Privacy Policy
This Policy describes how Vyzko Tecnologia da Informação Ltda. (CNPJ 68.798.965/0001-05, Av. Primeira Avenida, Quadra 01B, Lote 10, Sala 103, Condomínio Empresarial Village, Aparecida de Goiânia/GO, Brazil, ZIP 74934-600), hereinafter "Vyzko", processes personal data on the website vyzko.app and on the Vyzko GRC platform, in compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD") and other applicable rules.
1. Roles in processing
| Data | Vyzko's role | Examples |
|---|---|---|
| Registration, billing, account usage and sales contact data | Controller | Name, corporate e-mail, company, CNPJ, phone number, access logs, invoices |
| Personal data entered by the Customer into the platform (Customer Content) | Processor, on behalf of the Customer (controller) | Employee names in assessments, vendor contacts, incident records, records of processing activities (ROPA) |
When acting as processor, Vyzko processes data only according to the Customer's instructions, for the provision of the contracted services, and assists the Customer in responding to data subject requests.
2. What data we collect and why
| Category | Data | Purpose | Legal basis (LGPD) |
|---|---|---|---|
| Registration and account | Name, corporate e-mail, password (stored as a hash), company, job title, language | Create and manage the account, authenticate access, send operational communications | Performance of contract (art. 7, V) |
| Company data | Company name, CNPJ, address, municipal registration | Contracting, billing and invoice issuance | Performance of contract and legal obligation (art. 7, II and V) |
| Payment | Customer and subscription identifiers at Stripe, chosen payment method, payment status. Vyzko does not store the full card number. | Billing and subscription management | Performance of contract (art. 7, V) |
| Usage and security | IP address, access date and time, browser, relevant actions recorded in the audit trail | Security, fraud prevention, auditing and compliance with the Brazilian Internet Civil Framework (Marco Civil da Internet) | Legal obligation and legitimate interest (art. 7, II and IX) |
| Support and contact | Name, e-mail, phone number, content of messages | Handle requests, provide support and present the product | Legitimate interest and performance of contract |
| Customer Content | Information entered by the Customer: assessments, risks, policies, evidence, vendors, incidents, obligations | Provide the platform's features | On the Customer's instructions (processor) |
| AI features | Excerpts of Customer Content sent to language models to generate summaries, reports and recommendations | Deliver the AI-assisted features requested by the user | Performance of contract; on the Customer's instructions |
| AI usage | Organization, user, date, model and number of tokens of each use of the AI features (without the content of the requests) | Apply the fair use limits, control costs and prevent abuse | Performance of contract and legitimate interest (art. 7, V and IX) |
We do not intentionally collect sensitive personal data. If the Customer enters sensitive data into Customer Content, it is responsible for ensuring an appropriate legal basis.
3. Cookies and local storage
The platform uses the browser's local storage and strictly necessary cookies to keep the authenticated session and preferences such as language. We do not use advertising cookies or third-party trackers for marketing purposes. Users can clear this data in their browser settings, which will end the session.
4. Who we share data with
We share data only with providers necessary for the operation of the platform (sub-processors), all subject to contractual confidentiality and security obligations:
| Provider | Service | Processing location |
|---|---|---|
| Supabase | Database, authentication, storage and back-end functions | United States (AWS infrastructure) |
| Vercel | Web application hosting and content delivery network | United States, with global points of presence |
| Stripe | Payment processing | Brazil and United States |
| Resend | Transactional e-mail delivery | United States |
| Anthropic | Language models for the AI features | United States |
| Microsoft 365 | Corporate e-mail and support | Brazil and United States |
| Electronic service invoice (NFS-e) provider | Issuance of service invoices | Brazil |
We may also share data when required by law, court order or competent authority, and in corporate transactions, with prior notice to Customers. We do not sell personal data.
5. International transfer
Some of the providers above process data outside Brazil. These transfers are carried out under article 33 of the LGPD, through contractual clauses that ensure a level of protection equivalent to that required by Brazilian law and, where applicable, for the performance of the contract with the Customer.
6. Security
- Encryption in transit (TLS) and at rest.
- Role-based access control, data isolation by organization and two-factor authentication available.
- Audit trail with verifiable integrity for relevant actions.
- Periodic backups, monitoring and request rate limiting.
- Secrets and keys stored in credential vaults, outside the source code.
No system is completely immune to incidents. In the event of a security incident with relevant risk to data subjects, Vyzko will notify the Brazilian National Data Protection Authority (ANPD) and the affected Customers within the legal deadlines.
7. Retention
| Data | Period |
|---|---|
| Account and Customer Content | For the duration of the subscription. After termination, available for export for 30 days and deleted within 90 days. |
| Access records (logs) | At least 6 months, as required by the Brazilian Internet Civil Framework (art. 15). |
| Tax and billing data | 5 years, as required by tax legislation. |
| Sales contacts (leads) | Up to 24 months after the last contact, or until a deletion request. |
| AI usage records | 13 months, with automatic deletion. |
8. Your rights
Under article 18 of the LGPD, data subjects may request: confirmation that processing exists; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data; portability; information about sharing; information about the possibility of not giving consent; withdrawal of consent; and objection to irregular processing.
To exercise your rights, write to privacidade@vyzko.app. We will respond within 15 (fifteen) days. When Vyzko acts as processor, we will forward the request to the responsible Customer or advise the data subject to contact it directly. Data subjects may also file a complaint with the ANPD.
9. Data Protection Officer (DPO)
E-mail: privacidade@vyzko.app
Address: Av. Primeira Avenida, Quadra 01B, Lote 10, Sala 103, Condomínio Empresarial Village, Aparecida de Goiânia/GO, Brazil, ZIP 74934-600
10. Children and adolescents
The platform is intended for legal entities and their employees. We do not intentionally collect data from individuals under 18 years of age.
11. Changes to this Policy
We may update this Policy to reflect legal or operational changes. The current version will always be available at vyzko.app/privacidade.html, with the date of the last update. Material changes will be communicated by e-mail or notice on the platform.