essential, they do not depend on consent and cannot be disabled through the preferences panel, but can be deleted through the browser, with the effects described in Clause 6.
| Name/Company | Purpose | Duration |
|---|---|---|
| NEXT_LOCALE (Vulnera) · Cookie, on the institutional site | Record the language chosen by the visitor, so pages are consistently displayed in Portuguese or English. Stores only the value "pt-BR" or "en". | Until the browser is closed |
| vulnera-theme (Vulnera) · localStorage, on the institutional site | Store the visitor's visual preference (light or dark theme). | Until the User clears the browser data |
| vulnera-consent (Vulnera) · localStorage, on the institutional site | Record the User's choice about non-necessary cookies and the date of that choice, so the notice is not shown again and to evidence consent. | Until the User clears the browser data |
| vulnera.session (Vulnera) · localStorage, on the platform | Store the authentication token that keeps the User signed in. Without it, it is not possible to access the platform. | Until the User ends the session |
| vulnera.theme (Vulnera) · localStorage, on the platform | Store the User's visual preference (light or dark theme). | Until the User clears the browser data |
| vulnera.locale (Vulnera) · localStorage, on the platform | Store the User's preferred language. | Until the User clears the browser data |
| vulnera.connection (Vulnera) · localStorage, on the platform | Record whether the User has already completed connecting the platform to their development environment, preventing the procedure from being requested again. | Until the User clears the browser data |
4.2. Analytics Cookies. These allow understanding of how the site and the platform work and are used. They are divided into two groups, with different regimes.
(a) Technical monitoring. Intended exclusively for diagnosing errors and tracking the platform's performance, with no advertising or audience-measurement purpose.
| Name/Company | Purpose | Duration |
|---|---|---|
| sentryReplaySession (Functional Software, Inc., Sentry) · sessionStorage, on the platform | Enable recording of the browsing session only when an application error occurs, for diagnosis and reproduction of the failure. The recording is made with masking of all displayed text and all form fields, and with images and videos blocked. | Until the browser is closed |
| NRBA_SESSION::* (New Relic, Inc.) · sessionStorage, on the platform | Correlate the interactions of the same session for performance and user-experience monitoring (Real User Monitoring). | 30 minutes of inactivity, with a maximum duration of 4 hours |
(b) Audience measurement. Intended to understand the origin of visitors, whether through organic or paid traffic, and their conversion into sign-ups. Recorded only after the User's consent.
| Name/Company | Purpose | Duration |
|---|---|---|
| _ga (Google LLC) · Cookie, on the site and the platform | Generate and store a random browser identifier, to distinguish unique visitors and differentiate new visitors from returning ones. | 2 years, renewed on each visit |
| _ga_KVK4JYRHFM (Google LLC) · Cookie, on the site and the platform | Maintain the state of the browsing session, such as identifier and session count and engagement indicator. The suffix of the name corresponds to the identifier of Vulnera's measurement property. | 2 years, renewed on each visit |
4.3. Advertising Cookies. These are used to attribute conversions to ads and, when remarketing features are activated, to personalize ads. Recording of the cookies below depends on Vulnera running Google Ads campaigns or activating remarketing features and, in any case, on the User's prior consent.
| Name/Company | Purpose | Duration |
|---|---|---|
| _gcl_au (Google LLC) · Cookie, on the site and the platform | Store information about ad clicks, to attribute the conversion to the originating ad. | 90 days |
| _gcl_aw (Google LLC) · Cookie, on the site and the platform | Record the visitor's arrival via a click on a search-network ad, for conversion attribution. | 90 days |
| _gcl_dc (Google LLC) · Cookie, on the site and the platform | Record the visitor's arrival via a click on a display-network ad, for conversion attribution. | 90 days |
| IDE (Google LLC) · Cookie, on the doubleclick.net domain | Personalize ads and enable remarketing. | Up to 24 months |
| NID (Google LLC) · Cookie, on the google.com domain | Store user preferences and personalize ads. | 6 months |
| test_cookie (Google LLC) · Cookie, on the doubleclick.net domain | Check whether the visitor's browser accepts cookies. | 15 minutes |
The IDE, NID, and test_cookie cookies are recorded on Google domains, not on the vulnera.io domain, and will only come into existence if Google Signals features or integration with the ads account are activated.
4.4. Session Cookies. These are automatically deleted at the end of the session or when the browser is closed. This category includes: NEXT_LOCALE, sentryReplaySession, and NRBA_SESSION::*, the latter also expiring after 30 minutes of inactivity.
4.5. Persistent Cookies. These remain stored on the User's device even after the browser is closed, until they expire, are removed by the application itself, or are manually deleted. This category includes: vulnera.session (removed when the User ends the session), vulnera.theme, vulnera.locale, vulnera.connection, vulnera-theme, vulnera-consent, and, when authorized, _ga, _ga_KVK4JYRHFM, and the advertising cookies listed in Clause 4.3.
5. How Cookies Are Used
5.1. Use of Necessary cookies. Necessary cookies are used to enable the User's authenticated access to the platform, keep the User's session active, preserve language and theme preferences, and record the completion of the connection with the User's development environment. To the extent they involve personal data, the authentication item has as its legal basis the performance of the contract to which the User is a party (art. 7º, V, of the LGPD), and the preference items rely on Vulnera's legitimate interest in offering the experience chosen by the User themselves (art. 7º, IX, of the LGPD), with no use for tracking.
5.2. Use of Analytics cookies. Technical monitoring cookies are used to identify failures, system errors, and performance bottlenecks, with the aim of improving the platform's stability, security, and user experience. This processing relies on Vulnera's legitimate interest (art. 7º, IX, of the LGPD), with minimization measures such as masking content in session recordings. Audience-measurement cookies are used to understand the origin of visitors and their conversion into sign-ups and have as their legal basis the User's consent (art. 7º, I, of the LGPD), which is why none of them is recorded before the User's manifestation. Analytics cookies are not used by Vulnera for advertising purposes or to build User consumption profiles, except in the case described in Clause 5.3.
5.3. Use of Advertising cookies. If activated, advertising cookies will be used to attribute sign-ups and conversions to the originating campaigns and, if remarketing is enabled, to display Vulnera ads to people who have already visited the site or the platform. This processing has as its legal basis exclusively the User's consent (art. 7º, I, of the LGPD), which may be declined or revoked at any time, with no impact on access to the site and the platform.
6. Rejection and Deletion
6.1. Cookie preferences panel. On the first access to the site or the platform, the User is invited to make their choices through a cookie notice, which allows accepting or declining non-necessary cookies with equal ease. These choices can be changed at any time through the Cookie preferences link in your browser, available in the footer of every page. Revoking consent stops the recording of new audience-measurement and advertising cookies, without affecting the lawfulness of the processing carried out previously.
6.2. Browser settings. The User can also refuse, block, or delete cookies and local storage data directly in the settings of the browser used. Instructions and access links for the main browsers on the market follow:
- Google Chrome: https://support.google.com/chrome/answer/95647
- Mozilla Firefox: https://support.mozilla.org/pt-BR/kb/ative-e-desative-os-cookies-que-os-sites-usam
- Microsoft Edge: https://support.microsoft.com/pt-br/microsoft-edge/excluir-cookies-no-microsoft-edge-63947406-40ac-c3b8-57b9-2a946a29ae09
- Safari: https://support.apple.com/pt-br/guide/safari/sfri11471/mac
To remove local storage items (localStorage and sessionStorage), the User must use the site-data deletion option available in the browser, which also removes the cookies associated with the respective domain.
Important notice: refusing or deleting items classified as Necessary may compromise the proper operation of the Vulnera site and platform. Deleting vulnera.session ends the User's session and requires a new login, and deleting the preference items causes language and theme to revert to the default setting.
Regardless of the refusal or deletion of cookies, Vulnera keeps, confidentially, in a controlled and secure environment, for a period of 6 (six) months, the application access logs, which do not depend on cookies, in accordance with art. 15 of Lei nº 12.965/2014 (the Marco Civil da Internet, Brazil's Internet Civil Rights Framework) and art. 7º, II, of the LGPD, which authorizes the processing of personal data for compliance with a legal or regulatory obligation by the controller.
7. Data Sharing
Due to the use of third-party cookies, Vulnera shares certain browsing data with the following partners, which act as processors and handle the data only for the purposes indicated:
- Functional Software, Inc. (Sentry): receives technical browsing data and, when an error occurs, the masked recording of the session, for diagnosis, identification, and reproduction of platform failures.
- New Relic, Inc.: receives technical browsing and performance data, for monitoring the platform's user experience and performance.
- Google LLC: upon the User's consent, receives browsing data for audience measurement. Should advertising cookies be activated, Google will also process the data as an independent controller, under Clause 3.3.
Data from the NEXT_LOCALE cookie and from the first-party local storage items is not shared with third parties. There is no sharing, nor is any planned, of data obtained through cookies with companies other than those indicated in this Clause.
The User may revoke, at any time, the consent given for audience measurement and for advertising, through the panel described in Clause 6.1. As for technical monitoring, based on legitimate interest, the User may object to the processing, under art. 18, § 2º, of the LGPD, by request to the channel indicated in Clause 9, which will be reviewed taking into account the need for that monitoring for the platform's security and stability.
8. International Data Transfer
The data collected by the third-party cookies used on the site and the platform is transferred to the following partners and countries:
- Functional Software, Inc. (Sentry), United States of America.
- New Relic, Inc., United States of America.
- Google LLC, United States of America, only upon the User's consent.
These international transfers comply with the provisions of arts. 33 to 36 of the LGPD and Resolução CD/ANPD nº 19/2024, which regulates the circumstances and requirements for the international transfer of personal data.
9. Privacy Communication Channel
To exercise the rights set out in art. 18 of the LGPD, including confirmation of the existence of processing, access, correction, anonymization, blocking or deletion, portability, information about sharing, revocation of consent, and objection, the User may contact us at the e-mail privacidade@vulnera.io. The User may also petition the Agência Nacional de Proteção de Dados (National Data Protection Authority, ANPD), under art. 18, § 1º, of the LGPD.
10. Governing Law and Forum
This Cookie Policy is governed by the laws of the Federative Republic of Brazil, in particular Lei nº 13.709/2018 (the Brazilian General Data Protection Law, LGPD) and Lei nº 12.965/2014 (the Marco Civil da Internet, Brazil's Internet Civil Rights Framework), and shall be interpreted and applied in accordance with Brazilian law.
The forum of the Comarca de São Paulo/SP is elected to resolve any disputes arising from this Cookie Policy, involving Osmir Custodio Mariano Tecnologia da Informação Ltda, registered with the CNPJ under No. 53.636.099/0001-89, with express waiver of any other forum, however privileged it may be, except for the right of a User who qualifies as a consumer to bring an action in the forum of their domicile, under art. 101, I, of Lei nº 8.078/1990 (the Brazilian Consumer Protection Code).