Privacy Policy

1. Data We Collect

We collect different categories of data depending on use:

• Account data: name, email, phone, and company details provided at signup.
• Payment data: processed by Stripe; we do not store full card numbers.
• Usage data: pages visited, actions in the platform, logs, and IP address.
• Submitted content: information you add to the Service’s tools.

2. How and Why We Use Your Data

We process personal data for the following purposes, always under an LGPD legal basis:

• to provide, maintain, and improve the Service (performance of a contract);
• to process payments and manage subscriptions (performance of a contract);
• to send operational and support communications (contract / legitimate interest);
• to comply with legal and regulatory obligations (legal obligation);
• to send marketing communications, where authorized (consent).

3. Data Sharing

We do not sell personal data. We may share it with providers that support the operation of the Service (sub-processors), which process data under our instructions and applicable law, such as:

• Stripe – payment processing;
• infrastructure, hosting, and email providers;
• analytics and customer support tools.

4. Cookies and Tracking Technologies

We use cookies and similar technologies for authentication, security, remembering preferences, and measuring usage. You can manage cookies in your browser settings; disabling some of them may affect Service features.

5. Storage and Security

We adopt reasonable technical and administrative measures to protect data against unauthorized access, loss, or improper alteration. No system is entirely immune to risk, but we work continuously to mitigate it.

6. Data Retention

We retain personal data for as long as necessary to fulfill the purposes described and our legal obligations. Once the relationship ends, data may be anonymized or deleted, except where retention is required by law.

7. Your Rights as a Data Subject

Under the LGPD, you may at any time request:

• confirmation that processing exists and access to your data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary or non-compliant data;
• data portability to another provider;
• information about sharing and withdrawal of consent.

8. International Data Transfers

Some sub-processors may process data outside Brazil. In such cases, we adopt appropriate safeguards to ensure a level of protection compatible with the LGPD.

9. Data Protection Officer (DPO) and Contact

To exercise your rights or ask questions about data processing, contact our Data Protection Officer at privacidade@guessless.com.br.

10. Google API Services Data and Limited Use

Some GL Suite tools let you voluntarily connect your own Google accounts to import your marketing data. The connection uses OAuth: we never ask for or store your Google password, and you can revoke access at any time.

We request only the read scopes needed for the features below: analytics.readonly (Google Analytics 4 metrics, for the traffic and behavior dashboards); webmasters.readonly (Google Search Console data — queries, pages, clicks, impressions and position — for the organic search dashboard); and adwords (Google Ads campaign metrics, for the paid media dashboard). For Google Ads, Google offers a single access scope — although it permits writes, GL Suite performs read-only operations.

GL Suite's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. Specifically, we:

• use the data solely to provide and improve the user-facing features within GL Suite;
• do not sell data obtained from Google APIs;
• do not use this data for advertising, remarketing, or ad profiling;
• do not use this data to train generalized artificial intelligence or machine learning models;
• do not transfer this data to third parties except as necessary to operate the Service (infrastructure sub-processors acting on our instructions), to comply with applicable law, or with your consent;
• do not allow humans to read your data, unless you give explicit consent, for security purposes (e.g., investigating abuse), to comply with applicable law, or when the data is aggregated/anonymized;
• access tokens are stored encrypted and used only to synchronize your data. You can disconnect the integration at any time inside the tool (Integrations → Plugins → Disconnect), which deletes the tokens, or revoke access at https://myaccount.google.com/permissions.

11. Changes to This Policy

This Policy may be updated to reflect changes in the Service or the law. The current version will always be available on this page, with the date of the last update.