Privacy
Policy.

This policy explains which personal data Precisian processes, for what purpose, for how long, with whom it may be shared and how you can exercise your rights. It covers two distinct situations: your browsing on the precisian.io website and the processing of data from the advertising, analytics and e-commerce accounts that our clients connect to our data platform.

1. Who processes your data

The party responsible for processing the data described in this policy is:

The channel above is the point of contact of our data protection officer (DPO), under article 41 of the Brazilian General Data Protection Law (LGPD, Law 13,709/2018).

2. Our two roles: controller and processor

Precisian processes personal data in two different contexts, and its role changes in each of them. This distinction matters because it defines who decides the purpose of the processing and to whom you should address a request.

• Controller. When you visit precisian.io, fill in a form, download a material or talk to us on WhatsApp. Here we are the ones who decide why and how this data is processed. Described in section 3.
• Processor. When a client hires Precisian and authorizes reading of its accounts on Google, Meta, LinkedIn, Pinterest, RD Station, VTEX and other platforms. In this case the controller is the client itself, and we process the data exclusively according to its instructions and the signed agreement. Described in section 4.

3. Data collected on the precisian.io website

3.1. Data you provide to us

In the website forms (contact, WhatsApp, newsletter and demo request) we collect name, email, phone number, company name, type of business and the message you write. When the form offers the option to accept the privacy policy and you check it, we also record the date of acceptance.

We also record the source of your visit, based on the page's campaign parameters (utm_source, utm_medium and utm_campaign). The source of the page where you fill in the form is sent along with it, regardless of your cookie choice. If you accept Analytics cookies, we also keep the source of your first visit on this device, for up to 90 days, so we know which campaign or channel brought you to us.

This data is sent to our customer relationship management (CRM) and communication system, operated by Brevo, and, during the transition between tools, also to RD Station, so that our team can get in touch with you and, if you asked for it, send you content.

3.2. Data collected automatically, cookies and measurement technologies

When you visit the website, a cookie notice asks for your choice. The data collected depends on it:

• Essential (always active): store your cookie choice and allow the website to work. They do not collect data for advertising or measurement.
• Analytics: if you accept, we measure website usage with Google Analytics 4.
• Marketing: if you accept, we enable campaign measurement and sales intelligence: Apollo.io and OpenAI.

Cookieless signals. Our Google products use Consent Mode in advanced mode. Because of this, before you make your choice, or if you decline, Google Analytics may receive technical signals from the visit (such as the page accessed, date and time, language and browser type) without storing cookies on your device and without a persistent identifier. These signals are used for aggregated measurement and statistical modeling, and are processed by Google according to its own policy. Analytics and Marketing cookies, Apollo.io and OpenAI only start working after you accept.

Email sent to OpenAI as a hash. If you accept Marketing cookies and submit a form, your email is transformed, in your own browser, into an irreversible code (SHA-256 hash), and only that code is sent to OpenAI. The email itself is not sent. The code allows OpenAI to recognize whether the visit came from a campaign shown in its products, so that we can measure the results of that campaign. Even in this form, the hash is considered pseudonymized personal data and is processed according to this policy and OpenAI's policy. Without Marketing consent, nothing is sent to OpenAI.

Technologies and providers

We do not send the content of forms (name, email, phone number or message) to any advertising or measurement technology on the website, with the sole exception of the email hash described above.

Cookies and storage on your device

3.3. How to change your choice

You can change or withdraw your consent at any time through the cookie icon in the bottom left corner of every page. Withdrawal stops the use of cookies from that moment on; cookies already stored can be deleted in your browser settings. Declining does not prevent you from using the website, but it reduces the accuracy of our measurement. Each provider listed above also offers its own opt-out mechanisms.

3.4. Demo with artificial intelligence

The demo page lets you ask questions in natural language about a fictitious e-commerce operation. The answers are generated by an artificial intelligence model, which only queries a database invented for the demo, with no real client data.

• What is sent: the text of your questions and the conversation history in that session are sent to OpenRouter, which forwards them to the provider of the model used (currently Google, Gemini model) to generate the answer. Do not write personal data, passwords or confidential information in your questions.
• What we keep: we do not store the content of the questions in a database. Technical error logs may contain excerpts of the answer generated by the model and are kept for the server log retention period.
• Usage limit: to prevent abuse, the demo has a question limit, controlled by the essential cookie precisian_demo (24 hours) and by a counter per IP address kept only in memory, for up to 1 hour.
• Contact at the end: if you want to talk to our team at the end of the demo, we ask for your name, email, company and phone number, processed as described in section 3.1.
• Processing by providers: OpenRouter and the model provider process the text of the questions according to their own privacy and retention policies.

4. Data from accounts connected by clients

When a client hires Precisian, it authorizes reading of its accounts on the platforms listed below. This authorization is given by the client itself, through secure login (OAuth) or an access key generated inside its own account, and it can be revoked by the client at any time directly on the source platform.

We only request read permissions. We do not create, edit, pause or publish campaigns, ads, posts or orders on behalf of the client. Our service consists of reading and consolidating data for reporting and analysis.

Most of this content consists of aggregated metrics, with no identification of individuals. Where the data may contain personal information, for example a lead captured in an ad form or an e-commerce order, the processing takes place on behalf of and under the instructions of the client, who is the controller of this data and is responsible for the legal basis and for the notices to data subjects.

5. What we use the data for

• To provide the contracted service: consolidating, calculating and presenting metrics in reports and dashboards for the client that authorized the connection.
• To respond to sales and support requests you make.
• To send content and materials you requested, with an unsubscribe option in every communication.
• To measure the performance of our own website and our campaigns.
• To ensure the security, availability and integrity of our systems, and to comply with legal obligations.

Each client sees only its own data. We do not cross-reference, combine or compare one client's data with another's. Market studies and benchmarks, when they exist, use exclusively aggregated and anonymized information, with no identification of any advertiser, store or person.

We do not use client or visitor data to train general-purpose artificial intelligence models, nor do we make it available to third parties for that purpose.

6. Legal bases

• Performance of a contract (art. 7, V of the LGPD): processing of data from connected accounts and client service.
• Consent (art. 7, I): use of the Analytics and Marketing cookies and technologies described in section 3.2, including sending the email hash to OpenAI, sending marketing communications and recording the source of your first visit.
• Legitimate interest (art. 7, IX): information security, fraud prevention, technical diagnostics, operation of the demo described in section 3.4 and the cookieless signals described in section 3.2, always with an assessment of the impact on your rights.
• Compliance with a legal obligation (art. 7, II): retention of records required by law.

If you are in the European Union or the United Kingdom, the equivalent GDPR legal bases apply, and Precisian acts as a processor with respect to the data from accounts connected by the client.

7. Sharing and no sale of data

Precisian does not sell, rent or transfer personal data. We also do not redistribute to third parties the content obtained from the platforms' APIs, nor do we make it available to any other advertising or analytics service.

We share data only in the following cases:

• With the providers of the technologies listed in section 3.2 (Google, Apollo.io, OpenAI and Cloudflare), which receive browsing data to the extent necessary for each technology to work and process it according to their own policies.
• With OpenRouter and the artificial intelligence model provider (currently Google), which receive the text of the questions asked in the demo (section 3.4).
• With infrastructure and communication providers strictly necessary for our operation (hosting, database, email delivery and CRM, currently Brevo and RD Station), under confidentiality obligations and to process data only according to our instructions.
• With the client that owns the connected account, who is the recipient of the service.
• When required by law, court order or a competent authority.
• In the event of a corporate reorganization, with the obligations of this policy preserved.

8. Limited Use of data from Google APIs

Precisian's use and transfer of information received from Google APIs comply with the Google API Services User Data Policy, including the Limited Use requirements.

In practice, this means that data obtained from Google Analytics, Google Search Console and Google Ads is used only to provide and improve the user-facing features for the client that authorized access. We do not use this data for advertising, we do not sell it and we do not allow humans to read it, except with the client's express permission, for security purposes, for requested support or when required by law.

9. Where we store data and for how long

Data is kept on servers under Precisian's control and on managed services from cloud providers, with access restricted by authentication and individual credentials. All traffic between your browser, Precisian's systems and the source platforms is encrypted (HTTPS/TLS).

When data is no longer necessary for the purpose for which it was collected, it is deleted or anonymized.

10. How to request deletion of your data

You can request deletion of your data at any time, without having to give a reason, through one of these channels:

• By email: send your request to [email protected] with the subject "Data deletion", stating the email, phone number or account the request refers to.
• By revoking the authorization on the source platform: if you are a client and connected a Google, Meta, LinkedIn, Pinterest or RD Station account, you can revoke Precisian's access directly in the connected apps settings of the respective platform. Revocation immediately stops any new reading.

Deadlines. We acknowledge receipt within 2 business days and complete the deletion within 10 days of confirming your identity. When a client terminates the contract, the data from its accounts is deleted within 30 days of termination, unless immediate deletion was requested earlier or there is a legal obligation to retain it. Backup copies are overwritten within the normal rotation cycle.

If you are a person whose data appears in reports we produce for one of our clients, we forward your request to that client, who is the controller of this data, and act according to its instructions. We will let you know about this forwarding.

11. Your rights as a data subject

The LGPD guarantees you, at any time and upon request:

• Confirmation that processing exists and access to the data.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of data that is unnecessary, excessive or processed in breach of the law.
• Portability to another provider, upon express request.
• Deletion of data processed on the basis of your consent.
• Information about the entities with which we share data.
• Information about the possibility of not giving consent and the consequences of refusing.
• Withdrawal of consent.

To exercise any of them, write to [email protected]. We may ask for additional information to confirm your identity before fulfilling the request, as a security measure. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

12. Information security

We adopt technical and administrative measures to protect data against unauthorized access, loss, alteration and improper disclosure. These include encryption in transit, access control through individual credentials, segregation by client, logging of administrative access, periodic backups and permission reviews.

No system is absolutely secure. In the event of a security incident that may result in relevant risk or harm, we will notify the affected data subjects and the ANPD within the deadlines set by law.

13. International transfers

Some of the services we use, such as the advertising platforms themselves and some cloud providers, are based outside Brazil. In these cases, the transfer takes place based on the safeguards set out in article 33 of the LGPD, including data protection contractual clauses signed with the provider.

Data sent to our providers may be processed outside Brazil. Brevo is headquartered in France, and Google, Apollo.io, OpenAI, OpenRouter and Cloudflare may process data in the United States and other countries. In all cases, the transfer takes place with the safeguards of article 33 of the LGPD, including data protection contractual clauses.

14. Children and teenagers

Our services are intended for companies and professionals. We do not knowingly collect data from people under 18. If we identify any unintentional collection, the data will be deleted.

15. Changes to this policy

We may update this policy to reflect legal, technical or service changes. The date of the last update always appears at the top of the page. If a change alters the way we use data already collected, we will notify the affected data subjects before applying it and, when the change requires it, we will ask for new consent. This expressly applies to data obtained from Google APIs.

16. Contact

Questions, requests for access, correction or deletion, or any matter related to privacy and data protection: [email protected].

See also our Terms of Use.