Privacy Policy

Virio is operated by Latitude Zero Studios LTDA, CNPJ 63.297.891/0001-00, headquartered in Curitiba, Paraná, Brazil, the controller of the personal data processed through the Platform (LGPD art. 5, VI).

Data Protection Officer (LGPD art. 41): Rodrigo Santos Kroehn — contato@virio.com.br.

We collect the following personal data:

• Registration data: name, email address, password (stored hashed), company name, tax ID and phone number when provided;
• Usage data: access logs, features used, IP address, browser and device type;
• Profile data: profile picture (optional), display name, city;
• Payment data: processed by Asaas (payments in Brazilian reais) and Stripe (other currencies); we do not store credit card data;
• Contact data: information sent through the contact form or support;
• Connected platform data: described in sections 3 to 3.6.

When you connect a social media account, Virio accesses only the data you authorize on that platform's consent screen, and only to provide the features you use:

• Instagram (via Facebook Login for Business, Meta): professional account information (username, name, profile picture, biography, follower, following and media counts); published media and their metadata; account and media insights (reach, views, saves, shares and aggregated audience demographics); the list of Facebook Pages you manage, used only to identify the linked Instagram account; and publishing content you create and choose to publish or schedule. We also read public data of other professional accounts you choose to monitor (Meta's Business Discovery feature).
• YouTube (Google): channel data, video list and YouTube Analytics metrics. With the additional permissions you grant, Virio also shows thumbnail impressions and click-through rate and channel revenue, lets you reply to and moderate comments in the Inbox, and uploads to your channel the videos you choose to publish (section 3.2). Use of data received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements: https://developers.google.com/terms/api-services-user-data-policy
• LinkedIn (personal profile): basic profile data (identifier, name and photo), publishing the posts and polls you create and authorize on your own profile and, if you grant the analytics permissions, aggregated statistics of your own posts and profile. Company Pages: section 3.1.

What we do not do: we do not sell or rent platform data; we do not use connected account data to train artificial intelligence models; we do not share this data with advertisers or data brokers; we do not use it for targeted advertising or credit assessment. Direct messages are only accessed where this Policy expressly says so (X, section 3.3, and, once enabled, Instagram and Messenger, section 3.4), solely to display them to your team in the Inbox; Virio staff do not read them except at your support request, for security or when required by law. Data from a connected account is shown only to authorized users of the workspace (tenant) that connected it.

AI in the Inbox (sentiment and reply suggestion): on paid plans, Virio sends to the AI provider (Google, paid Gemini API, data not used to train models) only the text of public comments and mentions received on Instagram, Facebook, Threads and Bluesky, to classify sentiment (positive, neutral or negative and topics) and, when someone on your team asks, to suggest a reply based on the brand's knowledge base. A suggestion is never published on its own: a person reviews and sends it. Direct messages (DMs) never go to the AI, and neither does data from LinkedIn, YouTube, TikTok, Pinterest, Google Business Profile, X, Discord or Telegram. We keep only the result (sentiment, up to 3 topics and whether the conversation needs a person), which is deleted together with the message.

Protection: access tokens are stored encrypted (AES-256-GCM) and are never exposed to the browser.

Revocation: you can disconnect the account at any time in Virio, which deletes the access tokens. You can also revoke access directly on the platform: Facebook (Settings > Business Integrations), Instagram (Settings > Apps and websites), Google (https://security.google.com/settings/security/permissions or https://myaccount.google.com/permissions) or LinkedIn (Settings > Data privacy > Permitted services). To request deletion of data received from Meta or any platform, follow the instructions at https://www.virio.com.br/data-deletion

These connections are optional and are made by a workspace owner or admin, one brand at a time. For each one, Virio accesses only what the platform authorizes and only for the features you use (publishing, scheduling and following up on your own posts):

• Telegram (Bot API): you add the Virio bot as an administrator of your channel. We keep the channel's ID, title and @, the posts you publish through Virio and the daily subscriber count. We do not read or keep other people's messages.
• Discord (channel webhook): we keep, encrypted, the webhook of the channel you choose, the channel name and the posts you publish. We do not read the server, its members or messages; there are no metrics.
• Bluesky (AT Protocol OAuth): we keep the account ID (DID), @ and name, the encrypted access tokens, the posts you publish through Virio and public counters of your own account and of those posts (followers, likes, reposts and replies).
• Pinterest (API v5): we store the account identifier, @ handle and name, the encrypted access tokens and, for each Pin published through Virio, its identifier and link. Your boards and your Pins' metrics are fetched from Pinterest when you open the screen and are not stored. If you authorize ads reading (ads:read), the performance of the Pinterest ad accounts you have access to (accounts, campaigns, ad groups, ads and their metrics) is also fetched live to show the report and is not stored. Pinterest campaign management (ads:write: pause, resume and adjust budget) is in preparation and will only work with the approvals and spending cap described in section 3.5; until then, Virio does not create, change or pay for campaigns. Each Pin is chosen and published by you. We do not use Pinterest data for competitor comparisons, benchmarks or AI training.
• TikTok (Login Kit, Content Posting API and Display API): basic profile data (identifier, name, photo and @ handle), profile data (such as bio, profile link and verification badge) and counters (followers, following, likes and videos), with the user.info.basic, user.info.profile and user.info.stats scopes; the list and metrics of your videos (video.list), with a daily series for your own account; direct posting of the videos you create and confirm, with the privacy, interaction and commercial content disclosure settings you choose at that moment (video.publish); and sending the video as a draft to your TikTok inbox, where you finish posting inside the TikTok app (video.upload). This data is used only to operate Virio for you, without building databases or profiles, without comparison with other accounts and without commercial statistics.
• LinkedIn — Company Pages and profile (Community Management API): when you connect a Page you administer: the Page's name, logo and identifier; the posts, polls, images, videos and documents published through Virio; Page, follower (aggregated, including demographics such as seniority, function, company size, industry and country) and post statistics; comments on and mentions of the Page, shown in the Inbox for you to reply to or moderate, with the author identified only by the LinkedIn identifier (the author's name and photo are not stored); and Page notifications by webhook, of which we store only identifiers and the action type, never the text. On your personal profile: publishing on your own profile (w_member_social) and, with r_member_postAnalytics and r_member_profileAnalytics, aggregated statistics of your own posts and profile. We do not use LinkedIn member data for any other purpose, we do not build member profiles and we do not combine it with other sources.
• X (formerly Twitter) — API v2 with OAuth 2.0: posting on your behalf, metrics of your own posts and profile, and mentions and direct messages in the Inbox. Details in section 3.3.
• YouTube — video uploads: when you enable uploads, Virio uploads to your channel the videos you choose to publish (file, title, description, thumbnail and privacy), with the upload permission you granted to Google. Use follows the Google API Services User Data Policy, including the Limited Use requirements. The other YouTube permissions are described in section 3.2.

Purpose and legal basis: performing the contracted service (LGPD art. 7, V) and your consent when connecting each account (art. 7, I). The commitments in section 3 apply here too: we do not sell or share this data with advertisers or data brokers, we do not use it to train AI models and it is shown only to authorized users of the workspace that made the connection. Tokens and webhooks are encrypted (AES-256-GCM).

Each platform is an independent controller of the content you publish on it and processes that data under its own privacy policy: Telegram (https://telegram.org/privacy), Discord (https://discord.com/privacy), Bluesky (https://bsky.social/about/support/privacy-policy), Pinterest (https://policy.pinterest.com/privacy-policy), TikTok (https://www.tiktok.com/legal/privacy-policy), LinkedIn (https://www.linkedin.com/legal/privacy-policy) and X (https://x.com/privacy).

Revocation: disconnect the account in Virio at any time — tokens and webhooks are deleted immediately (on Bluesky and X Virio also revokes access; on Telegram the bot leaves the channel). You can also revoke directly on the platform: Telegram (remove the bot from the channel administrators), Discord (Server Settings > Integrations > Webhooks), Bluesky (account privacy and security settings, sessions and connected apps), Pinterest (account settings, connected apps), TikTok (Settings and privacy > Security > Manage app permissions), LinkedIn (Settings > Data privacy > Permitted services), X (Settings and privacy > Security and account access > Apps and sessions > Connected apps) and Google (https://security.google.com/settings/security/permissions).

Virio's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Policy: https://developers.google.com/terms/api-services-user-data-policy

Limited Use commitments: we use Google data only to provide and improve the user-facing features you use in Virio; we transfer it only as necessary to provide those features, for security purposes, to comply with applicable law, or as part of a merger, acquisition or sale of assets with your prior consent; we do not sell it and we do not use or transfer it for advertising, including targeted advertising, or for credit assessment; no human reads it unless we have your affirmative agreement for specific data, it is necessary for security purposes such as investigating abuse, it is required by law, or it is aggregated and anonymized for internal operations; and we do not use it to develop, improve or train generalized artificial intelligence or machine learning models.

YouTube: Virio uses YouTube API Services. By connecting a YouTube channel to Virio, you agree to the YouTube Terms of Service (https://www.youtube.com/t/terms), and the data is also processed under the Google Privacy Policy (https://policies.google.com/privacy). With the permissions you grant, Virio: reads channel data and the video list (youtube.readonly); shows channel analytics — views, watch time, audience retention, countries, traffic sources and devices — and thumbnail impressions and click-through rate per video and per day, obtained through the YouTube Reporting API (yt-analytics.readonly); shows estimated channel revenue to owners and admins only, fetched live and not stored (yt-analytics-monetary.readonly); lists, replies to and moderates comments on your videos in the Inbox (youtube.force-ssl); and uploads to your channel the videos you choose to publish (youtube.upload). We do not apply artificial intelligence to data obtained from YouTube, we do not compute derived metrics, we do not combine data from channels of different owners and we do not use YouTube data in benchmarks.

Virio does not serve third-party ads; the cookies and local storage we use are described in section 11 (essential ones and, only on the public website and with your consent, Google Analytics statistics, which do not use data from your Google Account). You can revoke Virio's access to your data at any time via the Google security settings page: https://security.google.com/settings/security/permissions (also at https://myaccount.google.com/permissions). After disconnection or revocation, data obtained from YouTube is deleted within 7 days (section 9). Privacy questions: contato@virio.com.br.

Google Ads: when an owner or admin connects Google Ads (openid, email and adwords scopes), Virio accesses the email of the Google Account that made the connection (to identify the connection; shown in full only to owners and admins), the list of accessible ad accounts, names and statuses of campaigns, ad groups and ads, and performance metrics (impressions, clicks, cost and conversions). Purpose: paid media reports for the client's own account and, when you request and approve them, changes to campaigns, always with the approvals and spending cap described in section 3.5. Disconnecting in Virio revokes access at Google and deletes the tokens immediately; you can also revoke at https://myaccount.google.com/permissions

Google Business Profile: when you connect your Business Profile, Virio uses the business.manage permission to list the locations you manage, read and reply to reviews (and delete your replies), publish, list and delete profile posts, and show the daily performance metrics of each location. Reviews, posts and metrics are read live from Google and are not stored by Virio; we keep only each location's identifier and name, and the name is deleted after 30 days without an update.

Google Drive: when you use "Save to Google Drive", Virio uses the drive.file permission to create a "Virio" folder in your Drive and save copies of your content's media in it. Virio only accesses the files and folder it created itself; the rest of your Drive is not read. We keep only the authorization (encrypted tokens) and that folder's identifier; the saved files are yours and remain in your Drive.

Google Analytics 4 and Search Console: when an owner or admin connects a brand's website, Virio uses the read-only analytics.readonly (Google Analytics Data and Admin APIs) and webmasters.readonly (Search Console API) permissions to list the GA4 properties and Search Console sites that account can access and, for the property and site you choose, read aggregated daily numbers: sessions, users, new users, engaged sessions, key events and revenue (total and by channel) from GA4; clicks, impressions, CTR and average position (daily total, top queries and pages of the last 28 days) from Search Console. Purpose: show these numbers in the Site tab of the brand's Analytics. Virio does not read data about individual website visitors, does not change anything in your Google accounts, does not send this data to artificial intelligence services and does not include it in exports, the API, spreadsheets or public reports.

Google Sheets: when you turn on "Copy to Google Sheets", Virio uses the same drive.file permission to create a spreadsheet in the "Virio" folder of your Drive and replace it once a day with Virio's Analytics numbers (YouTube data is not included). Virio only accesses that spreadsheet; the rest of your Drive is not read. When you stop the copy, the spreadsheet stays yours, in your Drive.

Looker Studio: the "Virio" Looker Studio connector fetches your workspace's numbers from Virio with an API key you create and can revoke in Virio. The connector does not read data from your Google Account (it only uses the Apps Script external connection permission, script.external_request, to call Virio's API) and does not include YouTube data.

You can disconnect Business Profile, Google Drive, Google Analytics or Search Console in Virio at any time and revoke access at https://myaccount.google.com/permissions. Access tokens are encrypted and deleted within 7 days after disconnection.

Google data is not sold, is not used for advertising, is not read by humans (except with your consent, for security, to comply with the law, or when aggregated and anonymized for internal operations), is not used to train artificial intelligence models and does not feed benchmarks, niche reports or comparisons with other clients.

When you connect an X account, we store the account identifier, @ handle and name and the encrypted access tokens, to post on your behalf (including threads, polls and media with alt text), read the metrics of your own posts and profile, and show mentions and direct messages in the Inbox.

Mentions and direct messages received from X stay in Virio for at most 24 hours; replies sent by your team, for 30 days. Metrics of posts published through Virio and of your profile are kept while the account is connected and for up to 400 days.

Content deleted on X is removed from Virio within 24 hours. When you disconnect, we revoke access at X and delete the tokens immediately.

We do not use X data to train or fine-tune artificial intelligence models, we do not match it with other records without consent, we do not use it to target ads and we do not use it in aggregated statistics or comparisons between clients.

Virio only replies to mentions and messages when a user on your team sends the reply; we do not send automated or unsolicited messages. X processes the data under its own privacy policy: https://x.com/privacy

The features below are in preparation and depend on Meta's approval. They only become available after that approval and when an owner or admin grants the corresponding permissions on Meta's consent screen; until then, none of this data is collected. Once enabled, Virio may access:

• Instagram comments and mentions (instagram_manage_comments): read, reply to, hide and delete comments on your posts in the Inbox and see mentions of your account.
• Instagram direct messages and Page Messenger (instagram_manage_messages, pages_messaging, pages_manage_metadata): show in the Inbox the conversations people start with your account or Page and send the replies written by your team, within Meta's messaging window (24 hours, or up to 7 days with the human agent tag). We do not send automated, bulk or unsolicited promotional messages.
• Facebook Pages (pages_manage_posts, read_insights, pages_read_user_content, pages_manage_engagement): publish the content you create to the Page, read Page and post metrics, and read, reply to, hide or delete comments.
• Hashtag search (Instagram Public Content Access): recent or top public media with the hashtags you choose to monitor, for PULSE.
• Lead Ads (leads_retrieval): receive in Virio's CRM the data people submit in your ad forms (such as name, email and phone, according to the form you created). For this data, you are the controller and Virio acts as processor (Terms, section 18).
• Meta Ads ("Virio Ads" app: ads_read, ads_management, business_management, pages_manage_ads): reports for your ad accounts and, upon request and approval, boosting posts and managing campaigns, as described in section 3.5.

Retention: the retention period for each of these data types will be published in this section before activation. In any case, when you disconnect, tokens are deleted immediately and account data within 30 days (section 9).

Commitments to Meta: we do not sell, license or purchase Meta Platform Data; we do not use it for advertising outside Meta's technologies; and we delete it if Meta requests.

Data deletion: you can request deletion of data received from Meta at any time by following the instructions at https://www.virio.com.br/data-deletion or by writing to contato@virio.com.br. You can also remove Virio in Facebook (Settings > Business Integrations) or Instagram (Settings > Apps and websites).

The features below are in preparation or in gradual rollout and depend on each platform's approval. They only work after that approval and when an owner or admin connects the account and grants the permissions; until then, none of this data is collected.

• Threads ("Virio Threads" app, Threads login): account identifier, @ handle, name and photo; publishing and deleting the posts you create (text, image, video, carousel and poll); metrics of your posts and account; replies to your posts in the Inbox, to reply to, hide or manage them; and keyword search of public posts for PULSE.
• TikTok for Business (Organic API and Marketing API): for Business accounts you connect: account and video insights, comments in the Inbox (read, reply and hide) and mentions of your account in PULSE; through the Marketing API, campaign reports, Spark Ads and leads from your ad accounts.
• Paid media management (Google Ads, Meta Ads, Pinterest Ads, LinkedIn Ads and TikTok Ads): ad accounts, campaigns, ad sets or groups, ads, budgets and metrics. A change is only executed after a recorded request, approval by another person in your workspace, your client's approval when required, and within the monthly spending cap set per brand; new campaigns are created paused; there is a global pause button and a change log that cannot be altered. Media is billed by the platform directly to your ad account.
• Leads and audiences: leads from ad forms go into Virio's CRM, where you are the controller and Virio is the processor. Custom audiences, when available, only use contacts for which you have provided a legal basis and follow each platform's audience terms.

Retention: ad metrics, up to 37 months; when you disconnect, tokens are deleted immediately and account data within 30 days, as with Google Ads (section 9). Specific retention periods for Threads and TikTok for Business will be published in this section before activation.

Each platform processes data under its own policy: Threads and Meta (https://www.facebook.com/privacy/policy), TikTok (https://www.tiktok.com/legal/privacy-policy), LinkedIn (https://www.linkedin.com/legal/privacy-policy), Pinterest (https://policy.pinterest.com/privacy-policy) and Google (https://policies.google.com/privacy).

Quick reference summary. Details are in sections 3 to 3.5 and 9. "Live" means fetched from the platform when you open the screen, without storage. On every platform: encrypted tokens, nothing is sold, nothing is used to train AI, and you can disconnect in Virio at any time.

• Instagram (Meta): professional profile, posts, metrics and insights, linked Pages and publishing; public profiles you monitor · Use: analysis, publishing and reports · Retention: while connected and 30 days after; public profiles, up to 25 months · Revoke: Instagram > Settings > Apps and websites, or https://www.virio.com.br/data-deletion
• Facebook Pages, Messenger, Lead Ads and Meta Ads (in preparation): see section 3.4 · Use: Inbox, publishing, metrics, leads and paid media · Retention: published before activation · Revoke: Facebook > Settings > Business Integrations
• Threads (in preparation): profile, posts, metrics, replies and keyword search · Use: publishing, Inbox and PULSE · Retention: published before activation · Revoke: disconnect in Virio or in Threads settings
• YouTube (Google): channel, videos, analytics, impressions and CTR, revenue (live), comments and video uploads · Use: reports, Inbox and publishing · Retention: statistics while consent is active (impressions up to 400 days); comments and details, up to 30 days; everything deleted within 7 days after revocation · Revoke: https://security.google.com/settings/security/permissions
• Google Ads: connection email, accounts, campaigns, ad groups, ads and metrics · Use: reports and approved changes · Retention: metrics up to 37 months; account data 30 days after disconnection · Revoke: https://myaccount.google.com/permissions
• Google Business Profile: locations, reviews, posts and metrics (live) · Use: reply to reviews, publish posts and show performance · Retention: only location id and name (name deleted after 30 days without update) · Revoke: https://myaccount.google.com/permissions
• Google Drive: only the files and folder Virio creates (drive.file) · Use: save media copies to your Drive · Retention: authorization and folder id; tokens deleted within 7 days after disconnection · Revoke: https://myaccount.google.com/permissions
• Google Analytics 4 and Search Console: properties and sites you grant access to; aggregated daily numbers of visits, channels, key events, revenue, clicks, impressions, CTR, position and top queries and pages (read-only) · Use: Site tab of Analytics · Retention: while connected, up to 25 months; disconnecting deletes the token and the numbers at once; access revoked at Google and not reconnected is deleted in 7 days · Revoke: https://myaccount.google.com/permissions
• Google Sheets: only the spreadsheet Virio creates (drive.file) · Use: daily copy of the Analytics numbers in your Drive · Retention: spreadsheet identifier while the copy is on; the spreadsheet is yours and stays in your Drive · Revoke: stop the copy in Virio or https://myaccount.google.com/permissions
• TikTok: profile, counters, videos and metrics, direct posting and drafts · Use: publishing and own-account metrics · Retention: while connected; deleted within 30 days after disconnection · Revoke: TikTok > Settings and privacy > Security > Manage app permissions
• TikTok for Business (in preparation): insights, comments, mentions, campaigns and leads · Use: Inbox, PULSE and paid media · Retention: published before activation · Revoke: disconnect in Virio or in TikTok for Business
• LinkedIn: basic profile, Pages, posts, polls, statistics, comments and mentions, own-profile analytics · Use: publishing, Inbox and reports · Retention: comments and mentions, 48 hours; Page activity, 6 months; reports, 1 year; Page deleted within 1 day after disconnection · Revoke: LinkedIn > Settings > Data privacy > Permitted services
• X (formerly Twitter): account, published posts, metrics, mentions and direct messages · Use: publishing, metrics and Inbox · Retention: mentions and messages, 24 hours; replies, 30 days; metrics, up to 400 days · Revoke: X > Settings and privacy > Security and account access > Apps and sessions
• Pinterest: account, published Pins (id and link), boards and metrics (live), ads report (live) · Use: publish Pins and show performance · Retention: no metrics stored; connection deleted within 24 hours after disconnection · Revoke: Pinterest > Settings > Connected apps
• Bluesky: DID, @ handle, name, published posts and public counters · Use: publishing and metrics · Retention: counters, up to 37 months; connection, 30 days after disconnection · Revoke: Bluesky connected apps settings
• Telegram: channel id, title and @ handle, published posts and daily subscribers · Use: publishing and metrics · Retention: subscribers, up to 37 months; connection, 30 days after disconnection · Revoke: remove the bot from the channel administrators
• Discord: channel webhook (encrypted), channel name and posts · Use: publishing · Retention: webhook deleted immediately on disconnection; other data, 30 days · Revoke: Server Settings > Integrations > Webhooks
• Stores and marketplaces (Shopify, Nuvemshop, WooCommerce, Hotmart, Kiwify, Eduzz, Mercado Livre, Magalu): orders, amounts, fees and products, with no buyer personal data · Use: sales panel, CRM and reports · Kept: while connected · Revoke: remove the platform in Analytics → Sales

When you connect a store, marketplace or sales platform (Shopify, Nuvemshop, WooCommerce, Hotmart, Kiwify, Eduzz, Mercado Livre, Magalu, TikTok Shop), Virio receives the orders to show revenue, fees and net revenue in the sales panel: order number, status, amounts, currency, product, dates and campaign parameters (UTM). We do not store buyers' name, tax ID, e-mail, phone or address; when the platform sends the e-mail, we keep only an irreversible code (hash) to match the sale to a contact in your CRM.

On Mercado Livre, we also show in the Inbox the questions asked on your listings (question and answer text, without identifying who asked), sales feedback, product reviews and your account reputation; and, in Mercado Ads, your campaign metrics. Replies are always sent by a person on your team.

On TikTok Shop, with your authorization in Seller Center, Virio reads the orders, the approved returns and refunds, the settled net amount of each order, the product catalog (name, status, price and stock) and the shop's promotions (name, type and dates), and receives real-time notifications signed by TikTok Shop when an order changes status. The buyer's address, phone, tax ID, e-mail and messages are never read. If you remove the authorization on TikTok Shop, Virio immediately deletes the shop's access credentials and keeps only the sales history already imported, which you can delete by removing the connection.

When you connect review sources (App Store, Google Play, iFood, Facebook Page recommendations), Virio shows the reviews in the Inbox and in Analytics → Reviews: rating, text, date, the published reply and, when the store shows it publicly, the author's name.

Purpose and legal basis: performance of the contracted service (art. 7, V of the LGPD). This data is not sold, not used for advertising and not used to train AI models.

We process personal data under the following legal bases of LGPD article 7:

• Performance of a contract: to provide the contracted services (art. 7, V);
• Consent: to connect social media accounts and for marketing communications, when applicable (art. 7, I);
• Legitimate interest: to improve the services, prevent fraud and secure the Platform (art. 7, IX);
• Compliance with legal or regulatory obligations (art. 7, II).
• Regular exercise of rights (art. 7, VI): retention of evidence of content approvals (section 19).

We use personal data to:

• Create and manage accounts and workspaces;
• Provide the contracted services: profile and competitor analysis, mention monitoring (social listening), AI content generation, calendar and scheduled publishing, comments and messages Inbox, reports, paid media management, client content approval, Year in Review and CRM;
• Send service-related notifications;
• Process payments and manage subscriptions;
• Ensure security, audit access and prevent fraud;
• Comply with legal obligations and respond to support requests.

For competitor analysis and brand monitoring, the Platform processes publicly available data: posts from public Instagram professional accounts (via Meta's official API), public YouTube channels and videos (via Google's official API) and headlines that news outlets publish via RSS (title, link and date only). This data does not include private messages or content protected by privacy settings. Once enabled (sections 3.4 and 3.5), also public media found through Instagram hashtag search and public posts found through Threads keyword search, always via official APIs and without scraping.

We share data only with processors required to provide the service, under contractual confidentiality and security obligations:

• Supabase: database, authentication, file storage and server functions, on servers in Brazil (São Paulo);
• Lovable: hosting of the website and web application (no access to the database);
• Google (Gemini API): processing of artificial intelligence features, without using the data to train models;
• Stripe and Asaas: payment and subscription processing;
• Cloudflare Turnstile: bot protection on forms;
• Perplexity: search for public web context for the trends tool (not used to collect mentions);
• Resend: transactional emails and reports;
• Google Analytics: visit statistics for the public website (www.virio.com.br), only if you click "Accept" in the cookie notice; it does not run inside the app and does not receive data from the accounts you connect (section 11);
• Platforms you connect (Meta — Instagram, Facebook and Threads —, YouTube and other Google services, LinkedIn, TikTok, X, Pinterest, Bluesky, Telegram and Discord): receive the content you decide to publish and the actions you take (replies, moderation, campaign changes) and are sources of the data described in sections 3 to 3.6; each acts as an independent controller under its own terms;
• Competent authorities: when required by law or court order.

We do not sell, rent or share personal data with third parties for marketing purposes.

Data is encrypted in transit and at rest, with per-workspace access control (Row Level Security) on every table and an immutable audit log of security events, in accordance with LGPD article 46.

• Account data: while the account is active; after closure, deleted or anonymized within 30 days, unless a legal retention obligation applies;
• Connected account tokens: deleted immediately when the account is disconnected;
• YouTube: public channel data (competitors, mentions and monitored profiles) is refreshed or deleted within 30 days; for the connected channel, statistics and analytics are kept while consent is active (impressions and CTR per video, up to 400 days); title, description, video list and Inbox comments are refreshed or deleted within 30 days; revenue is not stored; everything is deleted within 7 days after disconnection or revocation;
• Instagram: public posts of monitored accounts, up to 25 months; connected account data, while it stays connected, deleted 30 days after disconnection;
• LinkedIn: member comments and mentions, up to 48 hours; activity of the authenticated Page, up to 6 months; Page profile, refreshed at least every 8 weeks; reports and aggregated statistics of the Page and of your profile, up to 1 year; webhook notification records (identifiers only), 30 days; Page data deleted within 1 day after disconnection; third-party posts obtained through the API, up to 48 hours;
• X: mentions and direct messages received, up to 24 hours; replies sent by your team, 30 days; metrics of your posts and profile, while connected and up to 400 days; content deleted on X leaves Virio within 24 hours; on disconnection, access is revoked and tokens deleted immediately;
• Telegram: channel data and posts while the channel is connected; daily subscribers, up to 37 months; on disconnection the bot leaves the channel at once and the connection is deleted in 30 days;
• Discord: the webhook is deleted at once on disconnection; the other connection data, in 30 days;
• Bluesky: tokens deleted at once on disconnection and the connection deleted in 30 days; daily counters, up to 37 months; a post deleted on Bluesky is shown as deleted in Virio after the daily sync;
• Pinterest: no metrics or boards are stored; tokens deleted at once and the connection deleted within 24 hours after disconnection; the ID and link of published Pins stay in the publishing history while you keep that record or the account; a video awaiting processing at Pinterest, up to 2 days;
• TikTok: connected account data and daily series while it is connected; deleted within 30 days after disconnection (fixed maximum period);
• Google Ads: campaign metrics, up to 37 months; on disconnection, tokens deleted at once and account data deleted in 30 days (unless another active connection of the same workspace still reaches the account);
• Google Business Profile: only each location's identifier and name; the name is deleted after 30 days without an update; reviews, posts and metrics are not stored; tokens deleted within 7 days after disconnection;
• Google Drive: authorization and the "Virio" folder identifier while connected; tokens deleted within 7 days after disconnection; files saved to your Drive are yours and remain there;
• Google Analytics 4 and Search Console: aggregated daily numbers while connected, for up to 25 months; disconnecting in Virio deletes the token, the sources and the numbers at once; access revoked at Google and not reconnected is deleted in 7 days;
• Client content approval: evidence of decisions, while the account exists and for 5 years after it is closed (section 19);
• Year in Review: reports, up to 25 months; public links expire after 90 days by default and can be revoked at any time (section 20);
• Aggregated, anonymized statistics (niche benchmarks): kept while useful to the service, without identifying accounts or people;
• Sales and orders from stores and marketplaces: while the connector is active; deleted together with the connector when you remove it;
• Mercado Livre questions, feedback and product reviews, and reviews from app stores, iFood and Facebook: while the source is connected; deleted when you remove the source or the connector;
• Mercado Ads: campaign metrics, up to 37 months; when the Mercado Livre connector is removed, deleted within 30 days;
• Security audit logs: 90 days for informational events, or longer when required for security or by law.

Under LGPD articles 17 to 22, you have the right to:

• Confirmation of processing and access to your data;
• Correction of incomplete, inaccurate or outdated data;
• Anonymization, blocking or deletion of unnecessary data;
• Data portability;
• Deletion of data processed based on consent and withdrawal of consent;
• Information about sharing and objection to processing.

To exercise these rights, email contato@virio.com.br. We will respond within 15 days. Specific data deletion instructions: https://www.virio.com.br/data-deletion

For data received from connected platforms, you can also disconnect the account in Virio and revoke access directly on the platform (sections 3 to 3.6).

Essential: we use cookies and local storage for authentication, security and preferences (language, theme, your cookie choice). They do not depend on consent and are not used for advertising. We do not use third-party advertising cookies.

Website statistics (optional): if you click "Accept" in the cookie notice, the public pages of the website (for example home, pricing, features, tools, terms and this policy) use Google Analytics 4 to measure visits: page viewed, traffic source, device type and browser, and approximate city. Nothing is sent from inside the app, the address is sent without parameters, Google signals and ad personalization are off and Google receives no data for advertising. The _ga and _ga_* cookies last up to 13 months; event-level data is kept for 2 months in Google Analytics (afterwards only aggregated reports). Without consent, or if you click "Decline", the Google script is not even loaded. You can change your choice at any time under "Cookie preferences" in the website footer, which deletes the _ga cookies.

Platform data is stored in Brazil (São Paulo). Some processors handle data on servers outside Brazil — Google (Gemini and Google Analytics), Stripe, Resend, Cloudflare and Perplexity — and in these cases we apply the safeguards set out in LGPD article 33. This includes the APIs of connected platforms, whose servers are located in other countries.

The Platform is not intended for people under 18, and we do not knowingly collect data from minors (LGPD art. 14).

This Policy may be updated. Material changes will be communicated through the Platform or by email, and the update date will always be shown at the top.

You may file a complaint with Brazil's National Data Protection Authority (ANPD): https://www.gov.br/anpd

We record Platform usage actions (session started, sections visited, content created, analyses and connections) for support, security, churn prevention and product improvement. We do not record texts or third-party data. Legal basis: legitimate interest and contract performance (LGPD, art. 7, IX and V). Retention: 400 days.

We generate aggregated, anonymized statistics to improve the service and offer market comparisons. Today they use Instagram data only; YouTube, TikTok, LinkedIn, X, Pinterest, Bluesky, Telegram, Discord, Threads and Google (Business Profile, Drive, Google Ads, Analytics and Search Console) data are not included, because those platforms' terms do not allow it. An aggregated figure is only shown with at least 10 distinct accounts and when no single account accounts for more than half of the total. We never sell or license data obtained from the platforms, not even in aggregated form. You can opt out of benchmarks in Settings → Privacy and data; partnership values are only included with your express authorization.

When a customer uses the SDR module, they are the controller of the prospects' data and Virio acts as processor. We only use public or official sources, state the data source in every message and keep a permanent suppression list. If you received an outreach and want to object, use the unsubscribe link in the message or write to contato@virio.com.br; we forward the request to the customer and add your contact to the suppression list.

This section applies to anyone who receives a content approval link sent by a Virio customer (for example, an agency):

• Who decides about your data: whoever sent the link (controller). Virio processes the data on their behalf (processor). Requests about your data should be made to whoever sent the link; if you contact us, we will forward the request;
• Which data: declared name, email registered by whoever sent the link, IP address, browser, date and time, decision and comment and, at the reinforced level, confirmation of the code sent to your email;
• What for: to record your decision about the content and allow it to be proven later (LGPD, art. 7, V and VI);
• For how long: while the sender's account exists and for 5 more years; links without a decision expire;
• Who we share it with: whoever sent the link and our infrastructure providers (database and hosting, Cloudflare Turnstile bot protection and, when enabled, email delivery). We do not sell this data or use it for advertising;
• Your rights and security: you can request access, correction and anonymization. To preserve proof of the decision, cryptographic digests are kept even after anonymization (LGPD, art. 16). The link is individual and stored only as a cryptographic digest, and the records cannot be altered.

Year in Review summarizes your workspace's year with data you already have in Virio. Names of collaborators and of client approvers never appear outside the workspace; YouTube data is shown separately, without sums with other networks. If an owner or admin creates a public link, they choose card by card what is shared and see a preview; the link expires after 90 days by default and can be revoked at any time, with immediate effect. By creating the link, the customer decides to disclose that content and Virio acts as processor. Legal basis: performance of contract (LGPD, art. 7, V).

The extension has a single purpose: send the page, the selected text, the link or the image you choose to the Virio post composer, when you click the extension icon or the right-click menu.

On that click, the extension reads only the title and address of the current tab and, depending on what you clicked, the selected text, the link address or the image address, and opens Virio (www.virio.com.br) in a new tab with that data. It does not read pages on its own, does not record browsing history, does not store login, password, token or cookies, stores nothing in the browser and sends no data to third parties. Access to Virio is still decided by your session on the site.

The use of information received by the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements. The data is not sold, not used for advertising and not transferred to third parties.

To open the Virio demonstration we ask for your name, e-mail and, optionally, your Instagram profile. We use this data to understand interest in the product and to talk to you about Virio (legal basis: consent, LGPD art. 7, I, given when you tick the acceptance box). We also record the demonstration pages you open, how long you stay, where the visit came from (the campaign or site that brought you) and the type of device — without storing your IP address. News by e-mail only with your separate permission, which you can withdraw at any time. If you do not return to the demonstration for 12 months, your identification data is deleted and only aggregate numbers remain. You can request access, correction or deletion at any time through the channels in this policy.

Questions about this Policy or your data: contato@virio.com.br.