Privacy policy

1. Who processes your data

The controller of the personal data processed on minisitee is PMTurbo Tecnologia Ltda, CNPJ 54.008.386/0001-07, headquartered in Florianópolis/SC, Brazil.

This policy explains, under the Lei Geral de Proteção de Dados (Brazilian General Data Protection Law — Lei 13.709/2018 — LGPD), what data we collect, why, who we share it with and what you can demand from us.

2. What data we collect

Account data. E-mail address and password (stored only in encrypted form, never in readable text).

Profile data. Display name, chosen address, tagline, bio, city, WhatsApp number, profile photo and page language. You decide what to fill in.

Content you publish. Catalog items, prices, categories, photos, uploaded files (such as a PDF menu), opening hours, business address and social media links.

Subscription data. If you subscribe to a plan, Stripe processes the payment and returns to us only the subscription identifier, its status and the renewal date. We do not receive or store your card number.

Technical data. Access logs (IP address, date, time and action), necessary for security and required by art. 15 of the Marco Civil da Internet (Brazilian Internet Civil Framework), in addition to the cookies described in the Cookie Policy. Through Google Analytics, we also collect data about browsing on this site and in the app: pages viewed, where the visit came from, device type and approximate location, plus two events — the click on buttons that lead to sign-up and the creation of the account. Through Microsoft Clarity, we record how the site and the app are used — clicks, scrolling and mouse movements —; on the presentation page typed text is masked, and in the app the recording may show the content of the screens (passwords are always hidden). Through the Meta Pixel (Instagram and Facebook), we send Meta data about the visit — pages viewed, the click on sign-up buttons and the creation of the account, without what you type in forms — to measure the results of our ads.

We do not collect sensitive data (racial origin, political opinion, religion, health, biometrics) and we ask that you do not publish it on your page either.

3. What is public on your page

This is the most important point of this policy: your page at minisitee.com/youraddress is public. Everything you publish on it — name, photo, tagline, city, WhatsApp number, products, prices and files — can be seen by anyone with the link and indexed by search engines such as Google.

Publish only what you want the world to see. If you prefer not to expose your personal phone number, use a business number. You can edit or remove any item at any time through the dashboard; after removal, search engines may take some time to update what they have already indexed.

4. What we use the data for

We use the data to: create and maintain your account; publish and display your page; allow visitors to contact you; process the subscription and issue charges; provide support; prevent fraud and abuse; comply with legal obligations; improve the product based on aggregate usage; and measure the audience of this site and of the app.

We do not sell your data and we do not use it for third-party advertising.

5. Legal bases

We process data on the basis of: performance of a contract (art. 7, V of the LGPD) to provide the service and charge the subscription; compliance with a legal obligation (art. 7, II) for retention of logs and tax obligations; legitimate interest (art. 7, IX) for security, fraud prevention, product improvement and measurement of the audience of this site and of the app through Google Analytics, Microsoft Clarity and the Meta Pixel; and consent (art. 7, I) when you choose to publish additional information on the page or accept optional communications.

6. Who we share it with

We share only what is necessary, with providers acting as processors:

• Supabase — database, authentication and storage of photos and files.
• Vercel — hosting and delivery of the pages.
• Stripe — processing of subscription payments.
• Google Analytics — audience measurement for this site and the app. Advertising features are turned off.
• Microsoft Clarity — usage analysis for this site and the app, with heatmaps and session recordings. On the presentation page typed text is masked; in the app, passwords are always hidden.
• Meta (Instagram and Facebook) — Meta Pixel, to measure the results of our ads and improve how they are delivered.
• Resend — email delivery of messages sent through this site's contact form (name, email or WhatsApp and message).
• Google Fonts — the font used on this site is loaded from Google's servers, which receive your IP address to deliver the file. No cookie is created by this.

We may also share data to comply with a court order or a request from a competent authority, and in the event of a corporate reorganization, with the obligations of this policy maintained.

7. International transfer

The providers above may process data on servers outside Brazil, including in the United States. In such cases, the transfer takes place on the basis of art. 33 of the LGPD and of the contractual protection clauses adopted by these providers.

8. How long we keep it

Account data and content: for as long as the account exists. After a deletion request, we remove or anonymize it within 30 days, except for what we must keep by legal obligation.

Access logs: 6 months (art. 15 of the Marco Civil da Internet). Tax documents and billing data: 5 years, as required by tax legislation.

9. Your rights

The LGPD (art. 18) guarantees you the right to: confirm that we process your data; access it; correct incomplete or outdated data; request anonymization, blocking or deletion of unnecessary data; request portability; obtain information about who we share it with; revoke consent; and object to processing carried out on the basis of legitimate interest.

You can handle much of this yourself in the dashboard — editing your profile, removing items, closing your account. For other requests, write to [email protected]. We respond within 15 days and may ask for additional information to confirm your identity before fulfilling the request.

10. Security

We use an encrypted connection (HTTPS) throughout the service, passwords stored as hashes, row-level access control in the database (RLS) and restricted administrative access. No system is infallible: if a security incident occurs with relevant risk to your data, we will notify you and the ANPD (Brazilian National Data Protection Authority), as provided by art. 48 of the LGPD.

11. Visitors to your page

When someone opens a page published on minisitee, we do not create an advertising profile or track that person across sites. We record only the technical access described above.

If the visitor taps the WhatsApp button, they are taken to the WhatsApp app — from that point on, Meta's policies apply and the conversation is between them and you. The same applies to external links and maps.

12. Children and adolescents

minisitee is not intended for unaccompanied minors under 18. We do not knowingly collect data from children; if we identify an account in this situation, it will be removed.

13. Changes to this policy

We may update this policy. The date at the top indicates the version in force, and relevant changes are communicated by e-mail or in the dashboard before they take effect.

14. How to contact us

Data Protection Officer (DPO — "Encarregado pelo tratamento de dados pessoais"): [email protected].

You may also file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD — Brazilian National Data Protection Authority), at gov.br/anpd.