Privacy Policy

1. Who the data controller is

The controller of the personal data processed on the platform is Luz de Lima Tecnologia (Brazilian company registry no. 44.752.697/0001-22), responsible for the Avexi platform (“we,” “us,” “our”). For any matter relating to privacy and data protection, contact our data protection officer at noronhalimasolutions@gmail.com.

There is one exception, described in section 8: on the public pages we host on behalf of our clients, it is the advertiser client who decides about the processing. There they are the controller and we process the data on their behalf.

2. Definitions

• Personal data: information relating to an identified or identifiable natural person.
• Data subject: the person to whom the personal data refers.
• Processing: any operation performed on personal data (collection, use, storage, sharing, deletion, etc.).
• Processor: whoever processes personal data on behalf of a controller. As a rule we are the controller and the processors are third parties that process data on our behalf (e.g., cloud, AI, and payment providers). In the exception described in section 8 the roles are reversed: the controller is the advertiser client and the processor is us, processing on their behalf.

3. Data we collect and process

We process the following categories of data, depending on how you use the platform:

• Registration and account: name, email, password (stored only as a hash, never in plaintext), role/profile, and avatar photo (optional).
• Billing and subscription: processed by Stripe — name, email, plan, and customer/subscription identifiers. Card data is handled directly by Stripe; we do not store card numbers.
• Agency clients and contacts: data you enter about your clients (name, email/contact, notes). You are responsible for having a legal basis to enter it.
• Leads: name, email, phone, source, status, and message, captured through public forms you create.
• Platform connections: when you connect Meta/Facebook, Instagram, LinkedIn, or repository (GitHub/GitLab) accounts, we store the access tokens in encrypted form along with the permissions granted.
• Connected-platform data: identifiers for ad accounts, pages, and profiles, plus campaign metrics and statistics (impressions, clicks, reach, spend) used for management and optimization.
• Content and media: text, images, creatives, and other materials you create, upload, or generate on the platform.
• Internal usage and events: records of your use of the platform (product events, technical logs) for security and improvement. We do not use third-party pixels on our own website. On the pages we host for our clients (property pages and lead capture forms), the client may enable the Meta Pixel — see the dedicated section below.

4. Why we use the data (purposes)

• Create and manage your account, authenticate access, and provide support.
• Operate the platform: generate content, create and manage campaigns, publish, and measure results.
• Process subscriptions and charges and control resource usage.
• Send operational communications (invitations, notices) and, with consent, marketing/lead-nurturing communications.
• Ensure security, prevent fraud and abuse, and comply with legal obligations.
• Improve the platform and develop new features.

5. Legal bases (LGPD, art. 7)

• Performance of a contract: to provide the features you subscribe to.
• Consent: for lead nurturing and marketing communications (opt-in), revocable at any time.
• Legitimate interest: for security, fraud prevention, internal analytics, and service improvement, always respecting your rights.
• Compliance with a legal/regulatory obligation where applicable.

6. Sharing and processors (subprocessors)

We do not sell your data. We share data only with processors necessary to provide the service, which process it in accordance with our instructions and their own privacy policies — with the exception described in section 8, where Meta acts as an independent controller:

• Meta Platforms (Facebook/Instagram) — publishing and managing ads and content. For the conversion events described in section 8, Meta does not act as our processor: there it is an independent controller and also processes the events it receives for its own purposes, under its own policies.
• LinkedIn — publishing and managing ads and content.
• Google (Gemini), OpenAI/OpenRouter, Replicate, and Anthropic — AI generation of text, images, video, and audio.
• Stripe — payment and subscription processing.
• Resend — delivery of transactional and marketing emails.
• Infrastructure/hosting provider (cloud) — storage and operation of the platform and media.

We may also share data to comply with a court order or legal requirement, or to protect rights, always within the limits of the law.

7. Use of data from Meta Platforms (Facebook and Instagram)

When you connect a Meta account, we access only the data authorized by the permissions granted (for example, ad accounts, pages, and metrics). This data is used solely to operate ads and posts on your behalf within the platform. We do not sell this data, do not use it for unrelated purposes, and do not transfer it to third parties outside the processors above. Access tokens are stored in encrypted form, and you may revoke access at any time by disconnecting the account on the platform or in Facebook’s security settings.

8. Meta Pixel and Conversions API on the pages we host for clients

Besides our own website, Avexi hosts public pages on behalf of its clients — property pages and lead capture forms. When the client turns measurement on for their project, those pages load the Meta Pixel and also send conversion events to Meta from the server, through the Conversions API, so the client can measure and optimize their own ads. This happens at two moments. When the page loads, the Pixel records the visit (a PageView event) and sends Meta technical browsing data, even if you never fill anything in — and with JavaScript disabled, a tracking image does the same job. When you submit the form, and later when the advertiser records that the contact was qualified or turned into a deal, your contact details go too, always hashed.

What is sent to Meta

• Contact identifiers only as SHA-256 hashes (email, phone, and name). This data never leaves us in clear text.
• Technical browsing data: the IP address, the browser user agent, and the address (URL) of the page you are on.
• The _fbp and _fbc cookies, written by the Pixel in the browser, which link the visit to the ad you clicked.
• Nothing else — the text of your message and the remaining form fields are not sent to Meta.

Roles of each party

• The Avexi client — the advertiser who owns the ad account and the Pixel — is the controller of this processing: they decide to turn measurement on and what the results are used for.
• Luz de Lima Tecnologia acts as a processor, handling this data on the client’s behalf and under their instructions.
• Meta is an independent controller for this specific use: the events it receives are also processed for its own purposes, under its own policies, outside our control.

Legal basis

This processing relies on performance of the contract between you and the advertiser and on the advertiser’s legitimate interest in measuring and optimizing their own ads (LGPD, art. 7, V and IX). It does not depend on the marketing consent — the opt-in checkbox on the forms exists for a different purpose, which is receiving communications and content by email.

How to object

You can object to this processing or ask for more information by writing to noronhalimasolutions@gmail.com — we forward the request to the advertiser responsible. You can also limit the use of this data in your Meta ad preferences and block cookies in your browser settings. Important: Meta retains the events it receives on its own account, under its own policies — deleting your data on our platform does not, by itself, erase what has already been delivered to Meta.

None of this happens on a project without an active Pixel. With no Pixel configured and measurement off, the page loads no Meta script, writes no _fbp/_fbc cookies, and no event is sent.

9. Artificial intelligence

To generate content, the materials and information you provide (text, brand data, reference images) may be sent to the AI providers listed above. AI-generated content may contain inaccuracies — we recommend human review before publication. Processing by the AI providers follows each one’s privacy policy.

10. International data transfers

Some processors are located outside Brazil (for example, in the United States). In such cases, the transfer is carried out under the grounds set out in the LGPD and with adequate contractual safeguards offered by internationally recognized providers.

11. Information security

• Passwords stored as a hash (bcrypt), never in plaintext.
• Third-party access tokens encrypted at rest with AES-256-GCM.
• Communications encrypted via HTTPS/TLS and authentication via tokens (JWT).
• Rate limiting on access attempts and abuse-prevention practices.

No system is entirely immune to risk; we work continuously to mitigate it.

12. Data retention

We keep data while the account is active and for as long as necessary for the purposes described or to comply with legal obligations. Once the relationship ends or a deletion request is fulfilled, the data is deleted or anonymized within a reasonable period, except where retention is required by law.

13. Your rights as a data subject (LGPD, art. 18)

You may, at any time, request:

• confirmation that processing exists and access to your data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary data or data processed unlawfully;
• portability and information about whom we share your data with;
• withdrawal of consent.

To exercise these rights, write to noronhalimasolutions@gmail.com.

14. Data deletion

You can request deletion of your account and associated data in two ways:

• By email: send a request to noronhalimasolutions@gmail.com with the subject “Data deletion,” from your registered email. We will process the request within 30 days.
• By disconnecting platforms: when you disconnect a Meta account (Facebook/Instagram) on the platform, the corresponding access token is revoked and removed. You can also remove the app under Settings > Apps and Websites on Facebook.

Deletion removes your personal data from the platform, including connections, content, and leads associated with the account, except for records the law requires us to keep.

15. Cookies and local storage

We use the browser’s local storage (localStorage) to keep your authenticated session (token) and usage preferences. On our own website we do not use third-party advertising tracking cookies. On the pages we host for our clients (property pages and lead capture forms), the client may enable the Meta Pixel, which writes the _fbp and _fbc cookies in the visitor’s browser — see the dedicated section above.

16. Data of children and adolescents

The platform is intended for people over 18 and for professional use. We do not knowingly collect data from minors.

17. Changes to this Policy

We may update this Policy from time to time. The date of the latest update appears at the top of the page. Material changes will be communicated through the appropriate channels.

18. Contact

Questions about this Policy or the processing of your data may be sent to our data protection officer at noronhalimasolutions@gmail.com. See also our Terms of Use.