Privacy Policy

1. Who controls your data

Viralize Shop is operated by [COMPANY NAME], registered under CNPJ [CNPJ], headquartered at [FULL ADDRESS] ("we"). We are the controller of the personal data processed on this platform, under Brazil's General Data Protection Law (Law 13,709/2018 — LGPD).

Data protection officer (DPO): [DATA PROTECTION OFFICER EMAIL].

2. What data we collect

We collect only what is needed to operate the service. In practice:

• Account data: email, password (stored encrypted, not accessible to us), display name and store name, when you provide them.
• Payment data: credit card data is collected and processed directly by Stripe — we never receive or store your card number. For Pix payments made before September 2026, we keep the payer's CPF and email that Mercado Pago required to issue the charge.
• Content you upload: product photos, product name and description, and the creative instructions you write.
• Generated content: the videos produced, thumbnails and the prompts used to generate them.
• Browsing and usage data: IP address, browser identifier (user agent), pages visited, clicks and in-app usage events, plus session and visitor identifiers.
• Source and advertising data: campaign parameters (UTMs), landing page, referring site (referrer) and Meta ad identifiers (fbclid, fbp, fbc).

3. Why we process this data and on what legal basis

• To create and maintain your account and deliver the service you purchased — legal basis: performance of a contract (art. 7, V).
• To process payments and subscriptions and issue charges — performance of a contract and compliance with legal and regulatory obligations (art. 7, II and V).
• To generate videos from the photos you upload, which involves sending that content to artificial intelligence providers — performance of a contract (art. 7, V).
• To prevent fraud, abuse and misuse of the platform, and to investigate incidents — legitimate interest (art. 7, IX).
• To measure performance, understand usage and improve the product — legitimate interest (art. 7, IX).
• For advertising and campaign measurement, including sharing events with Meta — consent, where required, or legitimate interest (art. 7, I and IX).
• To comply with legal, judicial or competent authority orders — art. 7, II and VI.

4. Who we share it with

We do not sell your data. We share it only with providers needed to operate the service, each limited to its purpose:

• Supabase — database hosting, authentication and storage of your photos and videos.
• Cloudflare and Netlify — delivery and hosting of the web application.
• Mercado Pago — processing of past Pix payments.
• Stripe — card payment processing and subscription management.
• Artificial intelligence providers (OpenRouter/BytePlus and OpenAI) — receive the product photo and creative instructions to produce the video. We do not send these providers your email, CPF or payment data.
• Meta (Facebook and Instagram) — receives conversion events for ad measurement, including browsing identifiers and, where applicable, your email in encrypted (hashed) form.
• Public authorities, when there is a legal obligation or court order.

5. International data transfer

Some of the providers above process data on servers outside Brazil, notably in the United States. This means your photos, videos and browsing data may be transferred and processed abroad, under article 33 of the LGPD, always with providers that adopt contractual clauses and data protection safeguards.

6. How long we keep it

• Account data and content (photos, videos and products): while your account exists. When you delete your account, we remove or anonymize this data, unless there is a legal obligation to retain it.
• Payment and billing data: for the period required by tax and civil law, which can be up to 5 years after the transaction.
• Application access logs: for at least 6 months, under article 15 of Brazil's Internet Civil Framework (Law 12,965/2014).
• Usage and browsing data for metrics: generally up to 24 months, and may be kept for longer in aggregated, non-identifiable form.

7. Your rights

The LGPD guarantees you the rights below, at any time and free of charge. To exercise them, write to our data protection officer. We may ask for additional information to confirm your identity before handling the request, as a security measure.

• Confirm whether we process your data and access it.
• Correct incomplete, inaccurate or outdated data.
• Request anonymization, blocking or deletion of unnecessary data or data processed in breach of the law.
• Request portability of your data to another provider.
• Request deletion of data processed based on your consent.
• Know which entities we share your data with.
• Withdraw consent, when that is the legal basis used.
• Object to processing based on legitimate interest.

8. Cookies and similar technologies

We use local storage and cookies to keep you signed in, remember preferences and measure usage and campaign performance. Strictly necessary cookies cannot be disabled without breaking the service. You can block the others in your browser settings, bearing in mind that this may affect features.

9. Security

We adopt technical and administrative measures to protect your data, including encryption in transit, per-user access control and data isolation between accounts. No system is completely immune to incidents; if a relevant security incident occurs that may cause risk or harm to you, we will notify you and the ANPD, under article 48 of the LGPD.

10. Use by minors

The platform is intended exclusively for people over 18. We do not knowingly collect data from children or adolescents. If we identify an account belonging to a minor, it will be closed and the data deleted.

11. Changes to this policy

We may update this policy to reflect changes to the service or the law. The last-updated date at the top of this page always shows the current version. Relevant changes will be communicated through your account's contact channels.