Privacy Policy
How Sendyx Softwares handles your personal data
Last updated: October 13, 2026
1. Introduction
Sendyx Softwares ("we", "our" or "Sendyx") respects your privacy. This Policy describes how we handle personal data when you use our software platform (SaaS) for business management, sales of digital products, relationship management with contacts and integrations (including Instagram-related features), when you use our data API and the developer console, and how we handle public data of content creators and stores that feed the Radar and the API, in compliance with the Brazilian General Data Protection Law (Law 13,709/2018, the LGPD).
2. Controller and data protection officer
The controller of the personal data processed under this Policy is Sendyx Softwares. To exercise your rights or ask questions about privacy, use the channels listed in the "Contact and data protection officer" section below.
3. Data we may process
3.1 Registration and account
Name, email, phone number, document (CPF/CNPJ when required), country (detected from your IP address, provided by you, through Google sign-in or from your WhatsApp country code; editable in your profile, except with an active subscription), access credentials and profile preferences.
3.2 Use of the Platform (Producer)
Contact data, sales pipeline, operational messages, product settings, pages and checkouts, usage logs and support.
3.3 Buyers and transactions
Data needed to process purchases of digital products (identification, contact, address where applicable, order history and payment status). Part of this data may be shared with the Producer to perform the sales contract.
3.4 Payments
Billing and transaction data is handled largely by payment providers (such as Asaas). We do not store full card numbers on our servers as a replacement for the gateway.
For accounts whose country is outside Brazil, billing is done by Stripe, in US dollars. Stripe handles payment data as an operator, under its own terms. Card data is entered directly with Stripe and does not pass through Sendyx. The same applies to the purchase of public API credits in US dollars. We use the account's country to define the currency and the payment provider.
3.5 Instagram and Meta
When you connect an Instagram account or use automations, we may process account identifiers, authorization tokens, metadata needed for the integration, and message contents or interactions processed by the feature (according to the permissions granted and Meta policies).
3.6 Technical data and security
IP address, browser type, date and time of access, device identifiers and access records to systems, as required by law and good security practices (Marco Civil da Internet).
3.7 Data API and developer console
When you use the API, we process your account and billing data (name, email, document, credit purchase orders and payment status), your access keys (we keep only a cryptographic signature and the first and last characters so you can recognize them; the full secret is shown only once), your acceptance of the API terms of use (version, date and time and technical browser information) and the usage records.
We record every request made to the API, including refused ones (no key, invalid, revoked or expired key, blocked account, no balance or over the limit). Each record holds: date and time, IP address, account and key when there is one (of the key, only the visible leading characters, never the secret), route queried, result (status code and, when there is one, error code), response time, credits charged and identification of the client that made the request (user agent). The record does not keep the body or the query parameters. We use these records to operate and bill the service, apply limits, prevent fraud and abuse and comply with legal obligations. Separately, each creator contact lookup records which creator was queried, without keeping the contact in that record.
3.8 Public data of content creators and stores
The Radar and the API gather TikTok Shop market data obtained from public pages and from market data providers: products, videos, stores and creators (display name, public identifier, avatar, public performance metrics and category). When creators themselves make professional contact details public on their profile, such as email and WhatsApp, those contacts may also be offered to API customers, only for B2B commercial prospecting (proposing a partnership, affiliation or promotion), individually and tied to the creator's professional activity. We do not collect sensitive data of creators or access private accounts.
We act as the controller of this public data. Our legal basis is legitimate interest (art. 7, IX, of the LGPD), considering that the data was made manifestly public by the data subject (art. 7, paragraphs 3 and 4), respecting purpose, good faith, public interest and the rights of the data subject. API customers undertake, in the terms of use, to use the contacts only for the permitted purpose, to have their own legal basis, not to resell or redistribute them and to honor data subject requests. A creator contact kept temporarily in cache is deleted after a short period (today, up to 90 days after the cache expires).
Are you a creator and want removal? Ask through the privacy email in the "Contact and data protection officer" section, stating your public profile. Once the request is honored, your contact stops being delivered to any customer and the cached data is deleted. You can also ask who received your contact and object to the processing (art. 18, paragraph 2), through the same channel.
4. Purposes and legal bases
We process data based on:
- Performance of a contract: providing the Platform, processing orders and payments, and defining the currency and the payment provider from the account's country;
- Legitimate interest: security, fraud prevention, improving the service, aggregated metrics and the offering of public market data and public professional contacts of creators, observing a balance with the rights of data subjects;
- Legal or regulatory obligation: compliance with inspections and legal orders;
- Consent: when required (for example, non-essential marketing communications), which may be withdrawn at any time.
6. Marketing communications
Sending news, offers or promotional content about Sendyx may take place based on consent or another applicable legal basis. You can unsubscribe or object where provided, through the opt-out links or the contact listed in this Policy.
7. International transfer
If data is stored or processed outside Brazil (for example, in cloud providers or global services), we will adopt safeguards compatible with the LGPD, including contractual clauses or adequacy decisions when applicable.
8. Retention
We keep data for as long as necessary to fulfill the purposes of this Policy, legal periods (including tax and labor, when applicable) and the resolution of disputes. Access records may be kept for the minimum legal period set by the Marco Civil da Internet (six months for application access records).
API usage records, including those of refused requests, follow their own periods. The client identification (user agent) is deleted after 30 days. The date and time, the IP address and the rest of each record are kept for six months, as required by the Marco Civil da Internet (art. 15) for application access records, and then deleted.
If you delete your account, the client identification in your API usage records is deleted immediately. The rest of the access record is kept until the six months of the legal period are complete, to comply with that obligation (art. 16, I, of the LGPD), and is then deleted. Credit and billing entries follow the period set by tax law.
Creator contacts kept in cache are deleted after a short period and immediately when the creator asks for removal.
10. Your rights (LGPD)
Under the LGPD, you may request:
- Confirmation of processing and access to the data;
- Correction of incomplete or outdated data;
- Anonymization, blocking or deletion of unnecessary or excessive data;
- Portability, when applicable;
- Information about sharing and about the possibility of not giving consent;
- Withdrawal of consent and objection to processing based on legitimate interest, when applicable.
If you are a content creator and your public data appears in the Radar or the API, the same rights apply to you, including removal of your contact (see section 3.8).
Requests can be made through the email below or through the Support Center.
11. Security incidents
We implement technical and organizational measures to protect data. In case of an incident that compromises personal data and may cause relevant risk or harm to data subjects, we will notify those affected and the Brazilian National Data Protection Authority (ANPD) when required by the LGPD, without prejudice to other legal obligations.
12. Information security
We adopt controls such as encryption in transit when applicable, environment segregation, access controls and monitoring. No system is free of risk; that is why we keep an incident response plan.
13. Minors
The Platform is not intended for people under 18. Any processing involving children and adolescents, if it is ever necessary, will observe the rules of the LGPD and of the Brazilian Statute of the Child and Adolescent.
14. Assignment and continuity of processing
In case of a merger, acquisition or reorganization involving Sendyx, the data may be transferred to the successor, provided the purposes of this Policy and the applicable law are respected, with notice to data subjects when required by law.
15. Changes to this Policy
We may update this Policy. The date at the top indicates the version in force. Relevant changes may be communicated by email or a notice on the Platform.
16. Contact and data protection officer
Email (privacy and LGPD rights): contato@sendyx.com
Support Center: Go to support