Privacy Notice

01Summary

In short: Vertia is a CRM for online stores. We handle your account data on our own behalf, and the data of your store's customers and creators on behalf of your store.

• Who we are. Vertia is a product of VERT TECH TECNOLOGIA E DESENVOLVIMENTO LTDA, Brazilian company registration (CNPJ) 68.582.744/0001-03, headquartered in Porto Alegre, Brazil.
• Two roles. We are the controller of merchant and store-team account data, website visitor data, access logs and creators' global accounts. We are a processor of the data of each store's customers and creators: the store decides how that data is used.
• What we do. We connect your store to its e-commerce platform (Shopify or Nuvemshop), organize customers and orders, send emails and WhatsApp messages on the store's behalf, calculate creator commissions and report results.
• What we never do. We do not sell personal data. We do not use data for third-party advertising or behavioral advertising. We never use WhatsApp content or data received from Shopify to train artificial intelligence. We do not place third-party pixels, cookies or trackers on our website, the dashboard or the store.
• One exception you should know about. Emails sent by stores carry a 1×1 pixel image from the email provider (Amazon Web Services) that records opens. Links in those emails go through the store's own link domain, which records clicks. See Technologies in emails and links.
• Your rights. Email privacidade@usevertia.com. We reply within 15 days. If you are a customer of a store, please contact the store first; if you write to us, we forward your request and help the store respond.
• Deleting data. Step-by-step instructions are in Data deletion and on the Data deletion page.

02Who we are and how to reach us

In short: VERT TECH is responsible. Write to privacidade@usevertia.com about anything related to privacy.

• Company: VERT TECH TECNOLOGIA E DESENVOLVIMENTO LTDA (trading as Vert Tech), a Brazilian limited liability company, CNPJ 68.582.744/0001-03.
• Address: Av. Cristóvão Colombo, 2144, room 408, 3rd floor, Floresta, Porto Alegre, RS, 90560-001, Brazil.
• Product: Vertia. Website usevertia.com, dashboard at app.usevertia.com and the creator portal.
• Data protection officer under Brazilian law (encarregado): Brunno Vert Visani Carvalho, at privacidade@usevertia.com.
• Other contacts: contato@usevertia.com (general), suporte@usevertia.com (support), abuse@usevertia.com (spam and abuse), seguranca@usevertia.com (security vulnerabilities).

03Who decides about each type of data

In short: when the data belongs to you or to someone who uses Vertia directly, we decide and are accountable. When the data belongs to a store's customer or creator, the store decides and we follow its instructions.

As a processor, we use data only to provide the service to the store, under our contract and the Data Processing Agreement. The store sets the purpose and chooses the legal basis. Each store's data is kept separate, and no store can see another store's customers.

04Merchant and store-team account data

In short: we use your account data so you can sign in, run your store in the dashboard and contact us.

What we collect.

• Sign-up: name, email, phone and password. Your password is held only by our authentication service, never in our own tables. If you sign in with Google, Google shares your name and email with us.
• Store: store name, the postal address you provide (it appears in the footer of the store's emails), each team member's role (admin or member) and store settings.
• Preferences: language, date and time format, theme and display density.
• Activity: a record of who did what in the dashboard (for example, who activated an automation or exported a customer), for security and audit purposes.
• Integrations: the access tokens Shopify, Nuvemshop and Meta give us when you connect your store or WhatsApp. They are stored encrypted.
• Address lookup: when you type a Brazilian postal code (CEP), your browser queries BrasilAPI to fill in the address.
• Billing: for Shopify stores, Shopify bills you. We never receive card details.

Why we use it and our legal basis.

Sign-up data is required to use Vertia. Without it we cannot create your account.

05Store customer data

In short: we receive customers, orders and each person's marketing consent from the store's platform, and use them only so the store can run its CRM, send messages and pay creators.

In this section we act as a processor. The store is the controller and chooses the legal basis, usually performance of the purchase contract, consent for marketing, or the store's legitimate interests. We do not intentionally process special categories of data and we ask stores not to record them in notes or tags.

Data from Shopify (API). We request only the access the service needs: reading customers, orders, products and discounts, and creating discounts (creator coupons). Through this we receive:

• Customers: name, email, phone, city, state and country, tags, and email and WhatsApp marketing consent status with its date.
• Orders: items, amounts, discounts, coupon used, payment method, dates, refunds and shipments. The order event as Shopify sends it may include the full shipping and billing address and the IP address and browser used at checkout. We keep this raw record with the store's data so we can reprocess and verify events.
• Abandoned checkouts: contact details, items and recovery link, for cart reminders.
• Products and store branding: products, prices, images, logo and colors, to build emails.
• Privacy requests: Shopify's notices of customer data requests and customer or store deletion requests.

Data from Nuvemshop (API). The same types as above, plus the Brazilian taxpayer number (CPF or CNPJ) when the store collects it. On Nuvemshop, Vertia installs a script in the store's checkout. During checkout it sends us the email address, phone number, marketing opt-in, cart items and cart total, for abandoned-cart reminders, and displays the WhatsApp opt-in checkbox. It stores nothing in the customer's browser and does not collect pages visited, referral source or name. When the purchase is completed with the box ticked, we keep proof of the opt-in: order, phone number, language, wording and version of the opt-in text, and time of purchase.

Data the store gives us directly. Contacts imported from spreadsheets, tags, notes and groups. When importing, the store confirms it has the contacts' consent and states where the list came from. Purchased, rented or scraped lists are prohibited by our Acceptable Use Policy.

Data generated by use. Purchase-based segments (recency, frequency and monetary value), groups, messages sent and their outcome (delivered, bounced, opened, clicked, replied, marked as spam, unsubscribed), and revenue attributed to messages and creators.

Data from Meta (WhatsApp). When a store sends WhatsApp messages through Vertia, Meta tells us the status of each message (sent, delivered, read or failed), customer replies and requests to stop receiving marketing. We also receive the WhatsApp Business account and phone number identifiers, the store's message templates, and the number's quality rating and messaging limit. The WhatsApp Business account and phone number belong to the store.

How we use it. Only to provide the service to the store: organizing customers and orders, building groups, sending the messages the store has scheduled, honoring consents and unsubscribes, measuring results, attributing sales to creator coupons and calculating commissions. The store may also send this data to its own systems by webhook; in that case the store chooses and controls the destination.

Consent per channel. We send marketing email only to people with email consent, and marketing WhatsApp messages only to people with WhatsApp consent. Email consent does not cover WhatsApp, and a new phone number does not inherit the previous number's consent. There are three exceptions, all chosen by the store: an abandoned-cart reminder may be emailed, on the basis of legitimate interests, to people who left their contact details at checkout without opting in to marketing, through a setting that is on by default and that the store can switch off (on WhatsApp, it only goes to people who opted in to the store's WhatsApp messages); notices about the customer's own order (pending payment, status, shipping) are sent without marketing consent and also reach people who unsubscribed from marketing; and nothing is sent to anyone who asked to stop on that channel.

06Creator data

In short: the store registers the creator and decides about the relationship; the creator's global account is our responsibility.

A store's creator (processor). The store records name, email or phone, social media handles, notes and tags, the agreement accepted by click, the coupon, attributed sales, monthly statements, disputes, payments and, if the store chooses, payment receipts. We handle this on the store's behalf so it can manage the partnership and pay commissions. The store chooses the legal basis, usually performance of its agreement with the creator.

The creator's global account (controller). A creator has a single Vertia identity across all stores: display name, email, phone and, when the creator provides them, entity type, Brazilian taxpayer number (CPF or CNPJ), legal name and Pix key. We use this so stores the creator works with can pay them. A store sees tax and payout details only after the creator accepts its agreement, and only the store's admins can see them.

07Website visitors

In short: our website sets no cookies, runs no analytics and calls no third-party services.

The usevertia.com website stores only two preferences in your browser: the language you chose and whether you paused animations. They never leave your device. Fonts are served from our own domain. See the Cookie Policy for details.

When you email us, we use your name, email address and message to reply (LGPD art. 7, IX and V; GDPR art. 6(1)(f) and (b)).

08Access logs

In short: Brazilian law requires us to keep the IP address, date and time of each access for 6 months. We keep them separately and delete them afterwards.

As an internet application provider, VERT TECH keeps access logs for the dashboard and the portal (the account used, IP address, date and time, with time zone) for 6 months, confidentially and in a controlled environment, as required by article 15 of the Brazilian Internet Act (Marco Civil da Internet, Law 12,965/2014). These logs are stored separately, with no link to store customer data, and are deleted when the period ends. We disclose them only under a court order.

Legal basis: legal obligation (LGPD art. 7, II). For individuals in the EU and the UK, our legitimate interest in complying with the law of the country where we are established (GDPR art. 6(1)(f)).

09Technologies in emails and links

In short: store emails record opens through the email provider's pixel and clicks through a link of ours. There are no advertising pixels and no third-party cookies.

• Opens. Each email a store sends through Vertia contains a transparent 1×1 pixel image hosted by Amazon Web Services (Amazon SES) on AWS's tracking domain. When your email program loads the image, AWS records the open and receives the IP address and user agent of the program used to read it. AWS tells us that the email was opened, and when. The event AWS sends us also contains that IP address and user agent; it is stored with the store's events and used only to verify the event. We use opens to show the store open rates for its campaigns and automations. Opens are never used to attribute revenue, because privacy features in email programs can inflate them. If your email program blocks images, no open is recorded.
• Clicks. Links in emails go through the store's own link domain, and links in WhatsApp messages through an address of ours; both record the click and take you straight to the destination, with no third-party shortener or redirect. We store that the person clicked, when, and on which link. We do not store the IP address of the click. The browser's user agent is used on the spot to filter out bots and link previews, and we do not store it.
• Unsubscribe. The unsubscribe link in each email opens a page of ours that applies the opt-out without asking you to sign in.

These measurements are made on behalf of the store, which is the controller. For recipients in the European Union and the United Kingdom, the law may require the store to ask for your consent before measuring opens. See European Economic Area and United Kingdom.

10Automated decisions and artificial intelligence

In short: Vertia groups customers and calculates commissions automatically, but none of this has legal effects on people. We do not use AI on your data.

• Segmentation. Vertia groups a store's customers by purchase history so the store can decide whom to message. This does not decide credit, price, employment or access to services.
• Commissions. Vertia calculates a creator's commission from sales made with the creator's coupon. The store reviews each statement and the creator can dispute it. The store decides the payment.
• Review. Under the LGPD (art. 20), you may ask for a review of decisions made solely by automated processing that affect your interests.
• Artificial intelligence. No Vertia feature processes personal data with AI. WhatsApp message content and data received from Shopify are never used to create, train or improve AI models.

11Sharing and subprocessors

In short: we use vendors to host, process and send. They handle data only for us, under contract. The full list is on the Subprocessors page.

Platforms you connect. Shopify and Nuvemshop are the store's own platforms, chosen by the merchant: they are where the data comes from. Meta (WhatsApp Cloud API) delivers the store's WhatsApp messages through the store's own account, in the United States and other countries where it operates: the WhatsApp Business account belongs to the store, Meta bills the store directly and applies its own rules.

Other cases. We may also disclose data when required by law or court order, to establish or defend legal claims, or in a corporate transaction (merger, acquisition), always with the same level of protection.

Before adding or replacing a subprocessor, we email everyone who asked to receive these notices, 15 days in advance and with a period to object. The Subprocessors page explains how to sign up.

12International transfers

In short: our database and email sending are in São Paulo. Some vendors process data outside Brazil, always under contract and with security measures.

• What leaves Brazil, and why. Technical errors without personal data (Sentry, US); Vertia's notices to your account (Resend, US); hosting technical logs (Vercel, US); stores' WhatsApp messages (Meta); Google sign-in; background jobs (Trigger.dev, US). Transfers last as long as the service is provided and serve only each vendor's purpose described above.
• Brazilian basis. LGPD art. 33. For data we control, the transfer is necessary to perform our contract with you (art. 33, IX, together with art. 7, V). With vendors, we use each vendor's data processing agreement, and we are formalising the ANPD standard contractual clauses (ANPD Resolution 19/2024) with each of them; where each one stands is shown on the Sub-processors page. Brazil recognizes the European Union as adequate (ANPD Resolution 32/2026).
• Transfers from the European Union to Brazil. The European Commission has found that Brazil ensures an adequate level of protection (Decision C(2026) 373 of 26 January 2026). The EU Standard Contractual Clauses (modules 2 and 3) are included in our Data Processing Agreement as a fallback.
• United Kingdom and Switzerland. The UK does not recognize Brazil as adequate. For UK stores we use the UK Addendum to the EU Standard Contractual Clauses (version B1.0). For Switzerland, the Swiss clause in the same agreement.
• Your rights. You may ask for a full copy of the clauses used for the transfer at privacidade@usevertia.com. We reply within 15 days.

13How long we keep data

In short: we keep a store's data while it uses Vertia and delete it within 30 days after it leaves. Some records are kept longer because the law requires it.

On Shopify, the platform asks us to delete store data 48 hours after the app is uninstalled, and we complete deletion within 30 days of uninstall or of the end of the contract. Deleting a customer, at the request of the store or the customer, is completed within 30 days of the request.

14Security

In short: we protect data with encryption in transit, per-store isolation in every table and encrypted tokens. See Security.

• All connections use HTTPS (TLS).
• The database and application functions run in São Paulo.
• Every table enforces per-store isolation in the database itself: one store cannot read another store's data.
• Access tokens for Shopify, Nuvemshop and Meta are encrypted with AES-256-GCM.
• Creator tax details live in a separate table, visible only to the store's admins after the creator accepts.
• Error logging is configured not to receive personal data.
• If an incident affects your store's data, we notify you within 48 hours of becoming aware of it.

To report a vulnerability, email seguranca@usevertia.com.

15Your rights

In short: among other rights, you can find out about, access, correct, port and delete your data. Write to privacidade@usevertia.com and we reply within 15 days, free of charge.

Under the LGPD (art. 18), you have the right to:

1. confirmation that we process your data;
2. access to your data;
3. correction of incomplete, inaccurate or out-of-date data;
4. anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
5. portability of your data to another provider;
6. deletion of data processed with your consent, except as allowed by LGPD art. 16;
7. information about who we have shared your data with;
8. information about the option not to consent and its consequences;
9. withdrawal of consent.

You may also object to processing carried out without consent if it does not comply with the law (art. 18, §2), ask for a review of automated decisions (art. 20) and complain to the Brazilian Data Protection Authority (ANPD) (art. 18, §1).

Under the GDPR and the UK GDPR, you have the right to: access (art. 15), rectification (art. 16), erasure (art. 17), restriction of processing (art. 18), data portability (art. 20), objection, including to direct marketing at any time (art. 21), withdrawal of consent at any time (art. 7(3)) and not to be subject to a decision based solely on automated processing with legal or similarly significant effects (art. 22). You may lodge a complaint with the data protection authority where you live or work, or where the alleged infringement took place (art. 77). UK-specific rules are in European Economic Area and United Kingdom.

How to exercise your rights.

1. Email privacidade@usevertia.com, telling us what you want and the email address of your account.
2. We may ask you to confirm your identity in a way proportionate to the request, usually through your account email.
3. We reply within 15 days. Deletion requests are completed within 30 days.

Machine-readable copy. We provide your data in a structured file (JSON) that other systems can read. Store admins can already download a customer's data in the dashboard, from "More actions" on the customer's page. To receive a full copy of your store's data, ask at suporte@usevertia.com.

If you are a customer of a store. The store decides about your data. Please ask the store first: it can respond through its platform and through Vertia. If you write to us, we forward your request to the store within 2 business days, let you know we have done so and help the store meet its deadline. We do not delete or change a store's data without its instructions, because the data belongs to the store. If the store no longer uses Vertia, its data has already been deleted.

16Received a message from a store through Vertia?

In short: the store sent it. Vertia is the tool the store uses. To stop receiving messages, use the unsubscribe link in the email or reply asking to stop on WhatsApp.

• Who sent it. The store's name appears as the sender. Emails come from the store's own domain and WhatsApp messages from the store's own number. Vertia does not send its own messages to store customers.
• Why you received it. Because you bought from, signed up with or left your contact details at the store. Marketing goes only to people who opted in on that channel. You may also receive notices about your order and, if you left your details at checkout without completing the purchase, a cart reminder.
• How to stop. In email, use the unsubscribe link in the footer: it takes effect immediately, without signing in, and within 2 days at most. On WhatsApp, reply asking to stop or use WhatsApp's own option to stop promotions. The store also honors stop requests made outside WhatsApp.
• Opens and clicks. See Technologies in emails and links.
• Your data. To access, correct or delete it, contact the store. If you cannot reach the store, write to privacidade@usevertia.com with the store's name and your email or phone number. We will forward your request to the store and help it respond.
• Unwanted or abusive messages. Email abuse@usevertia.com with the message you received. We investigate and may suspend the store's sending.

17Data deletion

In short: email privacidade@usevertia.com or uninstall the app. We delete within 30 days and confirm by email.

If you are a merchant.

1. To delete your store's data: uninstall the Vertia app from the apps area of your platform (Shopify or Nuvemshop). Vertia's access to the store ends immediately. Store data is deleted within 30 days of uninstall or of the end of the contract. If your store is not uninstalled through a platform, ask us to end the contract at privacidade@usevertia.com.
2. To delete your sign-in account: email privacidade@usevertia.com from your account email. Uninstalling the app does not delete your sign-in account, which may be linked to other stores.
3. Before you leave: if you want a copy of your store's data, ask at suporte@usevertia.com before uninstalling.

If you are a customer of a store. Ask the store. On Shopify, the store handles your privacy request and the platform notifies us. Or email privacidade@usevertia.com: we forward your request to the store and, on its instructions, delete your data.

If you are a creator. To end your relationship with a store, contact the store. To delete your global account and your tax and payout details, email privacidade@usevertia.com.

If you connected the store's WhatsApp through Meta. Email privacidade@usevertia.com asking us to disconnect WhatsApp and delete the data received from Meta: we delete the access tokens, the account and phone number identifiers and the message records received from Meta. You can also remove Vertia's access in the apps and integrations settings of your Meta account; that stops our access but does not delete what we have already received, so please send the email as well. The WhatsApp Business account and phone number remain yours.

What we delete. The personal data covered by your request, in our systems. Suppliers' technical logs are deleted on each supplier's own retention cycle.

What we keep, and why.

• Dashboard and portal access logs (account, IP address, date and time): 6 months, under the Brazilian Internet Act.
• Tax and billing records: 5 years, until the tax limitation period ends.
• Store orders and commissions: kept without any personal data.
• The platform identifier of a deleted customer: so the person is not re-imported.
• A record of your deletion request: to show we handled it.

Timing and confirmation. We acknowledge your request within 2 business days, complete it within 30 days and email you a confirmation when it is done. If we cannot delete some data, we tell you which data and why.

18European Economic Area and United Kingdom

In short: if you are in the EU, the EEA or the UK, the GDPR or the UK GDPR also protects your data. Before offering the service in those regions, Vertia will appoint local representatives and a data protection officer.

• EU and UK representatives and DPO (GDPR): Vertia will appoint its EU representative (GDPR art. 27), its UK representative (UK GDPR art. 27) and its data protection officer (DPO) before offering the service to customers in the European Economic Area and the United Kingdom, and will publish their names and contact details on this page. Until then, send requests to privacidade@usevertia.com.
• Legal bases: as set out in the tables above. Where we rely on legitimate interests, we balance our interests against your rights; you can ask us for that assessment.
• Timing: we respond within one month, extendable by two further months for complex requests, with notice.
• Complaints in the United Kingdom. Before going to the regulator, you can complain to us at privacidade@usevertia.com. We acknowledge your complaint within 30 days, investigate and tell you the outcome without undue delay. You can also complain to the Information Commission (formerly the ICO).
• Email open pixel. European authorities, such as France's CNIL, consider that measuring email opens to assess campaign performance requires the recipient's consent. Stores that send to Europe are responsible for obtaining that consent.

19United States

In short: we do not sell or share personal data, and we act as a service provider to stores.

• We do not sell or share personal data, including for cross-context behavioral advertising.
• Service provider. For stores subject to US state privacy laws (such as California, Virginia, Colorado, Connecticut and Texas), we act as a service provider or processor: we process data only for the purposes in our contract and do not combine it with data from other sources.
• Categories and third parties (CalOPPA). The categories of data are described above, and third parties are listed in Sharing and subprocessors.
• Correction. To review or correct your data, email privacidade@usevertia.com.
• Do Not Track. We do not track visitors across third-party websites, so our website and dashboard work the same way whether or not your browser sends a "Do Not Track" signal.
• Changes and effective date. The effective date is at the top of this notice, and changes follow Changes to this notice.

20Canada

In short: data about people in Canada is processed in Brazil and the United States, with contractual protection.

• PIPEDA. For Canadian stores, we process data on the store's behalf and the store remains accountable for it. Data is processed outside Canada (Brazil and the United States) and may be accessible to courts and authorities in those countries under their laws.
• Quebec (Law 25). The person in charge of the protection of personal information is our data protection officer, Brunno Vert Visani Carvalho, at privacidade@usevertia.com.
• Complaints. You may complain to the Office of the Privacy Commissioner of Canada and, in Quebec, to the Commission d'accès à l'information.

21Children

In short: Vertia is not for anyone under 18.

Vertia is a service for businesses and adult creators. We do not knowingly collect data from anyone under 18 for merchant or creator accounts. If we learn that this has happened, we delete the data. Store customer data is processed on the store's behalf, and the store is responsible for any processing of minors' data (LGPD art. 14).

22Data protection officer and contact

In short: contact our data protection officer at privacidade@usevertia.com.

• Data protection officer under the LGPD (art. 41): Brunno Vert Visani Carvalho.
• Email: privacidade@usevertia.com. This is also the channel for communications from the ANPD.
• Postal address: VERT TECH TECNOLOGIA E DESENVOLVIMENTO LTDA, Av. Cristóvão Colombo, 2144, room 408, 3rd floor, Floresta, Porto Alegre, RS, 90560-001, Brazil.

23Changes to this notice

In short: we email you before any significant change.

If we change this notice in a significant way, we notify merchants and creators by email and in the dashboard before the change takes effect, and update the effective date at the top. Previous versions are available in the Legal center.

24Company details

In short: Vertia is a brand of VERT TECH.

VERT TECH TECNOLOGIA E DESENVOLVIMENTO LTDA (Vert Tech), a Brazilian limited liability company, CNPJ 68.582.744/0001-03. Av. Cristóvão Colombo, 2144, room 408, 3rd floor, Floresta, Porto Alegre, RS, 90560-001, Brazil. Contact: contato@usevertia.com. Privacy: privacidade@usevertia.com.