Privacy Policy

Who we are

Promoveu is an affiliate-program platform operated by NZK TECNOLOGIA LTDA (“NZK”, “we”). It identifies who referred a customer, follows the conversion, calculates what the affiliate earned and controls the payment of that commission.

Promoveu runs on promoveu.com.br, on app.promoveu.com.br, on affiliate portals at addresses such as company.promoveu.com.br, and on the domains each client company connects to its program.

This policy follows Brazil's General Data Protection Law (Law 13,709/2018, the LGPD). Questions and requests go to [email protected].

Who decides about your data

Promoveu serves companies that run an affiliate program (“client companies”). Our role under the LGPD depends on who you are:

• A client company's team member. We are the controller of your account data, your sign-ins and your use of the dashboard.
• An affiliate. We are the controller of your Promoveu account, which serves every program you join. The data of your participation in each program (your sign-up to the program, links, conversions, commissions and payouts) we process as a processor, on behalf of the company that runs that program, which is its controller.
• A visitor who arrives through a referral link, or a client company's customer. The controller is the company whose site you are on. We are its processor: we record the click and the conversion for it, following its instructions.

When the controller is a client company, contact it first. If you need to, write to us and we will forward your request.

What data we process

Account and sign-up. Name and email of everyone with an account. For affiliates, also: CPF or CNPJ (Brazilian tax ids), the referral code they choose, their acceptance of each program's terms, phone and website or social profile when given, and the answers to the fields each program asks for at sign-up.

Sign-in. Promoveu has no passwords. You sign in through a link sent to your email, valid for 15 minutes and usable once, or with your Google or Apple account. In that case Google or Apple send us an identifier, your name, your email and, when they provide it, your profile picture.

Sessions and security. For each session we keep the IP address, the browser (user agent) and the city and country estimated from the IP at sign-in, with a location database we keep ourselves. A cookie identifies the browser so we can tell you about a sign-in from a new device.

Audit log. Sensitive actions in each client company (for example approving an affiliate, changing a commission rule or marking a payout as paid) are recorded with who did it, when, the browser and the IP.

Referral link clicks. When a visitor reaches a client company's site through an affiliate link, we record the click code, the landing address, the referring page (referrer), the campaign, the browser and a cryptographic digest of the IP (HMAC-SHA256 with a secret key). The click's IP is never stored.

Referred customers and conversions. The client company sends us its own identifier for the customer and, if it chooses, the customer's email and CPF or CNPJ, only to detect self-referral. Of the email we keep only a digest (SHA-256 hash), never the email. For each payment we receive the transaction identifier, the amount, the currency and the event type.

Commissions and payouts. Each affiliate's commissions, adjustments and reversals, and their payouts. To get paid, the affiliate registers a Pix key with the holder's name and tax id; each payout keeps a copy of the destination it used. Pix details are masked in the interface.

Client company branding. The logo and colours of each company's affiliate portal.

Notifications and emails. What we tell you in the app and by email, and your notification preferences.

Usage measurement. Browsing and usage events on the site and in the app, under your consent, described in Cookies. The app's technical logs do not record IP addresses.

What we use the data for

• To provide the service: give access to accounts, record clicks, attribute customers, calculate commissions, prepare and record payouts and send the program's notices. Legal basis: performance of a contract and, for data processed on behalf of client companies, their instructions.
• To protect accounts and money: limit sign-in attempts, warn about new sign-ins, check a Pix receiver, detect self-referral and keep the audit log. Legal basis: legitimate interest.
• To improve the product: measure the use of the site and the app, unless you refuse. Legal basis: legitimate interest, with the option to refuse at any time.
• To meet legal obligations and exercise rights in proceedings.

We do not sell personal data and do not use it for advertising.

Cookies

We use few cookies, each with a purpose:

• Session (affiliate_hub.session_token and helper cookies with the same prefix): keeps you signed in. Necessary.
• Device (affiliate_hub_device): recognises the browser to warn you of a sign-in from a new device. Necessary.
• Consent (analytics_consent): stores your choice about usage measurement. Necessary.
• Language and theme (NEXT_LOCALE, theme): remember the language and appearance you chose. Necessary.
• Referral click (pm_click): set by Promoveu's script on the client company's domain when you arrive through an affiliate link. It holds only the opaque click code, for the period the program set (7 days unless the company changes it). On its own it proves no sale: the company's server confirms the conversion.
• Usage measurement (PostHog's cookie and local storage): browsing and usage events. Session recording is off, and a browser that asks not to be tracked is not measured.

Usage measurement starts on the first visit and can be turned off in the cookie notice or in “Cookie preferences”, in the footer. The choice applies to the site and the app.

Who we share data with

The client company that runs the program: it sees the program's affiliates, clicks, conversions, commissions and payouts. Affiliates see the customers they referred only as “Customer •••” and three characters of an internal code, never the customer's name, email or identifier.

Suppliers that run parts of the service for us, each with only what it needs:

• Cloudflare: network, certificates and client companies' own domains (Cloudflare for SaaS custom hostnames).
• Resend: sending sign-in and notification emails.
• Hookdeck Outpost: delivering the webhooks each client company sets up to receive its program's events.
• PostHog: usage measurement, under your consent.
• Google and Apple: signing in with your account, only if you choose that option.
• AWS S3 or Cloudflare R2: file storage, such as client companies' logos.

The client company's payment provider. When a client company connects its own BrasilCash account to pay by Pix automatically, the Pix key, the holder's name and tax id and the amount go to BrasilCash, which looks the key up in DICT (Brazil's Pix directory) and makes the transfer. In manual mode nothing goes to a provider: the company pays outside Promoveu and marks the payout as paid.

Some of these suppliers process data outside Brazil. In those cases the transfer follows what the LGPD requires of international transfers.

We may also share data when the law or a competent authority requires it.

How long we keep data

• The sign-in link is valid for 15 minutes; a team invitation for 7 days.
• The click cookie lasts the program's period (7 days unless the company changes it).
• In the audit log, the IP is replaced by its cryptographic digest after 90 days. The log itself is kept while the client company exists, because it is the record of what happened to each commission and payout.
• Other data is kept while the account or the program is active and, after that, for as long as the law requires or as needed to exercise rights.

How we protect data

• Each client company's data is isolated: every query is authorised on the server and limited to the session's company.
• API keys are stored only as a digest; the full key is shown once.
• The BrasilCash credentials a company connects are encrypted (AES-256-GCM) and never shown again.
• Pix details are masked, and each payout keeps the exact destination it used.
• All traffic uses HTTPS.

Your rights

The LGPD lets you confirm whether we process your data, access it, correct it, ask for the anonymisation, blocking or deletion of what is unnecessary, ask for portability, learn who we share it with, withdraw a consent and object to a processing.

To exercise any of these rights, write to [email protected]. When the data belongs to a client company's program, we forward the request to it. You may also complain to Brazil's National Data Protection Authority (ANPD).

Changes to this policy

When Promoveu starts collecting, keeping or sharing data differently, this policy changes with it, and so does the “Last updated” date at the top. Use of Promoveu also follows the Terms of Service.

Contact

NZK TECNOLOGIA LTDA, by email at [email protected].