Privacy policy

1. Controller and data protection officer

This Privacy Policy describes the processing of personal data carried out within the Cinble platform, hereinafter the Platform, and on this website, whose controller is Cinble, reachable at cinble.com.

The officer responsible for the processing of personal data may be contacted at privacy@cinble.com.

This Policy observes Brazilian Law no. 13.709/2018, the General Personal Data Protection Law (LGPD), and forms part of the Platform's Terms of Use.

2. Personal data processed

2.1 Data provided through the waitlist

The Platform is not yet open to the general public. On this website, the sole collection of personal data occurs through the waitlist form, which gathers the name, the email address and the professional information voluntarily supplied by the data subject. The form is hosted by a third party supplier acting in the capacity of processor, and the data is used exclusively to communicate the opening of access and matters related to it.

Registration on the waitlist is optional and may be withdrawn at any time upon a request addressed to privacy@cinble.com.

2.2 Data provided by the data subject on the Platform

• Name, email address and password, for the constitution and protection of the account.
• Company name and, optionally, its logo.
• Profile picture, where uploaded by the data subject.
• Content submitted through the contact form.

2.3 Data originating from advertising accounts

Upon authorization granted by the data subject within the respective platform, Cinble receives an access token and begins to collect, in an automated and periodic manner:

• The identifiers and names of accounts and campaigns.
• Campaign status.
• Aggregated performance metrics, comprising spend, impressions, clicks, conversions and their breakdowns by date, device and the further dimensions made available by the source platform.

2.4 Data generated by use

• Application access logs, comprising IP address, date and time, retained in compliance with article 15 of Brazilian Law no. 12.965/2014.
• Session identifier, for the maintenance of authentication and the enforcement of a single session per account.

3. Purposes and legal bases

• Performance of a contract, or preliminary steps taken at the request of the data subject (art. 7, V): registration on the waitlist, constitution and maintenance of the account, synchronization of campaigns and generation of dashboards, reports and analyses.
• Compliance with a legal or regulatory obligation (art. 7, II): retention of access logs and tax records.
• Legitimate interest (art. 7, IX): information security, prevention of fraud and abuse, and improvement of the service from aggregated data, subject to a balancing test and to the rights of the data subject.
• Consent (art. 7, I): communications not necessary to the provision of the service, revocable at any time.

4. Processing by artificial intelligence

The analyses made available by the Platform are generated by an artificial intelligence model supplied by a third party acting in the capacity of processor. For that purpose, only aggregated performance data is transmitted: campaign name and status, reference period, spend, impressions, clicks and conversions.

No end customer personal data, credentials, access tokens or information capable of identifying a natural person is transmitted. The processor is contractually bound to handle the data solely for the purpose of returning the analysis and is prohibited from using it for model training.

5. Sharing

Sharing observes the principle of necessity and extends only to the agents that carry out part of the service:

• Advertising platforms: Google, Meta, TikTok and LinkedIn, for the authentication of the data subject and the reading of the authorized campaigns.
• Artificial intelligence supplier: under the terms of clause 4.
• Form supplier: collection and custody of the waitlist registrations.
• Infrastructure and storage suppliers: hosting of the website, the application, the database and the files uploaded by the data subject.
• Email supplier: delivery of transactional messages.
• Payment processor: subscription billing. Cinble does not store credit card data.
• Public authorities: under a court order or legal obligation.

There is no sale of personal data and no assignment of it to third party advertising.

6. International transfer

Some of the processors listed in clause 5 are established outside Brazil, notably in the United States of America. International transfer observes the grounds set out in article 33 of Law no. 13.709/2018, by means of specific contractual clauses ensuring a degree of protection compatible with Brazilian law.

7. Retention periods

• Waitlist registrations: until the opening of access, or until the data subject requests removal.
• Registration data: for the term of the account.
• Campaign metrics: for the history period provided by the plan engaged.
• Application access logs: 6 months, under article 15 of Law no. 12.965/2014.
• Tax records: for the period established by applicable legislation.
• An account suspended for non payment: up to 90 days, counted from the start of the suspension.

Once the account is closed, the data is deleted or anonymized, save for the cases of mandatory retention provided by law.

8. Security measures

• Encryption of all traffic in transit.
• Encrypted storage of the access tokens for the advertising platforms.
• Storage of passwords exclusively in the form of a cryptographic hash.
• Availability of two factor authentication to every account.
• Logical segregation of data, so that each user reaches only the information of the organization to which they are linked.

Cinble adopts the technical and administrative measures provided by article 46 of Law no. 13.709/2018, without absolute inviolability being capable of assurance. Upon a security incident carrying relevant risk, the data subject and the Brazilian National Data Protection Authority are notified within a reasonable period, under article 48.

9. Rights of the data subject

Under article 18 of Law no. 13.709/2018, the data subject is assured the right to request:

• Confirmation of the existence of processing, and access to the data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law.
• Portability to another supplier, and information about the entities with which data has been shared.
• Withdrawal of consent and deletion of data processed on that legal basis.

Requests are to be addressed to privacy@cinble.com and are answered within 15 days.

10. Revocation of access and deletion of data

• Removal from the waitlist: upon a request addressed to privacy@cinble.com.
• Disconnecting a platform: through the Connections area, by removing the advertising account, in which case the token is discarded immediately and synchronization ceases.
• Revocation at the source: through the security or connected apps settings of the respective platform.
• Deletion of the account: upon request addressed to privacy@cinble.com, completed within 30 days.

11. Cookies

Only strictly necessary cookies are used, meaning those intended for the maintenance of authentication, the storage of the language preference and the protection of forms against forged requests. No advertising cookies and no third party tracking technologies for profiling purposes are used.

12. Minors

The Platform is intended for professional use and is not directed at anyone under 18. Data concerning children or adolescents is not knowingly collected.

13. Amendment of this Policy

This Policy may be amended at any time. A relevant amendment is announced by email or by notice on the Platform before it takes effect. The date shown at the head of the document records the last update.

14. Contact

Matters concerning this Policy are to be addressed to privacy@cinble.com. General matters are to be addressed to hello@cinble.com.