Privacy Policy

1. Who we are

This Privacy Policy is part of Popconvert’s Terms and Conditions of Use and explains how we protect the personal information handled on our platform.

Popconvert LTDA, CNPJ 46.963.610/0001-91, headquartered at Av. Paulista, 2.064 — 14º andar, Bela Vista, São Paulo/SP, CEP 01310-200.

Our data processing complies with the Lei Geral de Proteção de Dados (Brazil’s General Data Protection Law, Law No. 13,709/2018, “LGPD”), the European General Data Protection Regulation (GDPR), the Marco Civil da Internet (Brazil’s Internet Civil Rights Framework, Law No. 12,965/2014) and other applicable rules.

2. Two different roles, and why this matters to you

Popconvert processes personal data in two distinct situations, with different legal responsibilities. Knowing which one applies to you defines whom you should turn to:

2.1. When we are controllers

We are the controllers of the data of those who visit this website, create an account on the platform, subscribe to a plan or contact us. In these cases we decide which data to collect and for what purpose, and we answer directly for that processing.

2.2. When we are processors

When a customer store uses Popconvert to display pop-ups and capture leads, the data of the people who interact with that pop-up belongs to the store. In that case the store is the controller and Popconvert acts as the processor, processing the data only to perform the contract.

If you filled in a pop-up on a store and want to access or delete your data, the request must be addressed to that store. If you contact us, we forward the request to the responsible customer and support the handling of it.

3. Data we collect

3.1. Information you provide to us

• First and last name
• Email
• Country, used to present the interface in the appropriate language
• Phone number, when provided
• Billing data: company, address and CNPJ/CPF (Brazilian tax IDs)
• Payment method for financial transactions

3.2. Information collected automatically

• IP address
• Browser type and language
• Access times
• Accepted cookies
• Referral address (where you came from)

3.3. Geolocation

Collected only with your consent and only while you are browsing the website.

3.4. Data of visitors to our customers’ websites

On websites where the Popconvert tag is installed, we collect, on behalf of the customer:

• Pages visited and links clicked
• Non-sensitive information typed into forms
• Mouse movements
• IP address, device and browser data
• Information about cookies and consents
• When the visitor accepts an offer or pop-up, the data of the fields configured by the customer, usually name, email and phone number

We make three firm commitments about this data:

• It is not shared with third parties without the customer’s explicit consent
• It is not used for advertising or for any monetization model by Popconvert
• We do not carry out profiling or automated decisions about people

4. What we use the data for

• Provide, maintain and improve the platform
• Create and manage accounts, provide support and customer service
• Carry out financial transactions and issue tax documents
• Conduct research and analyses about products and services
• Communicate news, offers and updates
• Prevent fraud, abuse and misuse of the platform
• Comply with the Terms of Use and legal obligations

5. Legal bases

• Performance of a contract: creating your account, providing the service and processing charges
• Compliance with a legal obligation: keeping tax and accounting documents
• Legitimate interest: security, fraud prevention and aggregated usage metrics
• Consent: geolocation and marketing communications, revocable at any time

6. Who we share it with

We share data only with suppliers necessary for operation, and only to the extent necessary. We work exclusively with partners that follow GDPR rules:

• Digital Ocean: infrastructure and hosting
• Stripe: payment and subscription processing
• Vercel: hosting and delivery of this website
• Cloudflare: DNS service for the domain
• Google Analytics (Google), Umami (Umami Cloud) and Microsoft Clarity (Microsoft): usage measurement and session recording of this website, with your consent in the regions where the law requires it (see the Cookie Policy)
• Transactional email services, for service notices
• E-commerce platforms and CRMs: when you connect your store to Popconvert, exclusively to enable the integration you authorized
• Public authorities, when there is a legal obligation or court order

We do not sell personal data, under any circumstances. Aggregated and anonymous data, which does not identify anyone, may be used for analyses.

7. International transfer

Some of the suppliers above operate servers outside Brazil. In these cases the transfer takes place with the safeguards of article 33 of the LGPD and the equivalent GDPR clauses, ensuring a level of protection compatible with Brazilian legislation.

8. Data Processing Agreement (DPA)

Customers who need to formalize data processing can request our DPA (Data Processing Agreement) by email at hi@popconvert.com. We send the document for signature.

9. How long we keep it

• Account data: while the account is active and for the time necessary to meet legal and regulatory obligations
• Tax and billing data: for the period required by tax legislation
• Lead data processed for customers: for as long as the contract lasts; once it ends, it is deleted or returned according to the customer’s instruction, except where there is a legal need for retention

10. Your rights

The LGPD and the GDPR guarantee you the right to:

• Be clearly informed about the use and processing of your data
• Access your data at any time
• Correct incomplete, inaccurate or outdated information
• Request deletion of personal data (right to be forgotten)
• Restrict or object to processing
• Request data portability
• Withdraw consent at any time
• Not be subject to automated decisions, including profiling

To exercise any of these rights, write to hi@popconvert.com. We may ask for additional information to confirm your identity before responding; this is a security measure in your favor.

11. Security

We adopt technical and administrative measures to protect data against loss, unauthorized access, alteration or improper disclosure:

• Multi-factor authentication
• Role-based access restriction and IP-based access restriction
• Server segregation
• Daily backups
• Automated tests and code review before each release
• Encryption in transit (HTTPS/TLS) on all connections

No system is completely immune to incidents. In the event of a data breach, we notify the competent supervisory authority within 72 hours after identification and promptly inform the affected people.

12. Cookies

We use cookies and similar technologies to operate the platform, remember preferences and analyze use of the website. The details are in the Cookie Policy. You can configure your browser to refuse cookies, but some features may not work properly.

13. Links to third parties

Our platform may contain links to third-party websites, which have their own policies. We are not responsible for the privacy practices of those websites.

14. Communications

You can stop receiving promotional emails at any time by clicking “unsubscribe” in the messages we send. Operational and billing notices continue to be sent while your account is active.

15. Data of children and teenagers

The platform is intended for business activities and is not directed at people under 18. We do not intentionally collect data from children and teenagers.

16. Changes to this Policy

We update this policy periodically to reflect legal, technological or operational changes. Relevant changes are communicated by email and the date of the last revision is always at the top of this page.

17. Data Protection Officer (DPO)

Under article 41 of the LGPD, our data protection officer is Felippe Pereira, reachable at hi@popconvert.com.

You may also file a complaint directly with the ANPD (Autoridade Nacional de Proteção de Dados, Brazil’s National Data Protection Authority).