Privacy Policy

1. Who we are

Futuriza, registered under CNPJ 53.532.749/0001-46, with offices at Rua Leocádia Pedra Santos, 115, Vitória/ES, 29.050-370, and Rua Dona Francisca, 8300, Joinville/SC, 89.219-600, Brazil. Futuriza is the controller of the data described in this policy.

Contact for privacy matters and our data protection officer (DPO): privacidade@futuriza.io.

2. Data we collect

We collect only the data we need to provide our services:

• Contact data sent through the website forms: name, email, phone, company and the message sent.
• Platform account data: name, email and the identifier of the account used to sign in (including Sign in with Google).
• Content uploaded by clients: product photos, reference images, briefings, comments and approvals.
• Browsing data: IP address, browser type, pages visited and cookies, collected by Google Tag Manager and Google Analytics/Google Ads.
• Google account data, only when the user connects Google Drive (detailed in section 3).

3. Google Drive data

Futuriza's delivery portal lets clients import product photos directly from Google Drive folders. This integration is enabled only when the user chooses to connect their Google account and grants access on Google's consent screen.

Data accessed. With the Google Drive read-only permission (drive.readonly), Futuriza accesses:

• the identifier and email address of the connected Google account;
• the name and file list of the folders the user chooses to import or watch;
• the content of the image files in those folders, plus each file's name, type and modification date;
• the OAuth access tokens Google issues for that connection.

Use. Google Drive data is used only to: (a) import the photos in the chosen folders into the client's project on the platform; (b) periodically check the folders the client asked us to watch and import new photos; and (c) produce the image and video deliverables the client ordered from those photos. Futuriza does not read files outside the folders the user chose, does not modify or delete anything in Google Drive, and does not use this data for advertising, user profiling or any purpose unrelated to the service.

Storage. Imported photos are copied to Futuriza's cloud storage (Google Cloud and Amazon Web Services) and linked to the client's project. OAuth tokens are stored server-side only, with restricted access, and are never exposed to other users' browsers.

Sharing. Imported photos may be sent to artificial intelligence providers that process the images on our behalf to produce the deliverables (listed in section 5). These providers act as processors, under contract, only to perform the service. Google Drive data is not sold, not shared with third parties for advertising, and not transferred for any other purpose.

Artificial intelligence. Data obtained through Google APIs is not used to develop, improve or train generalized artificial intelligence or machine learning models, whether ours or third parties'.

Human access. Futuriza staff view imported photos only to perform the contracted service (for example, quality control of deliverables), to provide support at the client's request, for security reasons, or when required by law.

Revocation. Users can disconnect a watched folder at any time inside the platform, and can revoke all of Futuriza's access to their Google account at myaccount.google.com/permissions. To request deletion of the tokens and imported photos, write to privacidade@futuriza.io.

Futuriza's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. How we use data

• Providing the contracted services: generating, reviewing and delivering product photos and videos.
• Answering sales inquiries and providing support.
• Sending project progress notifications (email and WhatsApp).
• Keeping the platforms secure and preventing fraud.
• Measuring website and marketing campaign performance, from browsing data.
• Complying with legal and regulatory obligations.

The legal bases are performance of a contract, legitimate interest, compliance with a legal obligation and, where applicable, consent (LGPD, article 7).

5. Who we share data with

We share data only with processors that help us provide the service, always limited to what is necessary:

• Infrastructure and storage: Google Cloud (including Firebase) and Amazon Web Services.
• AI image and video processing: Google Vertex AI, OpenAI, Replicate, BytePlus, Kling and Higgsfield.
• Communication: email and WhatsApp messaging providers.
• Website measurement: Google Analytics and Google Ads.

We may also share data when required by law or by order of a competent authority. We do not sell personal data.

6. International transfers

Some of these providers process data outside Brazil, mainly in the United States. In those cases we rely on the safeguards in LGPD article 33, such as data protection contractual clauses.

7. Retention and deletion

Each project's files and deliverables are kept for the term of the contract and up to 6 months after it ends (or 90 days after delivery for credit-based purchases), as set out in the Terms of Use. After that, they are deleted.

Google Drive tokens are kept while the connection is active and are deleted at the user's request. When access is revoked at Google, they stop working immediately.

Data needed to meet legal obligations, such as tax records, is kept for the period the law requires.

8. Security

We use encryption in transit (HTTPS/TLS), per-account and per-project access control, server-side-only credentials, and internal access restricted to the staff who need the data to do their work. No system is completely immune to incidents; if one affects your data, we will notify you and the ANPD as the law requires.

9. Your rights

You may at any time request confirmation of processing, access, correction, anonymization, portability or deletion of your data, information about sharing, and withdrawal of consent, by writing to privacidade@futuriza.io. We reply within 15 days. You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

10. Cookies

The website uses first- and third-party cookies (Google Tag Manager, Google Analytics and Google Ads) to measure visits and campaign performance. You can block or delete cookies in your browser settings.

11. Changes to this policy

We may update this policy. The date of the last update is shown at the top of the page. Material changes, especially regarding the use of Google data, will be communicated to clients before they take effect.