Privacy Policy

1. Who is responsible

The controller of your personal data is IC Design Tecnologia Ltda (CNPJ 51.850.491/0001-09), Avenida Paulista, 1106, São Paulo, SP, 01310-914, Brasil. For anything about your data, including requests to our data protection officer (encarregado), use the contact form and choose “Privacy and personal data”.

2. In short

• You can watch without an account. We set no advertising, analytics or tracking cookies.
• We never see or store card details: Stripe handles payments.
• We never sell your data, and we do not use it for profiling or automated decisions. Every slot is reviewed by a person; no AI is used.
• The only free text with personal data we keep is what you send us through the contact form, and we delete it automatically after one year.

3. What we process, why, and on what legal basis

Everyone who visits

To deliver the site and protect it from abuse, your IP address and browser details are processed by our hosting provider, Cloudflare, and used for a short time to limit how many requests one connection can make. Legal basis: our legitimate interest in running a secure service (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).

To count viewers and link clicks, we combine your IP address and browser details into a coded identifier using a secret key that changes every day. Your IP address itself is never stored. The identifier is only used to produce totals (people watching, viewers per day, clicks per slot), cannot be linked across days, and is not used to recognise you. Legal basis: legitimate interest in measuring the audience slots receive (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).

Reports

When you report a slot, we store only which slot and the reason you chose, never who reported it.

Buyers

Stripe collects your payment details (such as your card, name, email address and billing country) on its own page as an independent controller, under its privacy policy. From Stripe we receive only payment references, the amount, the currency and whether the payment succeeded. We use your approximate country, from your connection, only to choose the currency, and do not store it. Legal basis: performing our contract with you (LGPD Art. 7, V; GDPR Art. 6(1)(b)) and complying with tax and accounting law (LGPD Art. 7, II; GDPR Art. 6(1)(c)).

Your slot content (name or brand, text, link, image or video link) is reviewed by our team and broadcast publicly to everyone watching. If it includes personal data, such as your name or a picture of a person, you choose to make it public. Images are re-encoded when you upload them, which removes hidden data such as location. Legal basis: performing our contract (LGPD Art. 7, V; GDPR Art. 6(1)(b)) and our legitimate interest in keeping the broadcast safe and lawful (LGPD Art. 7, IX; GDPR Art. 6(1)(f)).

Because we do not accept political content (see the Terms of Use), we never broadcast data revealing political opinions, which the law treats as sensitive personal data (LGPD Art. 5, II; GDPR Art. 9). A slot that contains it is rejected in review and never airs.

Nota fiscal

Payments in reais (BRL) get a nota fiscal (a Brazilian electronic invoice). Before such a slot is published, we ask for the CPF or CNPJ to issue it to and an email address, which we check by emailing a code; a slot bought while signed in uses your account’s. We store them with the language of the page and when you gave them, linked to your payment, and use them only to issue the nota fiscal and email it to you. Legal basis: complying with tax law (LGPD Art. 7, II; GDPR Art. 6(1)(c)) and performing our contract with you (LGPD Art. 7, V; GDPR Art. 6(1)(b)).

Accounts

An account is optional (except that the nota fiscal details of a payment in reais create one). To sign in, you give an email address and we email you a 6-digit code through our email provider, Resend; the code works for 10 minutes and is never stored in readable form. For your account we keep that address, the CPF or CNPJ you give for nota fiscal, the language you last used and when you last signed in, and which slots are yours. Your dashboard shows each slot’s statistics as anonymous totals (viewers and link clicks). Legal basis: performing our contract with you (LGPD Art. 7, V; GDPR Art. 6(1)(b)).

Contact form

When you write to us, we store your name (optional), your email address, the topic, your message and the language of the page. We use them only to answer you and to handle your request, including requests about your data. Legal basis: our legitimate interest in answering you, and our legal obligations when you exercise your rights (LGPD Art. 7, II and IX; GDPR Art. 6(1)(c) and (f)).

Preferences on your device

If you choose a language, we remember it in a cookie named “lang” for one year. If you turn video sound on, your browser remembers that choice in its local storage. Neither identifies you, and both exist only because you asked for them, so they need no consent. Our moderators also get short-lived cookies needed to sign in to the admin area. When you sign in to your account, a cookie named “v30_session” keeps you signed in for up to 30 days, or until you sign out; it is strictly necessary for the account you asked for.

4. Videos from YouTube and Vimeo

When a slot with a video is on air, your browser loads the video player directly from YouTube (Google) or Vimeo. We use YouTube’s privacy-enhanced mode (youtube-nocookie.com) and Vimeo’s “do not track” setting, but these providers still receive your IP address and browser details when the player loads, under their own privacy policies.

5. Who receives your data

We share personal data only with providers that help us run the service, and only as needed:

• Cloudflare: hosting, database, image storage, network security and sign-in for our team (as our processor).
• Stripe: payments and refunds (as an independent controller of your payment data).
• Resend: sending the sign-in codes you ask for by email (as our processor).
• Brazilian tax authorities: the details on each nota fiscal we issue, as tax law requires.
• Google (YouTube) and Vimeo: playing the videos buyers choose (see section 4).

We may also disclose data when the law requires it, for example to comply with a court order, or to defend our rights in legal proceedings.

6. International transfers

Our providers operate worldwide, so your data may be processed outside your country, including in the United States. Where the law requires, we rely on safeguards such as the European Commission’s and the ANPD’s standard contractual clauses, or the EU–US Data Privacy Framework for certified providers.

7. How long we keep it

• Connection data: processed by Cloudflare only for as long as needed to deliver and protect the site, under its data processing terms.
• Audience identifiers: they change every day and only feed that day’s totals.
• Contact messages: deleted when your request has been handled, and automatically after at most 12 months.
• Payment records: for as long as tax and accounting laws require (in Brazil, generally five years).
• Nota fiscal details (CPF or CNPJ and email address): deleted automatically 6 years after you send them, the period Brazilian tax law requires us to keep tax records (five years from the year after the nota fiscal is issued).
• Accounts (email address, CPF or CNPJ): kept while your account exists. You can change the address or delete the account yourself under “My account” (we email a code to confirm it’s you), or write to us through the contact form. Deleting it erases the address and the CPF or CNPJ at once and signs you out everywhere; slots you bought still air, and nota fiscal details already given stay for the tax period above.
• Slot content: kept as the record of what we broadcast, for as long as needed to handle reports, disputes and legal requests. An image is deleted when its slot is taken down.

8. Your rights

Under the LGPD (Art. 18), the GDPR (Arts. 15–22) and similar laws, you can ask us to:

• confirm whether we process your data, and give you access to it;
• correct data that is incomplete, inaccurate or out of date;
• delete, anonymise or block data that is unnecessary or processed unlawfully, or delete it in other cases the law allows;
• restrict how we use your data, or object to processing based on our legitimate interests;
• give you your data in a portable format;
• tell you who we share it with, and the consequences of not providing it.

Use the contact form and choose “Privacy and personal data”. We may ask you to confirm the email address the request is about. We answer within 15 days, free of charge.

You can also complain to a data protection authority: in Brazil, the ANPD (gov.br/anpd); in the European Union, the authority of your country, such as the AEPD in Spain (aepd.es).

9. Security

The site is served only over encrypted connections, with strict security headers. Card details never reach our systems. Our admin area is protected by single sign-on, our logs contain no personal data, and we keep as little data as the service needs.

10. Children

vitrine30 is not directed at children, and only adults can buy slots. We do not knowingly collect children’s personal data. If you think a child has sent us personal data, contact us and we will delete it.

11. Changes to this policy

We update this policy when what we do with data changes. The date at the top shows the current version, and we will highlight significant changes on the site.