Privacy policy
Last updated: October 10, 2026 · Terms of use
This policy explains what data Transita processes, why, who it shares it with and how rights are exercised. It is written to be understood both by the company using Transita and by the people whose data is loaded.
1. Who decides about the data
The company using Transita decides which of its workers' data it loads and why: it is the controller of that data. Transita processes it on the company's behalf, only to provide the service (processor).
For the service's own operational data (for example, technical access logs), the controller is Transita.
2. What data is processed
About the company's people: an internal identifier (employee ID), area, role, country, tenure and, if the company adds them, name and email. Transita does not ask for these people's ID numbers or sensitive data.
About their transition: the proposed plan (path, destination, actions, estimated cost), the consultation with the person (whether they accepted or asked for changes, and their note), signatures, progress and, if they leave the company, the date and reason.
About users: name, email, role in Transita, associated area or employee ID, last sign-in date and open sessions.
Audit log: who made each change, when, and the old and new values.
3. Why
To provide the service: show the exposure map, build and track plans, send email notices when a consultation or signature is pending, produce the dashboard and reports, and keep a record of every step.
Transita does not use data for advertising, does not sell it and does not use it to train artificial intelligence models.
4. Who it is shared with
With providers that run the service, only as needed: Railway (servers and database), Cloudflare (domain and network), Resend (email delivery: address, name and notice text) and, if Google or Microsoft sign-in is used, those providers to verify identity.
AI task suggestions use Anthropic (Claude). Only the occupation, role and area names, the company's AI projects and the role's existing tasks are sent. No personal data is sent.
These providers may be in other countries, so there may be international data transfers. Today all data is hosted on the same infrastructure, whatever region was chosen at registration; that choice is recorded for when region-specific hosting exists.
5. How long it is kept
As long as the company uses Transita. If a person leaves the company, their history is kept as a record until the company deletes it. When administrators delete the company, all its data is erased from the service's database; the infrastructure provider's backups roll over on their own cycle.
Sign-in links expire after 15 minutes, invitations after 7 days and sessions after 30 days.
6. Security
Encrypted connection (HTTPS), role-based access, passwordless sign-in, sessions stored only as a cryptographic fingerprint, separation of each company's data and an audit log. In the dashboard and reports, groups of fewer than 5 people are shown as “<5”.
7. Cookies
Transita uses only first-party, necessary cookies: the session cookie (to know you are signed in), the chosen language and, if you sign in with Google or Microsoft, a temporary one that lasts 10 minutes and protects that sign-in. It uses no advertising or third-party analytics cookies.
8. Rights
People can request access, rectification, erasure or objection, and any other rights their law grants (for example, Law 25,326 in Argentina, the GDPR in the European Union or the LGPD in Brazil). Since the controller is the employer, requests go to it; Transita helps it respond.
The company can export all its data to a file and delete it from “Settings”.
For privacy questions, the first contact is your company's administrator, who can reach Transita.
9. Changes
If this policy changes, the new version is published on this page with its date. Significant changes are notified to each company's administrators.