Privacy Policy

1. Our role for each type of data

Data protection law distinguishes who decides how data is used (controller) from who handles it on someone else's behalf (processor). vivapush plays both roles:

• We are the controller for data about website visitors, people who contact our sales team, and people who create an account or join a team in the dashboard.
• We are a processor for data about our customers' end users, meaning the people who receive notifications sent by the apps and websites that use vivapush. The customer is the controller of that data: it decides who receives what, and we process the data only to provide the service, following its instructions and the Terms of Use.

2. Data we process

Website visitors, waiting list and sales contacts:

• What you type in the “Talk to sales” and “Waiting list” forms: name, email, company, approximate monthly active users and, for sales, your message.
• A cryptographic hash of your IP address, used only to limit repeated form submissions. We do not store the IP itself.
• Your language and theme preference, stored in your browser (see section 5).

Customers and team members:

• Sign-up: name, email and password. Our authentication provider stores the password only as a hash; we never have access to it.
• Account preferences: language, time zone, theme and email choices.
• Security and access: active sessions with browser, IP address and times, two-step verification when enabled, invitations, and an audit log of actions taken in the dashboard (for example, who created a campaign or changed a credential).
• Data about the organizations and apps you register, including push service credentials (Apple, Google and Web Push), which we store encrypted.

Our customers' end users (processed as a processor):

• App or browser installation identifier, push token and Web Push subscription keys.
• Device technical data: platform, model, operating system and app version, and the language, country and time zone reported by the app.
• External identifier and tags that the customer chooses to associate with the device.
• Notification preferences (push and marketing) and delivery, open and click events.
• Activity records used to count monthly active users (MAU). The user's identity is stored as a hash.

We do not intentionally collect sensitive personal data (such as health, religion or biometrics) and ask customers not to send it in notifications or tags.

3. Why we use data and on what legal basis

• Providing the service, creating and maintaining your account, authenticating access and sending notifications on behalf of customers: performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Protecting accounts and the service against fraud, abuse and unauthorized access, and keeping audit logs: legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Keeping application access logs for the legally required period: legal obligation (LGPD art. 7, II; Brazilian Internet Civil Framework art. 15).
• Answering sales inquiries and sending proposals: steps taken at your request before entering into a contract.
• Telling people on the waiting list when vivapush opens: consent. To leave the list, just ask at the contact email.
• Sending notices about your account, billing, security and changes to these documents: performance of a contract and legitimate interests.
• Sending product news by email when you choose to receive it: consent, which you can withdraw at any time in your account preferences.

We do not sell personal data and we do not use our customers' end-user data for our own purposes, advertising or model training.

4. Who we share data with

We use providers that process data on our behalf, under contract and with appropriate security measures:

• Supabase: database, authentication and file storage, with servers in São Paulo, Brazil.
• Vercel: hosting for the website and dashboard, on a global delivery network.
• Apple Push Notification service, Firebase Cloud Messaging (Google) and browser push services (such as Google, Mozilla, Apple and Microsoft): they receive the token and the content of each notification to deliver it to the device.
• Resend: sends scheduled report emails, only when a customer turns this feature on.
• The hosting provider for our background sending processes, engaged under the same requirements.

We also send data to webhook URLs that customers configure themselves, and we may share data with authorities when required by law or court order, or to protect the rights of vivapush and others.

5. Cookies and browser storage

We only use what the website and dashboard need to work. We do not use advertising cookies or third-party analytics tools.

• Supabase session cookies (sb-…-auth-token): keep you signed in to the dashboard. Strictly necessary.
• vp_lang (cookie, 1 year): remembers your chosen language.
• vp-theme and vp-recent (local storage): remember the light or dark theme and the apps you opened last in the dashboard.
• vp-locale-sync (session storage): prevents repeated reloads when switching language.

On customers' websites that use our web SDK, the browser stores vivapush:iid (installation identifier) and vivapush:activity (date of last activity), plus the push subscription the browser itself creates when the person allows notifications. Customers are responsible for telling their visitors about this.

You can delete cookies and site data in your browser settings. Without session cookies, the dashboard cannot be used.

6. International transfers

Some providers, such as Vercel, Google, Apple, browser push services and Resend, may process data outside Brazil, mainly in the United States. In those cases we rely on the safeguards provided by LGPD art. 33 and, where the GDPR applies, its transfer rules, such as data protection contract clauses, and we choose providers with recognized security standards.

7. How long we keep data

• Account and organization data: while the account is active. After closure, we delete or anonymize it within 90 days, except what we must keep by law or to exercise rights.
• Application access logs (IP, date and time): at least 6 months, as required by Brazilian law.
• Audit logs and billing history: while the organization exists and for the applicable legal period afterwards.
• Per-notification delivery details: 90 days after the campaign ends. Aggregate campaign totals are kept.
• Active-user records used for billing: 13 months. Activity events that do not count toward MAU: 45 days.
• End-user devices and tags: while the customer's app is active on vivapush, or until the customer asks for deletion.
• Sales contacts and the waiting list: as long as needed to handle the conversation or announce the opening, and at most 24 months without new contact.

8. How we protect data

• Encrypted connections (HTTPS) across the website, dashboard and API.
• Push credentials and webhook secrets encrypted with AES-256-GCM using rotatable keys.
• API keys, invitations and user identities stored only as hashes.
• Isolation between customers in the database (Row Level Security) and role-based permissions in each organization.
• Two-step verification, active session management and an audit log.

No system is completely immune to incidents. If a security incident may cause relevant risk or harm, we will notify the people affected and the competent authorities, as the law requires.

9. Your rights

You may ask us at any time, free of charge, to:

• confirm whether we process your data and give you access to it;
• correct incomplete, inaccurate or outdated data;
• anonymize, block or delete data that is unnecessary or processed unlawfully;
• port your data to another provider;
• delete data processed on the basis of your consent, and tell you about the option not to consent;
• tell you who we share your data with;
• review decisions made solely by automated processing;
• withdraw your consent, or object to processing based on legitimate interests.

In the dashboard, under “Account” → “Your data”, you can download a copy of your data and delete your account yourself. For any other request, write to contato@vivapush.com. We may ask for information to confirm your identity, and we reply within 15 days. You can also complain to Brazil's National Data Protection Authority (ANPD, www.gov.br/anpd) or to your local data protection authority.

If you receive notifications from an app or website that uses vivapush, the company behind that app or website controls your data. Contact it first; to stop receiving notifications, turn them off in your device or browser settings. If you contact us, we will forward the request to the customer and help it respond.

10. Children and teenagers

The vivapush dashboard is meant for businesses and people aged 18 or over. We do not create accounts for minors. Customers whose apps are used by children or teenagers must follow the laws that protect them when sending notifications.

11. Data protection officer and contact

Controller: vivapush. Data protection officer (encarregado) and contact for anything in this policy: contato@vivapush.com.

12. Changes to this policy

We may update this policy to reflect changes in the service or the law. The date of the current version is shown at the top of the page. When a change is significant, we will notify customers by email or in the dashboard with reasonable notice.