Privacy Policy
PROVEI.AI
Last updated: January 2026
Data Controller Identification
This Privacy Policy describes how Reverbs Ai Tecnologias LTDA, a private-law legal entity registered under CNPJ No. 52.162.463/0001-53, headquartered at Alameda Vicente Pinzon, 54 - 3º andar - Vila Olímpia, São Paulo - SP, CEP 04547-130 (hereinafter referred to as "PROVEI.AI", "we", or "our"), collects, uses, stores, shares, and protects the personal data of users of our virtual try-on platform.
PROVEI.AI acts as CONTROLLER of the personal data of Clients (retailers and companies that contract our services) and as OPERATOR of the personal data of End Consumers who use the virtual try-on feature on our Clients’ websites.
Data Protection Officer (DPO)
The Data Protection Officer may be contacted by email [email protected]. The Data Protection Officer’s full identification will be made available in this Policy and communicated to the Autoridade Nacional de Proteção de Dados (ANPD) as soon as the officer is formally appointed.
Definitions
For purposes of this Privacy Policy, the following definitions apply:
Personal Data
Information relating to an identified or identifiable natural person.
Sensitive Personal Data
Data concerning racial or ethnic origin, religious belief, political opinion, membership in a trade union or a religious, philosophical, or political organization, data concerning health or sex life, and genetic or biometric data.
Processing
Any operation performed on personal data, such as collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation, or control of the information.
Controller
A natural or legal person, under public or private law, who is responsible for decisions regarding the processing of personal data.
Operator
A natural or legal person, under public or private law, who processes personal data on behalf of the controller.
Personal Data Collected
3.1. Client Data (Retailers)
| Category | Data Collected | Purpose |
|---|---|---|
| Registration Data | Name, corporate name, CNPJ, address, email, telephone | Identification, registration, and communication |
| Financial Data | Bank details, payment information | Processing charges and refunds |
| Product Data | Product catalog, images, descriptions, prices | Provision of the virtual try-on service |
| Website Data | URL, integration settings, technical data | Widget integration and functionality |
| Analytics Data | Google Analytics metrics, platform usage data | Performance analysis and service improvement |
3.2. End Consumer Data
| Category | Processed Data | Note |
|---|---|---|
| Personal Images | Photographs uploaded by the user (selfies, body photos) | NOT STORED |
| Environment Images | Photographs of spaces for furniture/decor visualization | NOT STORED |
IMPORTANT
PROVEI.AI does NOT store the images uploaded by End Consumers. Photographs are processed exclusively to generate the virtual visualization and are immediately discarded after processing. Personal or environment images are not retained on our servers.
Legal Bases for Processing
PROVEI.AI’s processing of personal data is based on the following legal bases provided for in the Lei Geral de Proteção de Dados (Law No. 13.709/2018):
| Type of Processing | Legal Basis (LGPD) | Basis |
|---|---|---|
| Clients’ registration and financial data | Art. 7º, V - Performance of a contract | Necessary to provide the contracted service |
| Processing of End Consumers’ images | Art. 11, I - Specific consent | Consent obtained when the image is uploaded |
| Analytics data and usage metrics | Art. 7º, I - Consent | Google Analytics 4 enabled only after consent |
| Essential cookies | Art. 7º, V - Performance of a contract | Proper platform functionality |
Data Sharing
PROVEI.AI may share personal data with the following categories of third parties:
Cloud Infrastructure Providers
We use cloud computing services to host and process data, including Amazon Web Services (AWS) and Google Cloud Platform (GCP).
Payment Processor
Financial transactions are processed by Stripe, which acts as an independent operator for payment data in compliance with PCI-DSS standards.
Artificial Intelligence Services
To process images and generate virtual try-on visualizations, we use specialized third-party AI services.
Our Commitment
PROVEI.AI does not sell, rent, or commercialize its users’ personal data to third parties for marketing purposes or any other purpose unrelated to providing the service.
International Data Transfer
Personal data collected by PROVEI.AI is transferred to and stored on servers located in the United States of America.
This international transfer is carried out in accordance with Art. 33 of the LGPD, using the following protection mechanisms:
- Standard contractual clauses approved by the Autoridade Nacional de Proteção de Dados (ANPD), pursuant to Resolução CD/ANPD No. 19/2024
- Technical and organizational security measures implemented by infrastructure providers (AWS and GCP)
- Contractual commitments from our subprocessors to maintain protection standards equivalent to those established by the LGPD
By using our services, you acknowledge and agree to this transfer, which is necessary to perform the contract under Art. 33, IX, of the LGPD.
Data Retention and Deletion
7.1. Retention Periods
| Data Type | Retention Period |
|---|---|
| Clients’ registration data | Term of the contract + 5 years (civil limitation period) |
| Financial and tax data | Term of the contract + 5 years (legal obligation) |
| Application access logs | 6 months (Marco Civil da Internet) |
| Images uploaded by End Consumers NOT RETAINED | Discarded immediately after processing |
| Generated images (outputs) | Indefinite period |
| Cookie data | According to the Cookie Policy (maximum 12 months) |
7.2. Data Deletion
Personal data will be deleted at the end of the retention period or upon the data subject’s request, subject to legal exceptions that authorize retention (compliance with a legal obligation, the regular exercise of rights in legal proceedings, or the controller’s legitimate interest).
Data Subject Rights
In accordance with Art. 18 of the LGPD, data subjects have the following rights:
Confirmation
Of the existence of processing
Access
To processed personal data
Correction
Of incomplete, inaccurate, or outdated data
Anonymization
Blocking or deletion of unnecessary data
Portability
Of data to another service provider
Deletion
Of personal data processed with consent
Information
About data sharing
Withdrawal
Of consent at any time
8.1. How to Exercise Your Rights
To exercise any of the rights above, the data subject must contact us by email [email protected], providing:
- Full name and identification details
- A clear description of the right you wish to exercise
- Additional information that helps locate the data
8.2. Response Times
Simplified response
Immediately or within 15 days
Complete statement
Within 15 days from the date of the request
Cookies and Tracking Technologies
PROVEI.AI keeps analytics storage denied by default. Google Analytics 4 loads only after consent; we do not use Google Tag Manager, and marketing storage remains inactive.
9.1. Types of Cookies Used
| Type | Purpose | Consent |
|---|---|---|
| Essential | Basic platform functionality, authentication, security | Not required |
| Analytics | Google Analytics 4 usage and performance analysis | Optional consent |
9.2. Cookie Management
Users can allow or reject analytics in the banner. To choose again, they can clear this site’s data in their browser settings. The preference is stored for no more than 12 months. Necessary storage remains active for essential features.
Data Security
PROVEI.AI adopts appropriate technical and organizational measures to protect personal data against unauthorized access, destruction, loss, alteration, or any form of improper or unlawful processing, including:
In the event of a security incident that may pose a risk or cause significant harm to data subjects, PROVEI.AI will notify the ANPD and affected data subjects within a reasonable period, in accordance with Art. 48 of the LGPD.
Marketing Communications
PROVEI.AI may send marketing communications, including product news, service updates, and promotional offers, with the data subject’s prior consent.
Opt-out
Data subjects may stop receiving marketing communications at any time through the unsubscribe link in each email or by contacting us at [email protected]. Cancellation will be processed within 5 business days.
Opting out of marketing communications does not affect transactional communications necessary to provide the service (payment confirmations, security alerts, or contractual changes).
Children’s Data Protection
PROVEI.AI’s services are intended exclusively for individuals aged 18 (eighteen) or older. We do not knowingly collect personal data from minors.
If we learn that a minor’s data was collected inadvertently, we will take immediate steps to delete that information from our systems.
If you are a parent or legal guardian and believe your child has provided us with personal data, please contact us by email [email protected].
Artificial Intelligence and Automated Decisions
PROVEI.AI uses artificial intelligence technology to process images and generate virtual try-on visualizations.
Important Statement
PROVEI.AI does NOT use users’ personal data to train artificial intelligence models. Images are processed exclusively to generate the requested virtual visualization.
AI image processing constitutes an automated processing operation. If a user believes that an automated decision has affected their interests, they may request clarification or review through our support channel.
Changes to This Policy
PROVEI.AI may update this Privacy Policy periodically to reflect changes in our practices, services, or applicable law.
Material changes will be communicated through:
- A prominent notice on our platform
- Email to registered Clients
- Updating the “last updated” date at the beginning of this document
Continued use of our services after changes are published constitutes acceptance of the new version of the Privacy Policy. If the Client disagrees with the changes, the Client may terminate the contract as provided in the Terms of Service.
Applicable Law and Jurisdiction
This Privacy Policy is governed by the laws of the Federative Republic of Brazil, especially Law No. 13.709/2018 (Lei Geral de Proteção de Dados Pessoais), the Marco Civil da Internet (Law No. 12.965/2014), and the Código de Defesa do Consumidor (Law No. 8.078/1990), where applicable.
The courts of the District of São Paulo, State of São Paulo, are elected as the competent forum to resolve any disputes arising from this Policy, with express waiver of any other forum, however privileged, without prejudice to the consumer’s right to choose the courts of their domicile under Art. 101, I, of the CDC.
Contact
For questions, requests, or complaints regarding this Privacy Policy or the processing of your personal data, please contact us:
Reverbs Ai Tecnologias LTDA
CNPJ: 52.162.463/0001-53
Alameda Vicente Pinzon, 54 - 3º andar
Vila Olímpia, São Paulo - SP, CEP 04547-130
- End of Document -