Privacy Policy

The controller of personal data collected by the Platform is Grupo Super Software House Ltda, headquartered in Brazil (address to be defined).

Data Protection Officer (DPO): contact via [email protected].

This policy applies to: (a) personal data of Merchants and their authorized users (admins, collaborators) using the Platform dashboard; and (b) end-buyer data collected through Merchant stores.

For end-buyer data, the Merchant is the controller; we act as processor, handling data only per instructions and technical necessity.

We collect different categories depending on use:

• Merchant registration: name, email, phone, billing data, CNPJ/CPF (Brazil) or equivalent, business address.
• Browsing and usage: IP address, browser, OS, visited pages, dashboard actions, login records, session identifiers.
• Payment data: tokens and transaction IDs provided by gateways (Stripe, Mercado Pago). We do NOT store full card numbers.
• End-buyer data (on behalf of Merchant): name, email, phone, shipping address, tax ID when applicable, order history.
• Support: messages exchanged with our team, attachments, environment data for diagnostics.
• Cookies and identifiers: detailed in the Cookie Policy.

We process personal data based on:

• Contract performance (art. 7, V LGPD / art. 6.1.b GDPR): operating the Platform, billing, support.
• Legal obligation (art. 7, II / art. 6.1.c): tax, fraud prevention and court orders.
• Legitimate interest (art. 7, IX / art. 6.1.f): Platform security, aggregate metrics, abuse prevention. Prior assessment available on request.
• Consent (art. 7, I / art. 6.1.a): non-essential cookies, marketing communications. Revocable at any time.

Data is used strictly for:

• Providing contracted services (creating stores, processing orders, integrating payments and shipping).
• Charging subscriptions and issuing our own tax invoices.
• Providing technical support and answering questions.
• Detecting and preventing fraud, abuse or breach of Terms.
• Complying with legal obligations and competent authorities.
• Improving the Platform (aggregate metrics, anonymized when possible).
• Communicating operational and security updates (these do not depend on consent — part of the contract).

We share data only with vendors strictly necessary for operation, under data protection agreements. We do not sell data.

• Payment gateways: Stripe (United States / Ireland), Mercado Pago (Brazil).
• Infrastructure: Netcup (servers in the United States), Cloudflare (global CDN/DNS), encrypted backup at Hetzner Storage Box (Germany).
• AI providers: xAI (Grok), Anthropic (Claude), OpenAI — used by the copilot, under contracts that prohibit using your data to train models.
• Shipping & tax: Melhor Envio (Brazil), CertFiscal (same group) — when enabled by the Merchant.
• Transactional email: Resend (United States / EU).
• Authorities: when required by law or court order.

Our main servers are in the United States (Netcup, Manassas/VA). Offsite backup in Germany (Hetzner Storage Box). AI providers may have infrastructure in the US or EU.

For international transfers of personal data protected by LGPD or GDPR, we use Standard Contractual Clauses, anonymization where possible and country adequacy assessment as required.

When strictly necessary, data may be processed in any country where our vendors operate, always respecting standards equivalent to Brazilian or European legislation.

We keep personal data only for the necessary time:

• Registration data: contract term + 5 years after termination (tax/commercial obligation).
• Payment data (tokens, transaction IDs): 10 years for tax obligation.
• Access and audit logs: minimum 6 months (Brazilian Civil Internet Framework).
• Merchant content (products, orders): contract term + 60 days after termination or deletion request.
• Backups: retention cycle up to 90 days with at-rest encryption.
• Support: 3 years for ticket history.

You have the right to, at no cost:

• Confirm the existence of processing of your data.
• Access your data.
• Correct incomplete, inaccurate or outdated data.
• Request anonymization, blocking or deletion of unnecessary or excessive data.
• Request data portability (structured format).
• Revoke consent (when this is the legal basis).
• Object to processing based on legitimate interest.
• Know with whom we share your data.
• To exercise any right: write to [email protected]. We respond within 15 days.

We adopt technical and organizational measures to protect personal data, including: SSL/TLS in all communications, at-rest encryption for backups and sensitive data, role-based access control, continuous monitoring, SSH key authentication on servers, fail2ban and restrictive UFW, regular security updates.

In the event of an incident that may cause relevant risk to data subjects, we will notify the competent authority and affected subjects per art. 48 LGPD / art. 33 GDPR.

The Platform is not directed to minors under 16. We do not knowingly collect minors' data. If improper collection is identified, we remove it immediately. Parents or guardians may contact the DPO.

Operational communications (billing, security, relevant updates) derive from the contract and do not depend on consent.

Marketing communications (newsletter, product news) require opt-in. You may unsubscribe anytime from the email or the dashboard.

We may update this policy. Relevant changes will be communicated by email and in the dashboard at least 15 days in advance.

Version and effective date are always visible at the top of this document.

Grupo Super Software House Ltda — Data Protection Officer.

Email: [email protected]. Response within 15 business days.

You may also contact your country's data protection authority (ANPD in Brazil, your local DPA in the EU).