NV R.E.C Privacy Policy

Plain-language summary

NV R.E.C is a work tool: a company installs it on its team’s computers to generate test scripts and automation spreadsheets. What you need to know:

Recording is continuous, on any website, while the extension is installed and active. It does not depend on the record button in the extension menu.
Passwords, secrets and tokens are masked. All other typed values, including CPF, CNPJ, card numbers, salaries and names, are recorded exactly as typed.
The extension does not send anything over the internet on its own. The generated files stay on the computer and, afterwards, an agent outside the extension sends them to the NV Track database.
The company that installed the extension decides what the recording is for. Release Sistemas processes the data on its behalf.

Who we are and who decides

NV R.E.C is developed and distributed by Release Serviços em Informática LTDA (CNPJ 09.508.478/0001-00), based in São Paulo, Brazil. This policy follows Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018).

As a rule, the company that installs NV R.E.C on its team’s computers is the controller of the data (LGPD, Art. 5, VI): it decides what the recording is for, on which devices it runs and for how long the data is kept. Release acts as the processor (Art. 5, VII): it processes the data on the company’s behalf and under its instructions (Art. 39).

If you use the extension at work, the first point of contact for questions and requests about your data is the company that installed it. Release also assists you, as described below.

What NV R.E.C is

NV R.E.C records the user’s actions on web pages, including inside Shadow DOM, and generates Robot Framework test scripts and spreadsheets (.xlsx and .csv). It works on Chrome and Edge (version 121 or later) and on Firefox (version 140 or later). It has no login and no user account.

Which data is processed

On every page opened in the browser, the extension records:

Clicks, including right clicks: the text of the clicked element (up to 100 characters) and its position on the screen.
Page scrolling.
Values typed or changed in fields, and the state of checkboxes and radio buttons.
Special keys, such as Enter, Tab, arrows and F1 to F12. There is no general key capture beyond that, but the content typed into fields is recorded, as described above.
The full page address (URL), which may contain parameters, and the SAP transaction code when it appears in the address.
The technical identification of the element: id, name, type, placeholder, accessibility label, text (up to 120 characters), XPath and CSS selector.
The date and time of each action and a random identifier of the recording session.
The user name and the machine name, read from the newvision.ini file or, if it does not exist, from the Windows user and computer.

What the extension does not do

It does not capture screenshots, cookies, camera, microphone or location.
It does not detect the computer’s IP address.
It does not use analytics, advertising, telemetry or crash reports.
It does not make network requests on its own. Its only communication outside the browser is with the local agent installed on the computer, through the browser’s native messaging.
It does not sell or rent data.

Scope and limits of the recording

Two points deserve attention. First, capture applies to any website open in the browser, including personal pages, while the extension is active. Second, masking covers only password fields and fields whose identifier indicates a password, secret, token or API key; all other values, including personal and financial data, are recorded as typed, and the page address may carry sensitive parameters.

For this reason, NV R.E.C should be used only on work devices and work browsers (or browser profiles), and the company must inform users before installing it.

What the data is used for

To generate Robot Framework scripts and spreadsheets for testing and process automation.
To feed the NV Track database with the generated spreadsheets and scripts.
To comply with legal and regulatory obligations.

Legal basis

The legal basis is set by the controller company, according to the purpose, among the grounds of Art. 7 of LGPD (for example, performance of a contract, legitimate interest or compliance with a legal obligation). If the recording may reach sensitive personal data (Art. 5, II), the company must rely on one of the grounds of Art. 11.

Release does not use the recorded data for its own purposes and processes it under the controller’s instructions.

Where the data is kept

In the browser’s local storage (with no size limit), until it is exported.
In .xlsx, .csv and .robot files in the C:\NewVision\Interfaces\Scripts folder, rewritten every minute by the Release local agent installed on the computer.
In the Downloads folder, when the user exports the CSV or saves the script.

Sending to NV Track and international transfer

An agent outside the extension sends the generated spreadsheets and scripts to the NV Track database. That database is hosted by a third-party cloud provider, engaged for that purpose, which acts as a sub-processor and is bound by duties of confidentiality and security.

If the server is outside Brazil, international transfer takes place only under the grounds of Art. 33 of LGPD, for example with adequate contractual clauses. The controller company may ask Release to identify the provider and the country where the data is kept.

Sharing

The data may be accessed by the controller company, by the sub-processors needed to run the service (such as the cloud provider) and by authorities, where there is a legal obligation or a court order. We do not sell personal data.

How long the data is kept

The period is set by contract with each controller company. When the contract ends, the data in the database is deleted or returned, as agreed, unless the law requires it to be kept (LGPD, Art. 16).

On the computer, the browser storage is cleared when a new session starts after a successful export and when the extension is uninstalled. The files in C:\NewVision\Interfaces\Scripts and in the Downloads folder remain until they are deleted: uninstalling the extension or the agent does not remove them.

Browser permissions

The extension asks for these permissions, each for a reason:

Access to all websites and activeTab: to record and scan the site where the user works.
storage and unlimitedStorage: to keep the session in progress, which has no event cap.
downloads: to download the CSV when the user clicks "Export CSV", or the script when they click "Save script" and the local agent is not available.
notifications: to tell where the file was saved.
nativeMessaging: to hand the session to the local agent that writes it to disk.
alarms: to save the session periodically so no data is lost.

Installation enforced by the company

The company may install NV R.E.C as mandatory, through a browser policy. In that case, the user may not be able to disable or remove the extension, and the company must inform them beforehand (LGPD, Art. 9).

Security

We mask credentials before recording them, the extension does not open network connections on its own, it uses bundled libraries (it does not load code from external servers) and asks only for the permissions its function requires. Release adopts technical and administrative measures to protect the data in the NV Track database (Art. 46).

In case of a security incident that may cause relevant risk or harm, Release notifies the controller company, which is responsible for assessing whether to notify the ANPD and the data subjects (Art. 48).

Your rights

Under Article 18 of LGPD, you may ask for:

Confirmation that we process your data, and access to it.
Correction of incomplete, inaccurate or outdated data.
Anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data.
Data portability.
Information about who the data is shared with.
Deletion of data processed with your consent, and withdrawal of consent.
Information about the possibility of refusing consent and the consequences of refusal.

How to exercise your rights and reach the data protection officer

Contact first the company that installed the extension, which is the controller. Release forwards to the controller the requests it receives and helps to answer them.

To reach Release and the data protection officer, write to comercial@rsistemas.com.br. You can also file a complaint with the Brazilian data protection authority (ANPD).

Children and teenagers

NV R.E.C is a professional tool and is not intended for children or teenagers.

Responsibilities of the company that installs the extension

By installing NV R.E.C, the controller company undertakes to:

Inform users, in writing and before installation, what is recorded, why and for how long.
Define and document the legal basis and the purpose, without using the data for other ends, such as improper control or discrimination (Art. 6, I, II and IX).
Install the extension only on work devices and browser profiles, and tell users not to use it for personal browsing.
Restrict access to the generated files and to the NV Track database to those who need it.
Keep the record of processing operations (Art. 37) and prepare the data protection impact assessment, where applicable (Art. 38).
Answer data subjects’ requests and notify Release of any incident involving the recorded data.

Changes to this policy

We may update this policy. The date at the top shows the version in force, and relevant changes are communicated to client companies.