Privacy Policy

1. Data controller

The data controller is LUSPIN ASSESSORIA E INTELIGENCIA DIGITAL LTDA, a Brazilian company registered under CNPJ 64.107.013/0001-47. Contact for any privacy matter: info@strawify.com.br.

2. Data we process

• Account: name, email, phone number and password. The password itself is never stored: we keep only a scrypt hash of it. If you sign in with Google or Apple, we receive that account’s identifier and email.
• Marketplace integrations (Mercado Livre and, when you connect them, TikTok Shop and Shopee): your seller account identifier and your operational data, such as orders (amounts, fees, commissions, shipping and status), listings, inventory, returns, advertising and platform charges.
• We do not store your buyers’ personal data. From orders we keep only financial and product fields; buyer name, address, phone number and ID document are not stored.
• Data you enter: product costs, suppliers, purchases, expenses, goals and payment methods. For a payment method we keep only its name and closing/due days, never a card number.
• Mobile app: the device push address and device model, to deliver the alerts you enable.
• Subscription: payments are processed by Stripe. We neither receive nor store card data.
• Technical data: an essential session cookie that keeps you signed in, and a record of sign-in attempts, stored only as hashes, to prevent abuse.

We do not use advertising cookies or any third-party tracking or analytics tools.

3. Purposes and legal bases

• Providing the service: computing profit, inventory, restock and reports, syncing connected marketplaces and sending alerts (LGPD art. 7, V: performance of a contract).
• Keeping accounts secure and preventing fraud and abuse (art. 7, IX: legitimate interest).
• Complying with legal and tax obligations related to the subscription (art. 7, II).
• Optional mobile notifications and alert emails, which you can turn on and off at any time (art. 7, I: consent).

We do not sell data and do not use it for advertising.

4. Who we share data with

We share data only with the providers required to run the service, acting as processors and processing data solely for that purpose:

• Hostinger: server and email hosting, in Brazil.
• Stripe: subscription billing.
• Google and Apple: sign-in, if you choose to use them.
• Expo: delivery of mobile app notifications.
• The marketplaces you connect: API requests are made on your behalf, under the authorization you granted.

We may also disclose data to authorities when required by law or court order.

5. Where data is stored and international transfers

The database and application server are located in Brazil. Some of the providers above (Stripe, Google, Apple and Expo) may process data outside Brazil, mainly in the United States, under the contractual safeguards provided for in LGPD art. 33.

6. Retention

• For as long as your account exists.
• When you disconnect a marketplace, its access credentials are deleted immediately.
• When you request account deletion, there is a 30-day grace period during which you can cancel the request. After it, all account data is permanently deleted.
• Records that the law requires us to keep, such as subscription tax records, are kept for the legal period.

7. Security

All traffic uses HTTPS. Marketplace credentials are encrypted in the database (AES-256-GCM), passwords and sessions are stored only as hashes, the database is not exposed to the internet and integrations request read-only permissions only. Details are in our Information Security Policy.

8. Your rights

Under the LGPD (art. 18), you may at any time request:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data;
• data portability;
• deletion of data processed based on consent, and withdrawal of that consent;
• information about whom we share your data with.

To exercise any of these rights, email info@strawify.com.br. We reply within 15 days. Account deletion can also be requested directly in the dashboard, under Account.

9. Data Protection Officer

Our Data Protection Officer (DPO) can be reached at info@strawify.com.br. You may also file complaints through this channel, without prejudice to your right to contact Brazil’s National Data Protection Authority (ANPD).

10. Audience

Strawify is a tool for businesses and sellers aged 18 or over and is not intended for children or teenagers.

11. Changes

We may update this policy. The effective date is shown at the top of the page, and material changes are announced by email or in the dashboard.