Privacy policy

Version of October 29, 2026. This is an English translation provided for convenience. If there is any difference, the Portuguese version prevails. 1. Who is the controller Provado (provadoseo.com) is a service of Eduardo Coelho Nogueira, an individual, with address at Rua Cabral, 2007, Aeroporto, 79332-030 Corumbá (MS), Brazil ("we"). Contact for anything related to personal data: [email protected]. We have not appointed a data protection officer: it is not required for the type and scale of processing we carry out. Privacy questions are handled directly through the contact above. 2. Which laws apply We apply the General Data Protection Regulation (GDPR), because the service is aimed at agencies in the European Union. As the controller is in Brazil, the Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) also applies. Both laws give similar rights. Where they differ, we apply the rule that protects you most. 3. Provado's two roles - Controller: for the data of the agency's account and the people who use it, of payments and of those who leave us their contact details on the website. - Processor, on behalf of the agency: for the content of the agency's clients' websites that Provado checks (images, HTML and reports). Here the agency is the controller and decides what is checked, and Provado follows its instructions, under the Data processing agreement in the Annex to the Terms of use. Anyone who wishes to exercise rights over this content should contact the agency; we help the agency respond. 4. What data we process - Account: email, password (stored only in encrypted form, which cannot be read), name of the person responsible, phone (optional), language and the dates of creation, email confirmation, last access and acceptance of the terms. - Sign in with Google, if available and you choose it: Google confirms your identity and sends us the name and email of the Google account. We do not receive the Google password. - Agency: name, logo, color, contact email shown in the reports and report options. - Agency clients: client name, website address, pages to check, agency note and the permission statement. - Check results: technical results, images of the top of the pages, copies of the HTML and PDF and PNG reports. These are public pages, but they may contain personal data published on the website (for example, names or contact details of people who appear there). - Payment: the customer identifier, the plan and the subscription status on Stripe. The billing name and address, the VAT number and the card details stay with Stripe. We do not see or store card details. - Visit source: when you reach the website through a campaign link, we store the parameters of that link (for example, utm_source) and the page you came from, to know which channels work. - Contact left on the website (home page form): name, email, agency, approximate number of clients, language and source page. - News: if you tick the corresponding box (off by default), we store that you agreed to receive news by email and the date. - Security: to limit sign-in attempts, mass account creation and form abuse, we store the IP address and email only in a protected form (an HMAC code, which does not allow the original value to be recovered). For access and account creation attempts, this code is deleted within 24 hours at most; for the contact form, it stays with the request, only to limit repeated requests. - Captcha: on the forms to create an account, sign in, reset and change the password, Cloudflare (Turnstile) analyzes technical browser signals, including the IP address, to confirm you are not a bot. - Service emails: record of the emails sent (account confirmation, approval, report ready and subscription notices). Brevo, which sends these emails, records delivery and clicks on links. - Manual review: when an account or a website goes through review, the person who operates Provado receives by email the data needed to decide (account email, agency name and website) and a link to approve or refuse. - Support: the messages you send us and our replies. 5. What we use the data for and on what legal basis - Creating and maintaining the account, running the checks, generating and delivering the reports, sending service emails and providing support: performance of the contract (GDPR, Article 6(1)(b); LGPD, Article 7, V). - Charging the subscription, issuing invoices and meeting tax and accounting obligations: performance of the contract and compliance with a legal obligation (GDPR, points (b) and (c); LGPD, Article 7, II and V). - Security and abuse prevention (attempt limits, captcha and manual review): legitimate interest in protecting the service, the accounts and the websites visited (GDPR, point (f); LGPD, Article 7, IX). - Knowing where visits come from: legitimate interest in understanding which channels bring customers, using only the link parameters, without analytics cookies (GDPR, point (f); LGPD, Article 7, IX). - Replying to those who leave their contact details on the website and sending news: consent, which you can withdraw at any time (GDPR, point (a); LGPD, Article 7, I). Withdrawing consent does not affect what was done before. We have balanced these legitimate interests against your rights: the data is minimal, protected and kept for a short time, and you can object at any time. We do not sell data, do not use it for third-party advertising and do not use it to train artificial intelligence models. We do not make automated decisions with legal effects on people: the manual review is decided by a person. 6. Cookies We use only what is strictly necessary for the service to work and be secure, and so we do not ask for consent: - the sign-in session cookies, which keep you signed in for up to 30 days and are not accessible to page scripts; - the security cookies that Cloudflare may set when confirming you are not a bot (Turnstile) or when protecting the website from abusive traffic. We do not use analytics, advertising or social media cookies. 7. Who we share data with Only with the suppliers needed for the service, each only for its role and under a data processing agreement: - Supabase (Supabase Inc., United States): database, sign-in and files. The data is stored in Frankfurt (Germany). - Google Cloud (Google LLC, United States): the server where the website and the checker run, in the United States. Data passes through it when it is processed (for example, when generating images and PDFs). - Cloudflare (Cloudflare Inc., United States): captcha (Turnstile) and protected connection between the internet and the server. - Brevo (Sendinblue SAS, France): sending service emails. - Stripe: payments, subscriptions and invoices. To prevent fraud and meet its own legal obligations, Stripe processes part of the data as an independent controller, under its privacy policy. - Google (Google LLC, United States), if you choose to sign in with Google: confirms your identity. The person who operates Provado, in Brazil, accesses the data when needed for manual review, support and troubleshooting. Outside these cases, we share data only when the law requires it or to defend rights in legal proceedings. 8. Transfers - Brazil: in January 2026, the European Commission recognized that Brazil ensures an adequate level of protection (Implementing Decision (EU) 2026/179). - United States (Google, Cloudflare, Supabase and, where applicable, Stripe): the transfer relies on the EU-U.S. Data Privacy Framework, for certified suppliers, or on the standard contractual clauses approved by the European Commission, which are part of those suppliers' data processing agreements. You can ask us for information about the safeguard that applies to each supplier. 9. How long we keep data - Account, agency, clients, checks, images, HTML and reports: for as long as the account exists. - Accounts created and never confirmed: may be deleted from 30 days after creation. - Contact left on the website: until you withdraw consent or ask us to delete it. - Acceptance of news: until you withdraw it. - Protected IP and email (HMAC) of access and account creation attempts: up to 24 hours. - Record of service emails sent: up to 90 days. - Manual review approval link: valid for 7 days. - Server technical logs: used only to fix failures and deleted when the service is updated or restarted. - Invoices: kept by Stripe for the period required by tax law. When you delete the account, we immediately delete all associated data and files, with automatic retries if any part fails. Only the customer record and invoices on Stripe remain, which tax law requires to be kept. 10. Your rights Under the GDPR, you can request access to your data, its rectification, erasure, restriction or portability, object to processing based on legitimate interest and withdraw consent at any time. Under the LGPD (Article 18), you can also request confirmation that we process your data, find out who we share it with, request the anonymization or blocking of unnecessary data and the review of automated decisions. You can correct most of the data on the Brand and Account pages, turn off news on the Account page and delete everything with "Delete account". For anything else, write to [email protected]. We reply within one month and, when the LGPD requires a shorter period (15 days for full confirmation and access), we meet that period. If there is doubt about who is making the request, we may ask for identity confirmation. You can also file a complaint with the Comissão Nacional de Proteção de Dados (CNPD, Portugal, www.cnpd.pt), the Agencia Española de Protección de Datos (AEPD, Spain, www.aepd.es), the authority of the country where you live or work, or the Brazilian National Data Protection Authority (ANPD, www.gov.br/anpd). 11. Security - Encrypted connections (HTTPS). - Each agency only accesses its own data, through rules enforced in the database itself. - Files (logos, images, HTML and reports) in private storage. - Password with at least 10 characters, letters and numbers, and rejection of very common passwords. - Attempt limits and captcha on account access. - Administration of the service restricted to the person who operates Provado. In case of a data breach, we assess the risk, notify the supervisory authority within 72 hours when the law requires it (and the ANPD, where applicable) and inform the affected agencies without delay, so they can inform their clients. 12. Minors Provado is intended for professionals and is not directed at anyone under 18. 13. Changes to this policy We always publish the new version on this page, with the date. When the change is important, we notify you by email before it takes effect.