Privacy Policy

01 Who controls your data

The controller of the personal data processed through the Services is Invictus Company Ltda, registered in Brazil under CNPJ No. 55.766.823/0001-14, headquartered in Dores do Indaiá/MG, Brazil. Questions, requests and complaints about privacy can be sent at any time to contato@invictuscompany.com.br.

As a small-scale processing agent (a micro-enterprise) under Resolution CD/ANPD No. 2/2022, Invictus is exempt from appointing a data protection officer. The address above is our official channel for data subjects and is handled directly by the responsible team.

02 Who this policy applies to

This policy covers the website and the apps, systems and other digital products that Invictus publishes and operates under its own name, including those distributed through the App Store (Apple) and Google Play (Google).

It does not apply to systems, websites and apps that Invictus builds or operates for clients. In those projects, the client is the data controller and Invictus acts as a processor, handling data only according to the client’s instructions and the applicable contract; the client’s own privacy policy applies.

Each Invictus app discloses the types of data it actually processes on its App Store page (“App Privacy”) and on Google Play (“Data safety”). App-specific rules, when they exist, are presented in a supplement to this policy within the app itself.

03 What data we process

We only process the data needed for each purpose. Depending on how you interact with the Services, this may include:

• Data you send us through the contact form or by email: name, email address, company (optional), subject and message content, plus the approximate country the message was sent from (derived from the IP address).
• Technical access data: IP address, date and time, pages visited and browser and operating system type, processed by our infrastructure to deliver the Services, protect them against abuse and comply with legal obligations.
• Preferences stored on your own device: your chosen language and the website’s animation level (see “Cookies and on-device storage”).
• In apps that offer an account: name, email address and login credentials — passwords are stored in encrypted form, never in readable text — and the information and content you add yourself.
• In apps, depending on each app’s features: app and device identifiers (for example, the token used to send notifications), diagnostic data (crash and performance reports) and feature usage data.
• Device features — such as location, camera, photos, microphone or contacts — only when a feature needs them and after you grant permission in your device’s system. You can revoke the permission at any time in your device settings.
• In-app purchases and subscriptions are processed by Apple or Google: Invictus only receives the confirmation and status of the purchase or subscription, never your card details.

We do not process sensitive personal data (such as health data, biometrics, racial or ethnic origin, religious beliefs or political opinions), unless a specific feature requires it — and, in that case, only with your specific and prominent consent.

Invictus does not sell personal data, does not use it for targeted advertising and does not track you across other companies’ apps and websites.

04 How we use data

• To reply to your messages, understand your needs and send the proposals and quotes you request.
• To provide contracted services and operate the apps, including sign-up, login, features, notifications and support.
• To protect the Services against fraud, spam, abuse and unauthorized access — for example, by limiting the number of contact form submissions per IP address.
• To diagnose failures and improve the stability, performance and usability of the Services.
• To remember your preferences, such as language and animations.
• To comply with legal and regulatory obligations and to exercise rights in judicial, administrative or arbitration proceedings.
• To send communications about the Services. Marketing communications are only sent with your consent and can be cancelled at any time.

We do not make decisions based solely on automated processing that produce legal effects for you or significantly affect your interests.

05 Legal bases

Each processing activity relies on one of the legal bases in Article 7 of the LGPD:

• Performance of a contract or of preliminary procedures at the data subject’s request (Art. 7, V): replying to contact and quote requests and providing the Services, including the use of the apps.
• Legitimate interest (Art. 7, IX, and Art. 10): security, abuse prevention, failure diagnosis and improvement of the Services, always respecting your legitimate expectations and your fundamental rights and freedoms.
• Compliance with a legal or regulatory obligation (Art. 7, II): for example, the retention of access logs required by the Brazilian Internet Civil Framework and compliance with tax obligations.
• Regular exercise of rights (Art. 7, VI): defense in judicial, administrative or arbitration proceedings.
• Consent (Art. 7, I): when a feature depends on it, such as optional device permissions or marketing communications. Consent can be withdrawn at any time, without affecting processing carried out before the withdrawal.

06 Who we share data with

We only share personal data when necessary and with partners committed to protecting it at a level equivalent to this policy:

• Infrastructure, hosting and security providers, such as Cloudflare, Inc., which hosts the website, protects it against attacks and delivers contact form messages.
• Our corporate email provider, where contact messages are received and stored.
• App stores (Apple and Google), which distribute the apps and process purchases and subscriptions under their own privacy policies.
• Providers used by a specific app, such as notification, cloud storage or crash reporting services, as disclosed on the app’s store page.
• Public authorities, when there is a legal obligation, a court order or a request from a competent authority.
• A successor company, in the event of a corporate reorganization, merger or acquisition, which will be bound by this policy.

Our processors may only process data for the purposes defined by Invictus and are subject to contractual confidentiality and security obligations.

07 International data transfers

Some of our providers, such as Cloudflare, operate networks and servers in several countries, including the United States. Your data may therefore be processed outside Brazil.

For these transfers, we adopt the safeguards set out in Article 33 of the LGPD and in the regulations of the Brazilian National Data Protection Authority (ANPD), such as contractual clauses ensuring a level of protection consistent with Brazilian law.

08 How long we keep data

We only keep data for as long as needed for the purposes of this policy or for the period required by law:

• Contact messages: for as long as needed to handle your request and, if you hire us, for the duration of the business relationship. Without a contract, they are deleted within 2 (two) years of the last contact.
• App account data: while the account is active. After the account is deleted, the data is erased or anonymized within 30 (thirty) days, except as described below.
• Internet application access logs (IP address, date and time): for the 6 (six) months required by Article 15 of the Brazilian Internet Civil Framework.
• Data needed to comply with legal, tax or contractual obligations, or to exercise rights: for the periods set by applicable law.
• Preferences stored on your device: until you delete them or they expire.

At the end of these periods, data is securely deleted or anonymized. Backups are overwritten in regular backup cycles.

09 Cookies and on-device storage

The website only uses the storage strictly necessary to work and to remember your choices:

• inv_locale (cookie and local storage, valid for 1 year): stores the language chosen in the language switcher, so the website opens in your language on future visits.
• inv_motion (local storage, until deleted): stores your choice between full and reduced animations.
• Cloudflare security cookies (such as __cf_bm and cf_clearance), which may be set to tell people and bots apart and to protect the website against attacks.

The website does not use advertising, tracking or analytics cookies. You can delete cookies and browsing data at any time in your browser settings; the website keeps working, it just won’t remember your preferences.

10 Your rights

Under Article 18 of the LGPD, you may request at any time, free of charge:

• confirmation that we process your data and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
• portability of your data to another provider, subject to commercial and industrial secrets;
• deletion of data processed based on your consent;
• information about the public and private entities with which we share your data;
• information about the possibility of not giving consent and the consequences of refusing;
• withdrawal of consent;
• objection to processing based on other legal grounds, in case of non-compliance with the LGPD;
• review of decisions made solely on the basis of automated processing (Article 20 of the LGPD).

To exercise your rights, write to contato@invictuscompany.com.br, preferably from the email address used to sign up or contact us. We may ask for additional information to confirm your identity and protect your data. We reply within 15 (fifteen) days.

If you believe your request has not been addressed, you may file a complaint with the Brazilian National Data Protection Authority (www.gov.br/anpd (opens in a new tab)) and with consumer protection bodies.

11 How to delete your data or your account

You can request the deletion of your personal data — and of your account, in apps that offer one — at any time, without reinstalling any app:

• In apps with an account: use the “Delete account” option in the app’s settings.
• By email, for any of the Services: send a message to contato@invictuscompany.com.br with the subject “Data deletion”, stating the name of the app or service and the email address used to sign up or contact us.
• We will confirm receipt and your identity and complete the deletion within 30 (thirty) days.

We delete your account data and the personal data linked to it, such as your profile, content and preferences. We only keep what the law requires — such as access logs (6 months, Brazilian Internet Civil Framework) and tax records of purchases — and only for the legal period, after which that data is also deleted.

Subscriptions purchased through the App Store or Google Play must be cancelled in the store itself: deleting the app or the account does not automatically cancel an active subscription.

12 Security

We adopt technical and administrative measures to protect data against unauthorized access and against accidental or unlawful destruction, loss, alteration, communication or dissemination — such as encryption in transit (HTTPS), least-privilege access control, credentials kept only on servers and protection against spam and abuse.

No system is completely immune to incidents. If a security incident may cause relevant risk or harm, we will notify the ANPD and the affected data subjects, as required by Article 48 of the LGPD.

13 Children and teenagers

The Services are not directed at children, and we do not knowingly process personal data of anyone under 13. If a parent or guardian finds that a child has sent us data, just write to contato@invictuscompany.com.br and we will delete it.

If an app is intended for children or teenagers, processing will follow Article 14 of the LGPD — with the specific consent of a parent or legal guardian where required — and the app stores’ rules for that audience.

14 Third-party links and services

The Services may contain links to websites or integrations with third-party services, which have their own privacy policies. We recommend reading them; Invictus is not responsible for the privacy practices of third parties.

15 Users outside Brazil

If you access the Services from another country, your data is processed under this policy and Brazilian law. Where the law of your country grants additional rights — such as the European Union’s General Data Protection Regulation (GDPR) — we will handle requests through the same channel: contato@invictuscompany.com.br.

16 Changes to this policy

We may update this policy to reflect changes in the Services or in the law. The version and effective date are shown at the top of this page. Material changes will be announced prominently on the website or in the apps before they take effect and, where the law requires, we will ask for your consent again.

17 Contact

Invictus Company Ltda · CNPJ 55.766.823/0001-14 · Dores do Indaiá/MG, Brazil.

Official channel for privacy matters and data subject requests: contato@invictuscompany.com.br.