Privacy policy

1. Controller and data protection officer

This Privacy Policy describes the processing of personal data carried out within the Cinble platform, hereinafter the Platform, whose controller is CINBLE TECNOLOGIA LTDA, registered under Brazilian tax ID no. 69.360.079/0001-68, with offices at Rua Visconde do Rio Branco, 1488, conjunto 909, 9º andar, Condomínio Universe Life Square, Bloco Comercial, Centro, Curitiba/PR, CEP 80420-210, hereinafter Cinble.

The officer responsible for the processing of personal data may be contacted at [email protected].

This Policy observes Brazilian Law no. 13.709/2018, the General Personal Data Protection Law (LGPD), and forms part of the Platform's Terms of Use.

2. Personal data processed

2.1 Data provided by the data subject

Name, email address and password, for the constitution and protection of the account.
Company name and, optionally, its logo.
Profile picture, where uploaded by the data subject.
Content submitted through the contact form.

2.2 Data originating from advertising accounts

Upon authorization granted by the data subject within the respective platform, Cinble receives an access token and begins to collect, in an automated and periodic manner:

The identifiers and names of accounts and campaigns.
Campaign status.
Aggregated performance metrics, comprising spend, impressions, clicks, conversions and their breakdowns by date, device and the further dimensions made available by the source platform.

The data subject's Google or Meta access credentials are never requested. Authorization is granted within the platform itself and may be revoked at any time, whether on the Platform or at the source. No contact lists, end customer records or any information capable of individually identifying a person who viewed or interacted with the data subject's advertising are collected.

2.3 Data generated by use

Application access logs, comprising IP address, date and time, retained in compliance with article 15 of Brazilian Law no. 12.965/2014.
Session identifier, for the maintenance of authentication and the enforcement of a single session per account.

3. Purposes and legal bases

Performance of a contract (art. 7, V): constitution and maintenance of the account, synchronization of campaigns and generation of dashboards, reports and analyses.
Compliance with a legal or regulatory obligation (art. 7, II): retention of access logs and tax records.
Legitimate interest (art. 7, IX): information security, prevention of fraud and abuse, and improvement of the service from aggregated data, subject to a balancing test and to the rights of the data subject.
Consent (art. 7, I): communications not necessary to the provision of the service, revocable at any time.

4. Processing by artificial intelligence

The analyses made available by the Platform are generated by an artificial intelligence model supplied by a third party acting in the capacity of processor. For that purpose, only aggregated performance data is transmitted: campaign name and status, reference period, spend, impressions, clicks and conversions.

No end customer personal data, credentials, access tokens or information capable of identifying a natural person is transmitted. The processor is contractually bound to handle the data solely for the purpose of returning the analysis and is prohibited from using it for model training.

5. Sharing

Sharing observes the principle of necessity and extends only to the agents that carry out part of the service:

Google and Meta: authentication of the data subject and reading of the authorized campaigns.
Artificial intelligence supplier: under the terms of clause 4.
Infrastructure and storage suppliers: hosting of the application, the database and the files uploaded by the data subject.
Email supplier: delivery of transactional messages.
Payment processor: subscription billing. Cinble does not store credit card data.
Audience measurement provider: visits to the public pages of the site only, under clause 11.
Public authorities: under a court order or legal obligation.

There is no sale of personal data and no assignment of it to third party advertising.

6. International transfer

Some of the processors listed in clause 5 are established outside Brazil, notably in the United States of America. International transfer observes the grounds set out in article 33 of Law no. 13.709/2018, by means of specific contractual clauses ensuring a degree of protection compatible with Brazilian law.

7. Retention periods

Registration data: for the term of the account.
Campaign metrics: for the history period provided by the plan engaged.
Application access logs: 6 months, under article 15 of Law no. 12.965/2014.
Tax records: for the period established by applicable legislation.
An account suspended for non payment: up to 90 days, counted from the start of the suspension.

Once the account is closed, the data is deleted or anonymized, save for the cases of mandatory retention provided by law.

8. Security measures

Encryption of all traffic in transit.
Encrypted storage of the access tokens for the advertising platforms.
Storage of passwords exclusively in the form of a cryptographic hash.
Availability of two factor authentication to every account.
Logical segregation of data, so that each user reaches only the information of the organization to which they are linked.

Cinble adopts the technical and administrative measures provided by article 46 of Law no. 13.709/2018, without absolute inviolability being capable of assurance. Upon a security incident carrying relevant risk, the data subject and the Brazilian National Data Protection Authority are notified within a reasonable period, under article 48.

9. Rights of the data subject

Under article 18 of Law no. 13.709/2018, the data subject is assured the right to request:

Confirmation of the existence of processing, and access to the data.
Correction of incomplete, inaccurate or outdated data.
Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law.
Portability to another supplier, and information about the entities with which data has been shared.
Withdrawal of consent and deletion of data processed on that legal basis.

Requests are to be addressed to [email protected] and are answered within 15 days.

10. Revocation of access and deletion of data

Disconnecting a platform: through the Connections area, by removing the Google Ads or Meta Ads account, in which case the token is discarded immediately and synchronization ceases.
Revocation at the source: through Google's security settings or Meta's apps settings.
Deletion of the account: upon request addressed to [email protected], completed within 30 days.

11. Cookies and audience measurement

Strictly necessary cookies, used throughout the service: those intended for the maintenance of authentication, the storage of the language preference and the protection of forms against forged requests. Without them the Platform does not work.

Audience measurement, used only on the public pages of the site, outside the authenticated area. Google Analytics is employed to know how many people reach the site and through which pages, on an anonymous identifier. This measurement does not extend to what happens inside the Platform: campaign data, reports and analyses are not shared with that tool.

No advertising cookies, no remarketing and no third party tracking technologies for individual profiling are used. The processing described here rests on the legitimate interest of understanding and improving the reach of the site, and may be blocked in the browser settings without prejudice to the use of the Platform.

12. Minors

The Platform is intended for professional use and is not directed at anyone under 18. Data concerning children or adolescents is not knowingly collected.

13. Amendment of this Policy

This Policy may be amended at any time. A relevant amendment is announced by email or by notice on the Platform before it takes effect. The date shown at the head of the document records the last update.