1. Who handles your data
ValoraZap is the data controller for personal data handled on the platform. Questions: suporte@valorazap.com.br.
2. What data we handle
- Email, phone, name, company, tax id and address
- Customer name and phone, and quote content, written by you
- The text you send to the AI
- The public link and the quote status
- Invoices, processed by Stripe
- A device fingerprint (truncated IP, browser, language), stored only as a hash, to stop abusive account creation
- Activity log (date, IP, event) for security and support
We do not handle card numbers or CVV. Your password is stored hashed.
3. Why we use it
The main legal basis is performance of the contract, not consent: without an email there is no account, and without a quote there is no service.
- Performance of the contract — creating the account and issuing the quote
- Your instructions — handling the text you wrote, including sending it to the AI
- Legal obligation — keeping invoices
- Legitimate interest — preventing abuse and providing support
4. Artificial intelligence
The text you write in the generator is sent to Google's Gemini to be structured.
Do not write end-customer personal data: it would be shared with Google.
5. Sub-processors and international transfers
- Supabase — database and authentication
- Stripe — payments
- Resend — email delivery
- Google (Gemini) — text structuring
6. How long we keep it
- Quotes and clients — until you delete them
- Invoices — 5 years, by legal obligation
- Email log — up to 12 months
- Abuse counter — 30 days from last use
- After you delete your account — deleted or anonymised within 30 days
7. Your rights
You can ask for confirmation, access, correction, anonymisation, blocking, deletion, portability, withdrawal of consent where applicable, and information about sharing.
We reply within 15 days, free of charge, unless the request is manifestly excessive or repeated. You can complain to the data protection authority.
8. Sharing and the public link
We do not sell personal data and do not share it for advertising. The quote recipient sees the quote and the contact details of whoever issued it, through the public link.
The link has a random 64-character code that is impractical to guess. Even so, do not put in the quote anything you would not want the recipient to see.
9. Cookies and security
We only use what is essential: keeping you signed in and your language preference. No tracking or advertising cookies. The draft quote stays on your device until you save it.
Passwords are hashed. In the database, each user can only read and write their own row. Everything travels encrypted and payment events are signature-verified.