This Policy explains which personal data SpotLinkr processes, what for, who it is shared with and how you exercise your rights, under Brazil's General Data Protection Law (Law No. 13,709/2018, “LGPD”).
1. Who is responsible
SpotLinkr is run by ALTF4 Desenvolvimento e Consultoria Ltda – EPP, CNPJ 42.376.604/0001-87, headquartered at R. Dr. Pedro Lúcio, 70, Jd. Universitário, Marília/SP, CEP 17526-240, Brazil (“SpotLinkr”, “we”).
For any privacy matter, including reaching our data protection officer (DPO), write to dev.altf4@gmail.com.
Two different roles
- Controller of the data of people who create a SpotLinkr account, who write to us through this site's contact form and who browse www.spotlinkr.com.
- Processor of the data of visitors to the sites our customers publish (for example yourname.spotlinkr.com or a domain of their own). On those sites, the customer who owns the site decides what is collected and why, and is the controller; we process that data on their behalf and following their instructions (see the Terms of Use).
2. What data we process
Account
- E-mail and password (we only keep an encrypted version of the password, never the password itself).
- If you sign in with Google: your e-mail and an identifier for your Google account. We don't receive your Google password.
- The language chosen for the dashboard and the e-mails.
- The record of your acceptance of these documents: the version, the date, and the IP address and browser used.
- Dates of e-mail confirmation, password recovery and, if any, the request to delete the account.
Site content
The texts, photos, posts, events, products, testimonials, social links and contact details you publish on your site. You decide what goes there; don't publish other people's data without a legal basis to do so.
Contact forms
The name, e-mail and message of whoever writes through a site's contact form (this one included). The message is available to the site's owner in the dashboard.
Visit statistics
To show each site's owner how many visits it gets, we record the page viewed, the referring page, the browser (user agent), the approximate city and country and pseudonymised identifiers (a hash of the IP address and of the session; we don't store the IP itself). To find the city and country, the IP is looked up on the ip-api.com service at the time of the visit. Search engine robots are ignored.
Payments
When a site sells products through SpotLinkr, the payment is made on Mercado Pago. We receive the buyer's e-mail, the amount and the payment status from it, to deliver what was bought. We have no access to card details.
3. What for, and on which legal basis
- Providing the service (creating and keeping the account, publishing the sites, sending account e-mails, generating the first version of the site and translations with artificial intelligence): performance of the contract (LGPD art. 7, V).
- Visit statistics, security and preventing fraud and abuse: legitimate interest (art. 7, IX), always with pseudonymised data and the minimum needed.
- Google Analytics on the sites that set it up: the visitor's consent (art. 7, I), asked in the cookie notice.
- Keeping records required by law and defending rights: legal obligation and the regular exercise of rights (art. 7, II and VI).
We don't sell personal data and don't use it for advertising.
4. Who we share it with
Only the providers the service needs to work, who process the data on our behalf:
- Heroku (Salesforce): hosting of the application and the database, in the United States.
- Cloudflare: DNS, certificates and protection for the sites' own domains.
- Anthropic: the artificial intelligence that builds the first version of the site and the translations. It gets the questionnaire's answers and the texts to translate, not your password.
- ip-api.com: approximate location (city and country) from the visit's IP.
- Mercado Pago: payments, on the sites that sell products.
- GoDaddy: sending the platform's e-mails.
- Google: fonts, signing in with Google for those who choose it and, only on the sites that set it up and with your consent, Google Analytics.
We may also provide data to authorities when the law or a court order requires it.
International transfer
Several of these providers are outside Brazil, mainly in the United States. For these transfers we require data protection safeguards compatible with the LGPD, such as data protection contract clauses (art. 33).
5. Cookies
- Essential: the session cookie (keeps you signed in and protects the forms) and, if you tick “remember me”, the cookie that keeps you signed in for a few weeks. The service doesn't work without them, so they don't ask for consent.
- Cookie preference: keeps your choice in the cookie notice for 6 months.
- Google Analytics (optional): only on the sites whose owner set it up, and only after you click “Accept” in the cookie notice. You can change your mind at any time with the site's cookie preferences button.
You can also delete or block cookies in your browser's settings.
6. How long we keep it
- Account and site content: while the account exists.
- Visit statistics and contact messages: while the site exists.
- Acceptance records: while the account exists.
- Application access logs: when kept, for the 6 months required by Brazil's Internet Civil Framework (Law No. 12,965/2014, art. 15).
- Backups: database backups are replaced periodically; deleted data may remain in them for a limited time, until they rotate, without being used.
7. Deleting your account
You can delete your account at any time under My account, in the dashboard. It works like this:
- Right away, the sites you alone own go offline and you lose access to the sites you share with others. The data is blocked: neither shown nor used.
- For 90 days you can change your mind by signing in and clicking “Cancel deletion”. We e-mail you a week before the period ends.
- Once it ends, the account, the sites you alone own and all their content, statistics and messages are deleted for good, and their own domains are disconnected.
Financial records of payments stay with Mercado Pago, under its own policy.
8. Your rights
Under the LGPD (art. 18), you may ask for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of data that is unnecessary or processed against the law;
- deletion of the data processed with your consent, and withdrawal of that consent;
- information on who we share your data with;
- review of decisions made solely on automated processing.
Send the request to dev.altf4@gmail.com, from your account's e-mail. We answer within 15 days. If you are a visitor of a site published on SpotLinkr, first contact that site's owner, who is the controller; we'll help them handle the request.
You can also complain to Brazil's National Data Protection Authority (ANPD), at gov.br/anpd.
9. Security
We use encrypted connections (HTTPS) on every site, encrypted passwords, pseudonymised identifiers in the statistics and restricted access to the data by our team. If a security incident that may cause relevant risk or harm happens, we'll notify you and the ANPD, as the law requires.
10. Children and teenagers
SpotLinkr is not meant for people under 18, who must not create an account.
11. Changes to this Policy
When this Policy changes in a relevant way, we'll let you know in the dashboard and ask you to accept it again before you keep using the account. The date of the last update is at the top of this page.