Privacy Policy
Updated 28 October 2026. Previous version: 29 January 2021.
This Policy explains which personal data S. B. PASTRO TECNOLOGIA DA INFORMACAO LTDA, Brazilian tax ID (CNPJ) 36.608.531/0001-09, Av. Paulista, 807, Suite 2315, São Paulo/SP, Brazil (HINTUP) processes, for what purpose, with whom it is shared, how long it is kept and how to exercise your rights, in compliance with Brazilian Law 13.709/2018 (LGPD), the Brazilian Internet Act (Law 12.965/2014) and, depending on the data subject’s country, Regulation (EU) 2016/679 (GDPR), Argentine Law 25.326 and the Mexican Federal Law on the Protection of Personal Data Held by Private Parties (LFPDPPP).
1. Who this Policy applies to
1.1 This Policy applies to: (a) customers — merchants and their teams who create an account and use the HINTUP dashboard; (b) visitors to hintup.io and its contact channels; (c) end customers — people who browse the customers’ stores where HINTUP tools are installed.
1.2 Data Protection Officer (DPO): Samuel Barletta Pastro, reachable through the e-mail listed at hintup.io/contact with the subject “LGPD”.
1.3 This Policy forms part of HINTUP’s Terms of Use and Refund Policy. By using the services, the customer declares to have read this Policy.
2. HINTUP’s roles
2.1 Controller — for customer and visitor data: registration, payment, dashboard usage, support, contact and marketing. HINTUP decides the purposes and means of that processing.
2.2 Processor — for the data of the end customers of the customers’ stores. The customer (merchant) is the controller: it decides to install the tools, which data they receive from its e-commerce platform and which campaigns to send. HINTUP processes that data only to provide the contracted service, according to the customer’s instructions and this Policy.
2.3 The customer is responsible for informing its end customers, in its own privacy policy, about the use of HINTUP tools (there is a ready-made template text), and for having a legal basis for the processing, including for cart-recovery e-mails and messages.
2.4 End customers who wish to exercise rights over data processed by HINTUP as a processor should first contact the store where they shopped. HINTUP assists the customer in responding and, if contacted directly, forwards the request to the responsible customer.
3. What data we process, why and on what legal basis
| Data subject | Data | Purpose | Legal basis (LGPD) |
|---|---|---|---|
| Customer | Name, e-mail, phone, tax ID, company name, address, store and e-commerce platform details | Create and maintain the account, provide the service, issue charges and invoices | Performance of a contract (art. 7, V); legal obligation (art. 7, II) |
| Customer | Payment data (cardholder name, last 4 digits of the card, brand, expiry; Pix/bank-slip details). The full card number stays only with the gateway | Bill the subscription, process refunds and chargebacks | Performance of a contract; legal obligation |
| Customer | Dashboard access logs (IP, date/time, browser), dashboard actions, support messages | Security, audit, support, compliance with the Internet Act | Legal obligation (art. 15 of the Internet Act); legitimate interest (art. 7, IX) |
| Customer | E-mail and communication preferences | Renewal, billing and service-change notices; HINTUP news and offers | Performance of a contract (notices); legitimate interest with opt-out (offers) |
| Visitor | Name, e-mail, phone and message sent via the contact form or WhatsApp | Respond to the contact and present the services | Pre-contractual steps (art. 7, V); legitimate interest |
| Visitor | Cookies and browsing data on hintup.io | Website operation, statistics, campaigns | Consent (non-essential); legitimate interest (essential) |
| End customer (as processor) | Session identifier, browsing events (products viewed, searches, clicks, cart), cart items and value, orders | Personalising the store experience (search, recommendations, interactive content) and statistics for the customer | Defined by the customer as controller |
| End customer (as processor) | Name, e-mail, phone, address, when entered in the store or sent by the platform | Communication with the end customer on the store’s behalf and lead capture | Defined by the customer as controller |
3.1 HINTUP does not collect sensitive data (racial origin, health, religion, sexual life, biometrics, among others under art. 5, II, of the LGPD) and advises customers not to configure the tools to collect it.
3.2 To train and improve its search and recommendation models, HINTUP uses only interactions with products and categories (views, clicks, purchases) and approximate location (country, state, city). Session identifier, name, e-mail and any other data that identifies the person are not part of that set.
4. Who we share data with
4.1 HINTUP does not sell personal data. It shares data only with the providers below, to the extent necessary for the service, under contracts that bind them to process it in accordance with this Policy and the law.
| Category | Purpose | Data involved |
|---|---|---|
| Payment gateways (in Brazil and abroad) | Process charges, refunds and chargebacks | Customer registration and payment data |
| E-commerce platforms (Nuvemshop and others the store is integrated with) | Receive the store’s catalogue, orders and events and display the tools | Store and end-customer data |
| Cloud infrastructure, CDN and storage providers | Host and run the tools | All data processed by the service |
| E-mail and messaging providers | Send transactional, cart-recovery and campaign e-mails | E-mail, name and message content |
| Support and communication tools (WhatsApp, e-mail) | Support and sales contact | Name, phone, e-mail, conversation content |
| Accounting and invoicing | Tax obligations | Company name, tax ID, address, amounts |
| Public authorities | Comply with a court order or legal obligation | Whatever is required |
4.2 HINTUP keeps an up-to-date list of the providers that process end-customer data as sub-processors and provides it to the customer on request.
4.3 In the event of a merger, acquisition or sale of assets, data may be transferred to the successor, who will be bound by this Policy; data subjects will be notified.
5. International transfers
5.1 Some providers in section 4 are located or have servers outside Brazil, in particular payment gateways used for customers in Latin America and Europe and cloud providers. For those transfers HINTUP adopts the safeguards of art. 33 of the LGPD: contracts with data-protection clauses, providers in countries with an adequate level of protection or, where applicable, the data subject’s specific consent.
5.2 For data subjects in the European Economic Area, transfers to Brazil and other countries rely on the European Commission’s standard contractual clauses or another mechanism under Chapter V of the GDPR.
6. How long we keep data
| Data | Period | Reason |
|---|---|---|
| Customer account, settings and store data | During the subscription and for 6 (six) months after cancellation | Allow export and reactivation |
| End-customer data processed as processor | During the subscription and for 6 (six) months after cancellation, unless the customer instructs earlier deletion | Service provision; return or deletion at the end of the contract |
| Dashboard access logs | At least 6 (six) months | Art. 15 of the Brazilian Internet Act |
| Tax documents, charges and proof of payment and refund | 5 (five) years after the end of the contract | Tax obligations and limitation periods |
| Support and contact messages | 2 (two) years | Service history and defence in proceedings |
| Lead data of prospects who did not subscribe | 12 (twelve) months after the last contact | Legitimate commercial interest |
6.1 At the end of these periods, data is deleted or anonymised. Deletion may be brought forward at the data subject’s request, except where the law requires retention.
6.2 Aggregated and anonymised data that does not identify individuals may be kept indefinitely.
7. Your rights
7.1 Under art. 18 of the LGPD, the data subject may ask HINTUP for: confirmation that processing takes place; access to the data; correction of incomplete or outdated data; anonymisation, blocking or deletion of unnecessary data or data processed in breach of the law; portability; information about sharing; information about the possibility of refusing consent and its consequences; withdrawal of consent; objection to processing based on legitimate interest; and review of automated decisions. Data subjects in the EEA, Argentina and Mexico have the equivalent rights under the GDPR, Law 25.326 and the LFPDPPP (ARCO rights).
7.2 How to request: a message with the subject “LGPD” through the channels at hintup.io/contact, stating your name, registered e-mail and the right you wish to exercise. HINTUP may request identity confirmation before responding.
7.3 Timeframe: response within 15 (fifteen) days. Simplified confirmation and access requests are answered immediately where possible.
7.4 Marketing: every HINTUP promotional e-mail includes an unsubscribe link. Billing, renewal and security notices continue to be sent while the account exists.
7.5 End customers: see clause 2.4 — the request goes to the store, and HINTUP assists it.
7.6 The data subject may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD) or the authority of their country: AAIP in Argentina, INAI in Mexico, the national data protection authority in the EEA.
8. Cookies and technologies in the stores
This section covers two different situations, with different rules: the hintup.io website, which uses cookies like any website; and the tools installed in the customers’ stores, which write no cookies and no other data to the end customer’s device.
8.1 On hintup.io, HINTUP uses essential cookies (session, security, preferences) and, with consent, statistics and campaign cookies. Visitors may refuse non-essential cookies in the cookie notice or in their browser.
8.2 In the customers’ stores, HINTUP tools generate a session identifier to recognise the same visit and keep the tools working during the visit. This identifier is derived from technical characteristics of the browser and device (fingerprint) and processed on HINTUP’s servers. The tools do not write cookies or any other data to the end customer’s browser or device. It contains no name, e-mail or other data that directly identifies the person and is not used to track them across other sites.
8.3 This identifier is linked to an e-mail or account only when the end customer enters their details in the store (login, checkout, form or poptop), and then under the store’s privacy policy.
8.4 The customer is responsible for displaying in its store the cookie and technology notice required by the law of its country, including a mention of HINTUP tools.
9. Security and incidents
9.1 HINTUP adopts technical and administrative measures proportionate to the risk: encryption in transit (TLS), additional encryption of data in the browser before sending, asymmetric-key encryption of personal data on entry to the servers (personal identifiers are stored encrypted), credential-based access control with least privilege, access logging, backups, per-customer data isolation (multitenant) and periodic supplier review.
9.2 No system is fully secure. HINTUP is not liable for incidents caused solely by third parties or by the data subject, such as a shared password or a compromised device.
9.3 In the event of a security incident that may cause relevant risk or harm to data subjects, HINTUP notifies the ANPD and the affected data subjects or customers within a reasonable time, under art. 48 of the LGPD, stating the nature of the data, the risks and the measures taken.
10. Minors
10.1 HINTUP services are intended for businesses and persons over 18. HINTUP does not create accounts for minors. Data of minors received through the customers’ stores is processed according to the customer’s instructions, and the customer must comply with art. 14 of the LGPD.
11. Changes to this Policy
11.1 HINTUP may change this Policy to reflect changes in the service, in providers or in the law. Material changes are communicated to customers by e-mail or dashboard notice at least 15 (fifteen) days in advance; other changes, by publishing the new version with the updated date at the top.
11.2 Continued use after the new version takes effect constitutes acknowledgement. A customer who disagrees may cancel the subscription under the Refund Policy.
12. Jurisdiction, governing law and final provisions
12.1 This Policy is governed by the laws of Brazil. The courts of the city of São Paulo/SP, Brazil, are elected, except that data subjects who qualify as consumers may bring claims in the courts of their own domicile.
12.2 The invalidity of any clause does not affect the others.
12.3 Questions about this Policy: channels at hintup.io/contact, subject “LGPD”.
12.4 In case of discrepancy between this English version and the Portuguese version, the Portuguese version prevails.
A HintUP® increases your average ticket contact us
No cancellation fee! You stay with us for the results achieved!