Privacy Policy

Víndica ("we", "our") is the controller of the personal data processed through this platform, under Brazil's General Data Protection Law (Law No. 13,709/2018 — "LGPD"). This Privacy Policy explains what data we collect, why we collect it, and how you can exercise your rights.

We collect the following categories of data:

• Registration data: name, email, password (encrypted), and company/brand information provided when creating your account.
• Usage data: pages accessed, filters and brands queried, dashboard interactions, access logs.
• Payment data: processed directly by our payment provider; we do not store full credit card data on our servers.
• Cookies and device identifiers: as detailed in our Cookie Policy.

Separately from the personal data above, the Service also processes public data collected from third-party websites (fashion brands and stores) — such as prices, stock, and product catalog — for market intelligence purposes. This data concerns publicly disclosed products and business operations and does not constitute personal data. More details about this collection are available on our Data Sources page.

We use your personal data to:

• Enable the creation and operation of your account;
• Process payments and manage your subscription;
• Send operational communications (confirmations, billing alerts, security notifications);
• Improve the Service through aggregate usage analysis (analytics);
• Comply with legal and regulatory obligations.

This processing is based on the performance of the contract entered into with you (LGPD art. 7, V), compliance with a legal obligation (art. 7, II), and our legitimate interest in maintaining and improving the Service (art. 7, IX), always respecting your fundamental rights and freedoms.

We do not sell your personal data. We share data only with:

• Infrastructure and hosting providers (e.g., Supabase) who process data on our behalf, under confidentiality agreements;
• Payment processors, to enable billing;
• Public authorities, when required by law or court order.

We retain your personal data for as long as necessary to fulfill the purposes described in this policy or while your account remains active. After account closure, data is deleted or anonymized, except where retention is required by law (e.g., tax records).

Under LGPD article 18, you may request at any time:

• Confirmation of the existence of processing and access to the data;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary or excessive data;
• Portability of data to another service provider;
• Deletion of data processed with your consent;
• Withdrawal of consent and information about the entities with which we share your data.

To exercise these rights, contact us via the email listed in the "Contact and Data Protection Officer" section below.

We adopt technical and administrative measures to protect your data against unauthorized access and loss, alteration, or leakage, including encryption in transit, access control, and secure authentication.

Some of our infrastructure providers may store or process data outside Brazil. In these cases, we require contractual and technical safeguards compatible with the LGPD.

The Service is intended exclusively for adults aged 18 and over and for business use. We do not intentionally collect data from minors.

We may update this Policy periodically. Material changes will be communicated by email or platform notice, with an updated date shown at the top of this page.

The Service offers an AI assistant ("Agent") that answers natural-language questions based on aggregated market data from our own database (brands, prices, stock, and trends) — not based on personal data or private business information from other accounts.

The Agent is powered by the Gemini model (Google), with a fallback provider. We only use the user's first name (taken from their registration) to personalize the conversation; neither conversation content nor personal data is used to train AI models, ours or third parties'.

The Agent's responses are informational and decision-support in nature and may contain inaccuracies, as described in Section 4 ("About Public Market Data") and our Data Sources page. Use of the Agent does not constitute automated decision-making that produces legal effects or significantly impacts the user, under LGPD article 20 — all business decisions remain the user's sole responsibility.

To exercise your rights or clarify questions about this Policy, contact our Data Protection Officer at contato@vindica.app.