Privacy Policy

Last updated: 19 de outubro de 2026

This is a courtesy translation. The Portuguese version of this policy is the legally binding one.

This policy explains what data Vazante collects, what it is used for, and how you can control it, in compliance with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018).

1. Who we are

Vazante is a product of Platinuum Marketing (63.493.999 Victor dos Santos Jurema), Brazilian company ID (CNPJ) 63.493.999/0001-78, headquartered at Avenida Antonio Frederico Ozanan, 2111, Apt 1405, Bloco 2 — Ponte de São João, Jundiaí/SP, CEP 13218-000. For anything related to this policy, contact us at contato@vazante.app.

2. What data we collect

• Signup data: name, email, and password (when you create an account with email) or the name, email, and profile photo provided by Google (when you sign in with your Google account).
• Meta/Facebook data: when you connect your account through the "Connect Facebook" button, we use Meta's official OAuth login. We never see or store your Facebook password. With your explicit authorization, we read:
  • the list of Facebook Pages you manage;
  • organic metrics for those Pages (reach, engagement, follower growth — Facebook Page Insights);
  • metrics for your ad accounts (spend, impressions, clicks, CPC, CPA — Meta Ads Insights).
• Technical data: session cookies to keep you signed in (via Supabase Auth), measurement tools on the public pages (Meta Pixel and Google Tag Manager) and basic technical access logs (date/time, errors) for security and diagnostics.

3. What we use this data for

• Authenticating you and keeping your session active;
• Fetching and displaying, in your dashboards, the Meta data you authorized;
• Managing your trial period and, in the future, your subscription;
• Sending important notices about your account (e.g., trial ending);
• Diagnosing technical issues and keeping the platform secure.

We do not use your data for advertising, nor do we sell it to third parties.

4. Legal basis (LGPD, art. 7)

We process your signup data based on the performance of the contract established in the Terms of Use. Access to your Meta data depends on your explicit consent, given when you authorize the connection — and revocable at any time (see section 7).

5. Who we share data with

• Meta Platforms, Inc.: for authentication (Facebook Login) and reading the data you authorized, via Meta's official Graph API.
• Supabase: our database and authentication provider, where your signup data and (encrypted) access tokens are stored.

We do not share your data with any third party other than those listed above.

6. How we protect your data

Meta access tokens are stored encrypted and are never exposed in the browser. The database uses Row Level Security, so each account can only access its own data.

7. How to disconnect your Meta account

You can remove the connection at any time in Settings inside the app, or directly in your Facebook account's app settings. When you disconnect, we stop fetching new data and delete the stored access tokens.

8. Your rights (LGPD, art. 18)

At any time, you may request:

• confirmation that we process your data, and access to it;
• correction of incomplete or outdated data;
• deletion of your account and associated data;
• portability of your data to another provider;
• revocation of the consent given for the Meta connection;
• information about who we share your data with.

To exercise any of these rights, write to contato@vazante.app.

9. Data retention

We keep your data while your account is active. When you request account deletion, we remove your signup data and Meta access tokens; aggregated, non-identifying data may be kept for statistical purposes.

10. Minors

Vazante is not directed at people under 18.

12. Google user data (Google API Services)

Vazante connects to Google services only when you authorize it, and each connector asks for its own authorization, separate from the others. This section describes, in one place, what each one accesses, as required by the Google API Services User Data Policy.

• Sign in with Google: name, email and profile photo, to create and identify your account.
• Google Ads (adwords): the list of accounts you can access and their metrics — cost, impressions, clicks, conversions, CPC and CPA — plus campaign names and daily budgets. The Google Ads API only offers this scope; there is no read-only variant. Nothing is changed without your request: Vazante only pauses, resumes, adjusts the budget of or creates campaigns (which start paused) when you ask and confirm each action, within a per-action spending cap you set. Write actions come turned on, and you can turn them off under Account and team at any time.
• Google Analytics 4 (analytics.readonly): sessions, conversions and traffic sources of the properties you choose. Read-only.
• Google Search Console (webmasters.readonly): queries, impressions, clicks and position of your verified sites. Read-only.
• Google Drive (drive.file): only the files you pick in Google's own picker. Vazante cannot see the rest of your Drive. When you ask, we download the chosen file and hand it to the ad account or YouTube channel you selected; no copy of the file is kept by Vazante.
• YouTube (youtube.force-ssl andyt-analytics.readonly): see section 12.1.

• How we use it: only to show this data in your own dashboards, answer your questions about it and carry out the actions you request. We never use Google data for advertising, credit scoring, training AI models or any purpose unrelated to the service you signed up for.
• Who we share it with: no one. Google data is not sold, rented or transferred to third parties, data brokers or advertisers. It only travels between Google, our infrastructure (Vercel and Supabase, as processors) and you. When you connect Vazante to an AI assistant, the data you query goes to the assistant you authorized, at your command.
• How we protect it: access keys are stored encrypted and never reach the browser. All traffic uses HTTPS, and the database uses row-level access control, so each account only reaches its own data.
• Retention and deletion: we keep data only while your account exists and the connection is active. When you disconnect under Account and team → Connections, we revoke the access with Google and immediately delete the keys and everything that came from that connection. If you revoke access directly at Google, atsecurity.google.com/settings/security/permissions, a daily routine detects it and deletes the data within 24 hours (our own limit is 30 days). Deleting your account removes all associated data.

Vazante's use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements.

12.1 YouTube (YouTube API Services)

Vazante uses YouTube API Services. By connecting a channel you agree to theYouTube Terms of Service, and data handled by YouTube is also subject to theGoogle Privacy Policy.

• What we access: the channel's name, photo and URL; the channel's video list, including private and scheduled videos, with title, description, tags, category, visibility and publish date; statistics for views, minutes watched, likes, comments (counts only) and subscribers; and the channel's playlists.
• What we store: only the channel's name, photo and URL, and the authorization key, encrypted. Videos, statistics and playlists are fetched live from YouTube every time and are not stored. What we store is refreshed every day — never more than 30 days without an update.
• What we do on your channel: only when you ask, with a click — publish or schedule a video you picked from your Google Drive; edit title, description, tags, category, visibility and publish date; set the thumbnail; create playlists and add videos to them. Vazante does not delete videos, comments, ratings or any content on your channel. Every action is recorded in your account's change history.
• Who we share it with: no one, on the same terms as section 12. Vazante does not allow third parties to serve content or ads inside the product.
• Data on your device: we store cookies in your browser to keep your session and preferences, and the public pages use measurement tools (Meta Pixel and Google Tag Manager). No YouTube data is sent to these tools.
• How to revoke: under Account and team → Connections → Disconnect, we immediately delete all YouTube data and revoke each channel with Google (our maximum is 7 days). You can also revoke at security.google.com/settings/security/permissions; in that case data is deleted within 24 hours, at most 30 days.
• Questions: write tocontato@vazante.app.

Annex A. The “Vazante” app on the Bitrix24 Market

This annex covers specifically the Vazante application (code platinuum.vazante) published on the Bitrix24 Market, and forms part of this Privacy Policy. Everything not described here is governed by the sections above.

• Permission we request: crm only. The app does not request access to tasks, files, drive, chat, telephony, email or the portal's user list.
• What we read: the CRM pipelines (categories) and stages, the deals in the period being queried, the stage-history of those deals, and the deal's source fields (UTM, source). We read the deal amount to compute revenue.
• What we do NOT do: the app is read-only. We never create, change or delete anything in your portal.
• How we use it: solely to build your own dashboards and answer your questions about them — how many deals came in, how many reached the quote and sale stages, and which source they came from.
• Who we share it with: nobody. Your Bitrix24 data travels only between your portal, our infrastructure (Vercel and Supabase, acting as processors) and you. When you connect Vazante to an AI assistant, the queried data goes to the assistant you authorized yourself, under your command, and is not used to train models.
• How we protect it: portal access tokens are stored encrypted and never reach the browser. All traffic is over HTTPS.
• Retention and deletion: we keep the figures only while your account exists and the connection is active. Uninstalling the app in Bitrix24, or removing the connection under Account and team → Connections, immediately deletes the token and the stored pipelines.

11. Changes to this policy

We may update this policy from time to time. Relevant changes will be communicated by email or by notice inside the platform.

See also the Terms of Use.