Virio Agency Privacy Policy

1. Controller and contact

Latitude Zero Studios LTDA, CNPJ 63.297.891/0001-00, Curitiba/PR, Brazil. Data protection officer and data subject requests: virio@virio.com.br, or the contact form with the Privacy topic.

2. Two roles

We are the controller of the data of people who visit the site, join the waitlist, contact us and create an account (e-mail, name and preferences).

For the data the agency puts in the workspace — clients, contacts, team members, costs, hours, documents and files — the agency is the controller and we are the processor: we handle that data only to provide the service, following the agency's instructions.

3. Data we process

Account: e-mail, name, photo (optional), language, time zone and theme.

Use and security: first and last access of each day per workspace; audit records (what was done, by whom, when, with the old and new values); attempts on public links with the IP turned into a hash (never the raw IP).

Client pages (proposal, contract, minutes, approval, authorization, quotation): name, e-mail, optional document, date and time, IP, browser and document hash of whoever decides.

Waitlist and contact: e-mail, name, agency, team size, interest, topic, message, language and hashed IP.

Agency e-mail communications: recorded consent and an unsubscribe list kept only as a hash of the e-mail.

We do not use tracking or advertising cookies. The browser stores the session, language and chosen workspace locally. Site traffic is measured by Cloudflare Web Analytics, without cookies and in aggregate.

4. Purposes and legal bases

Providing the contracted service and the trial (performance of contract, art. 7, V).

Security, fraud prevention, audit and service improvement (legitimate interest, art. 7, IX, and art. 37).

Waitlist and answering contacts (consent, art. 7, I, which you can withdraw at any time).

Complying with legal and regulatory obligations and exercising rights in proceedings (art. 7, II and VI).

5. Sub-processors

Supabase (database, authentication, file storage and functions; database in the São Paulo region, sa-east-1; company in the USA).

Cloudflare (hosting of the site and the app, delivery network and Web Analytics; global infrastructure).

Resend (sending the sign-in code e-mail; infrastructure in the USA).

Assinafy (only when the agency connects its own account for signatures with stronger validity; document and signer data may be processed outside Brazil).

International transfers follow art. 33 of the LGPD, with the providers' contractual clauses.

6. How long we keep data

Workspace data: while the workspace exists. Deleting the workspace immediately erases all its data, including documents, evidence, consents and files.

Trash: deleted items stay 30 days for restore and are then erased for good.

Access records (first and last access of the day): 400 days.

Audit records: 5 years, erased by a monthly routine; they remain after the workspace is deleted, as proof of security (art. 37 and 46).

Evidence of client acceptance, approval and authorization, and consent records: cannot be changed and are kept while the workspace exists.

Meeting recordings and audio attached by the agency: while the record exists; if deleted, they follow the trash (30 days).

Attempts on public links (hashed IP): 1 day. Unsubscribe links: 400 days. Unsubscribe list (hash of the e-mail): while the workspace exists.

Waitlist: up to 2 years after the last submission, or earlier if you ask to leave. Contact messages: 1 year.

Database provider backups: daily, kept for 7 days.

7. Artificial intelligence

Today Virio Agency does not send workspace data to artificial intelligence services. If that changes, it will be an optional feature, announced beforehand, and the data will not be used to train models.

8. Your rights

You can ask for confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent (art. 18). In the system, the profile can be edited, and the owner exports all data and deletes the workspace. For anything else, write to virio@virio.com.br.

If you are a client or contact of an agency that uses Virio Agency, talk to the agency first, as it is the controller of your data; we help the agency answer the request.

9. Security

Isolation per agency in the database (Row Level Security on every table), permission per module, encryption in transit, secrets kept in the provider's vault, public links stored only as hashes, attempt limits and an audit trail that cannot be changed. If an incident may cause relevant risk or harm, we notify those affected and the Brazilian data protection authority (ANPD).

10. Children

The service is for professional use by people aged 18 or older.

11. Changes

We may update this Policy. The update date is at the top of the page; relevant changes are announced in the system.