Privacy Policy

Please read this document carefully: it explains our data-related practices, such as the data we process to provide our Services, and it applies to all of our Services unless otherwise specified.

Please also read the Terms of Use of our products and services, which describe the terms governing the provision and your use of courses and training offered through our Services.

Here we will specify:

What data we collect;
Why we collect this data; and
What we do with the data.

Who we are

The website https://aros.com.br, which you are accessing right now, is controlled by Uptide Solutions and Technology LTDA (also referred to as "we" or the "Controller"), headquartered at Alameda Rio Negro, 503, Sala 2020, ALPHAVILLE CENTRO INDUSTRIAL E EMPRESARIAL, Barueri SP, Brazil, 06448070. The Controller is responsible for the data transmitted to it by the User (also referred to as "you"), and has the duty to process your data within the legal bases authorized by law.

Data we process

We must receive or collect some data about you in order to operate, provide, improve, understand, personalize, support and advertise our Services. This data is provided or collected directly by/from you on our pages or when you purchase our products and Services through Stripe Checkout, which we use to process payments. Stripe processes the data needed for the transaction under its own Privacy Policy.

The types of data we receive and collect depend on how you use our Services. To provide our Services, we request certain information and, without it, we will not be able to offer those Services to you. For example, we need you to provide your name, e-mail address and mobile phone number so that we can deliver the information and instructions you requested when joining the waiting list to purchase one of our products or Services, or so that we can deliver one of our products or Services purchased through our checkout.

Our Services may include optional features and we need to collect additional data in order to provide them to you. Where applicable, you will be notified about this collection. If you decide not to provide the data required to use a feature, you will not be able to use it.

Data provided by you

Identity Data: first and last name provided by you;
Contact Data: physical address, e-mail address and phone numbers.
Profile Data: your comments, messages and/or information received through your interaction with us and other users through our Services, in the course of the delivery of our products or the provision of our Services, and answers to questionnaires.

You are responsible for updating any data provided to the Controller in the event of any change. Although we strive to keep your data up to date, and to review and inspect all information provided by you, we are unable to do so effectively without your help.

Data collected automatically

Technical Data: Internet protocol (IP) address, website login data, browser type and version, time zone setting and location, browser plug-in types and versions, operating system, platform and other technologies on the devices the User uses to access the website, and the use of cookies stored on your device.

Marketing and Communication Data: your preferences in receiving marketing from us regarding our Services and products or those of our partners, and your communication preferences. We use cookies to operate and provide our Services, improve your experience, understand how our Services are used and personalize them. For example, we use cookies to provide our web-based, desktop and other web-based services. We may also use cookies to display relevant content related to our Services. In addition, we may use cookies to remember your choices, such as language preferences, to offer a safer experience and to personalize our Services for you.

Third-party data

Data provided by third parties about you: We may receive data from other users about you. For example, when other users you know use our Services, they may provide your phone number, name and other data to share one of our Services or product offers. We require each of these users, including you when providing third-party data to us, to have legal authorization to collect, use and share your data before providing it to us.

Remember that, in general, any user can take screenshots of your messages or public profile while using our Services, in message groups or events, and send them to other people or post them on another platform.

User reports: Just as you may report other users, other users or third parties may also report your interactions and messages sent to them or to other people on our Services, for example, in order to report possible violations of our Terms or policies. When a report is made, we collect data from both the reporting user and the reported user.

Third-party service providers: We work with third-party service providers to help us operate, execute, improve, understand, personalize, support and advertise our Services. We work with these companies to obtain support for our Services, such as providing technical infrastructure, delivery and other systems, to market our Services, conduct research, safeguard the protection, safety and integrity of users and other people, and assist with customer service. When we share data with third-party service providers in this regard, we require them to use your data on our behalf in accordance with our instructions and terms.

The items above are collectively referred to as Personal Data.

Aggregated Data includes statistical or demographic data for any purpose. This data may be derived from your personal data, but is not considered personal data under the law, as it does not reveal your identity either directly or indirectly. An example of such Aggregated Data could be data we aggregate from your usage data to calculate the percentage of users accessing a specific website tool and/or preferences for services/products.

Instagram Business Integration (Meta Graph API)

When the user chooses to connect their Instagram Business account to the arOS platform, we collect the following data via the Meta Graph API, upon explicit consent given through OAuth (Instagram Business Login):

Data collected:

Profile identification: account ID, name, username (handle) and profile picture of the Instagram Business Account, obtained at the time of connection and refreshed at each session renewal.
Content publishing: the images and captions of carousels created in arOS are sent to the Meta Graph API exclusively for publishing on the user's own profile. After publishing, we store the identifier and the link (permalink) of the created post, in order to display the publishing history within the platform.

We do not read existing posts from the profile, messages, comments or audience metrics through the Meta Graph API.

Where the data is stored:

The data is stored in the arOS backend database (PostgreSQL hosted on Neon), with encryption at rest at the infrastructure layer. Access tokens are never exposed to the user's browser nor included in system logs.

Retention:

Profile data (handle, picture): kept while the Instagram connection is active.
Identifiers and links of published posts: kept while the arOS account is active, as part of the user's publishing history.
When the Instagram integration is disconnected, the access token and the Meta account identifiers are immediately deleted from our systems.
When the arOS account is deleted, all data linked to the Meta account is removed within 30 days.

Sharing:

We do not share Meta data with third parties. The data is processed exclusively by infrastructure providers essential to the operation of the arOS platform (database hosting and file storage), all subject to confidentiality agreements and compliance with applicable law.

Revocation:

The user can disconnect the Instagram integration at any time:

Within the arOS platform: profile menu (bottom of the sidebar) → Connections → Disconnect.
Directly on Instagram: Settings → Website permissions → Apps and websites → arOS → Remove (or at instagram.com/accounts/manage_access).

Data deletion requests:

In compliance with Meta's data policy, we provide a public data deletion endpoint (Data Deletion Callback), triggered automatically when the user removes the app in their Instagram settings. Upon receiving a request, the data linked to the Meta account is removed within 30 days. The user may also request deletion at any time by e-mail at [email protected].

LinkedIn Integration (LinkedIn API)

When the user chooses to connect their LinkedIn account to the arOS platform, we collect the following data via the LinkedIn APIs, upon explicit consent given through LinkedIn's own OAuth flow, in which the user reviews and authorizes the requested permissions before any data is collected:

Data collected:

Profile identification: the user's LinkedIn member identifier (ID) and name, obtained at the time of connection and updated when the connection is renewed.
Company pages (where applicable): the identifier, name and logo of the organization pages administered by the user, exclusively so that the user can select which page to publish to.
Content publishing: the text and images of posts created in arOS are sent to the LinkedIn APIs exclusively for publication on the user's own profile or on company pages they administer, at the time defined by the user. After publication, we store the identifier of the created post in order to display the publishing history and status within the platform.
Access tokens: we store the access and refresh tokens issued by LinkedIn, along with their expiration dates, exclusively to perform the publications authorized by the user.

We do not read private messages, connections, comments, reactions or profile data of other LinkedIn members. Every post is created and explicitly approved by the user — arOS never publishes content on the user's behalf without their instruction.

Where the data is stored:

Retention:

Profile and page data (ID, name): kept while the LinkedIn connection is active.
Identifiers of published posts: kept while the arOS account is active, as part of the user's publishing history.
When the LinkedIn integration is disconnected, the access tokens and the LinkedIn account identifiers are immediately deleted from our systems.
When the arOS account is deleted, all data linked to the LinkedIn account is removed within 30 days.

Sharing:

We do not share data obtained from LinkedIn with third parties, nor do we use data obtained to manage one customer's account for the benefit of other customers. The data is processed exclusively by infrastructure providers essential to the operation of the arOS platform (database hosting and file storage), all subject to confidentiality agreements and compliance with applicable law.

Revocation:

The user can disconnect the LinkedIn integration at any time:

Within the arOS platform: profile menu (bottom of the sidebar) → Connections → Disconnect.
Directly on LinkedIn: Settings & Privacy → Data privacy → Other applications → Permitted services → arOS → Remove.

Data deletion requests:

When the integration is disconnected (via arOS or via LinkedIn) or the arOS account is deleted, the data linked to the LinkedIn account is removed within the timeframes described above. The user may also request deletion of their data at any time by e-mail at [email protected].

Use of data

The processing of your data is carried out following the principles of lawfulness, fairness and transparency, always adhering to the intended purpose of the data processing, the principle of data minimization, accuracy, limited data storage, data integrity, confidentiality and accountability.

The Controller collects and processes your Personal Data always for at least one of the following reasons:

To perform the contract with you;
To comply with legal obligations;
To safeguard the legitimate interests of the User and the Controller.

Our Services: We use the data we have to operate and provide our Services, such as to offer support, complete purchases or transactions, improve, fix and personalize our Services and connect them to products or services you may use. We also use the data we have to understand how people use our Services, to evaluate and improve our Services, to research, develop and test new services and features, and to troubleshoot issues. We also use your data to respond when you contact us.

Protection, safety and integrity: Protection, safety and integrity are essential to our Services. We use the data we have to verify accounts and activities; to combat harmful conduct, protect users from bad experiences and unwanted messages (spam); to promote protection, safety and integrity within and outside our Services, investigating suspicious activities or violations of our Terms and Policies. We also use this data to ensure our Services are being used lawfully.

Communications about our Services: We use the data we have to contact you about our Services and to inform you about our terms, policies and other important updates. We may send you announcements about our Services and those of our partners.

Training of Artificial Intelligence Models

As part of the continuous improvement of our AI-based services, Uptide Solutions and Technology LTDA may use the data entered or generated by users on our platforms (including texts, prompts, commands, interactions and outputs) to train, fine-tune and improve our proprietary AI models, in anonymized form whenever possible.

This use is intended exclusively to improve the accuracy, usefulness and safety of the responses provided by arOS AI tools.

If you do not wish your data to be used for this purpose, you may request the exclusion of its use for training at any time by sending an e-mail to [email protected] with the subject "Opt-out of AI training use".

The request will be processed within up to 15 (fifteen) business days, and will not affect the lawfulness of the prior use of the data before the exclusion.

Age restriction

Our Website, products and services are not intended for minors, and we do not knowingly collect data relating to persons under 18 (eighteen) years of age.

As we do not allow Users under 18 (eighteen) years of age to use our services, we need to obtain your date of birth to confirm and verify your age.

In the event that you provide us with false data, and such falsehood is later discovered, all of your data, including website access data, will be promptly deleted without prior notice.

If you become aware of any improper processing of data of children and adolescents, please contact us at the e-mail address published in this policy so that we can take the appropriate measures.

Marketing opt-out

If you do not wish to receive any marketing newsletters, or object to the transmission of your data to third parties for marketing purposes, you may express your wish at the time of: (i) signing up to receive information about our Services and products, (ii) receiving advertising content, and (iii) at any time via the e-mail address published in this policy, requesting that we stop sending such advertising content or sharing your data with third parties for marketing purposes.

Data sharing

Your data is shared as you use and communicate through our Services, and we share your data to help us operate, provide, improve, understand, personalize, support and advertise our Services, as well as when:

Sharing is required by applicable law;
It is necessary for us to fulfill our contractual obligations to you;
It involves companies that contribute to the provision of our Services.

We require all companies that process data on our behalf to respect your data and treat it in accordance with the provisions of Brazilian Law no. 13,709/2018 (LGPD), Law no. 8,078/1990, and applicable regulations. We take all reasonable measures to ensure that our third-party service providers do not use your data for their own purposes, and only process it for the specific purposes, always in accordance with our instructions.

Please note that these companies may change from time to time, and we will do our best to update the relevant sections of this Privacy Policy in due course.

In addition, the transfer of your data to another legal entity may occur as part of a transfer of our business or parts of it in the form of a reorganization, sale of assets, consolidation, merger or similar.

If we are involved in a merger, acquisition, restructuring, bankruptcy or sale of all or most of our assets, we will share your transaction-related data with the successor entities or new owners in accordance with applicable data protection laws.

Corrective measures will be taken in response to the misuse or unauthorized disclosure of personal information by third parties that collect, store or process personal information on behalf of the Controller.

Users' information is processed preferably by electronic means. However, it may occasionally be handled by the Controller's employees and/or trusted third parties providing specific support services, such as user support, handling Users' specific accounts and services necessary for the provision of our services, bound by agreements signed to protect personal information consistent with this Privacy Policy and with Law 13,709/2018, and information security practices or measures implemented as prescribed by applicable laws.

International data transfer

We may use services from companies around the world for the purposes set out in this Privacy Policy. Depending on the scope of their activities, your personal information may be stored in or accessed from other countries.

Whenever we transfer your personal information to other jurisdictions, we will ensure that the information is transferred in accordance with this Privacy Policy, and at security levels compatible with Law 13,709/2018 of the Federative Republic of Brazil.

Data retention

We keep your data for as long as reasonably necessary to fulfill the purposes for which we collected it, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. We may retain your personal data for a longer period in the event of a complaint, or if we reasonably believe there is a prospect of litigation in respect of our relationship with you.

To determine the appropriate retention period for your data, we consider the amount, nature and sensitivity of the data, the potential risk of harm from unauthorized use or disclosure, the purposes for which we process the data, whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting and other requirements.

By law, we must keep your data during our contractual relationship for a minimum period of 5 (five) years from the end date of the Platform/Service used by the User. The data storage period may be extended from 5 (five) to 7 (seven) years if required by the competent authorities.

In general, all other data is stored for a period of 30 (thirty) business days after the end date of the provision of our services, unless there is any other legal or regulatory reason to keep it.

At the end of the data retention period, the data is erased by irreversible destruction. We will notify all third parties to whom the data was transferred of the deletion, and will require them to implement similar action.

Your rights, how to withdraw consent, and unsubscribe

You have several rights regarding data protection, in accordance with Law no. 13,709/2018 and our policies.

The right of access. You have the right to obtain confirmation as to whether or not your data is being processed by us and our contractors. In addition, you have the right to obtain detailed information about the data held and the processing carried out by us, and, under certain circumstances, the right to receive a copy of such data.

The right to rectification. You have the right to have incorrect data about you duly rectified, and to have incomplete data properly completed. You can make such rectifications yourself, and we encourage you to do so, through the settings panel located within the User area.

The right to erasure. You have the right to ask us to delete or remove personal data when there is no reason for us to continue processing it. Note, however, that we may not always be able to comply with your request to erase the data, for specific legal reasons, which will be notified to you, if applicable, at the time of your request. If you wish for the complete removal and destruction of the data (by exercising the "right to be forgotten"), please note that we may not always be able to comply with your request to erase the data, for specific legal reasons, which will be notified to you, if applicable, at the time of your request.

The right to restrict processing. You have the right to request the restriction of the processing of your personal data (a) if the processing is not necessary; (b) in cases where the processing may be unlawful, but you do not want us to erase your data; (c) in cases where you need us to keep your data even if it is no longer necessary on our part; or (d) in cases where you may have objected to our use of your data, but we need to verify whether we have legitimate grounds to use it.

The right to data portability. In cases where the legal basis used for processing the data is your consent, and the processing is carried out by automated means, you have the right to receive your data in a structured, commonly used and machine-readable format. However, this right does not apply where portability would adversely affect the rights and freedoms of others and/or where it is technically impossible to do so.

The right to object. Subject to the legal basis on which the processing activity is based, you may object to the processing of your personal data. Bear in mind that, in some cases, we may have legitimate grounds to process your information, in which case the objection does not apply.

The right to withdraw consent. In cases where the legal basis for processing is your consent, you have the right to withdraw it at any time. This may apply to marketing purposes and/or the transfer of your data to third parties. If you withdraw your consent, we will cease processing your data, unless the continuation of the processing is necessary or permitted under applicable legislation and regulations. The withdrawal of your consent in no case affects the lawfulness of the processing already carried out on the basis of the consent before its withdrawal.

We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month, if your request is particularly complex or if you have made several requests. In this case, we will notify you and keep you informed.

Data security

We have put in place several appropriate security measures to prevent your data from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. In addition, we limit access to your data to employees, agents, contractors and other third parties on a strict need-to-know basis for business purposes. They will only process your data under our instructions, and are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected breach of confidentiality and data protection, and will notify you and the competent regulator of any incidents, whenever legally required.

Automated decision-making

In general, we do not adopt automated decision-making. Should we adopt such a procedure, its use will be made in individual cases, and you will be informed about it exclusively. In some cases, we may carry out profiling in order to evaluate certain personal aspects of our Users. You will be informed if we adopt automated methodologies for this purpose. In general, any data collection that is optimized is clarified at the time of collection.

Links to other websites

On our website, we may provide links to third-party websites. These websites are in no way under our control. For this reason, we cannot assume any responsibility for their respective conduct, including the collection and disclosure of data by their methods and carried out under their control. Before disclosing your data on any other website, we recommend that you review its terms and conditions of use, as well as its privacy policy.

Changes to this privacy policy

We reserve the right, at our discretion, to add to, modify or remove parts of this Privacy Policy, in order to ensure that the information contained herein is always up to date with respect to the collection and processing of data as carried out by us.

This privacy policy should be understood as complementary to the terms and conditions of use, and other complementary policies of our website.

We will announce updates to this Privacy Policy by e-mail, by a notice in your user account, and by any other means you have provided to us.

Your comments and feedback are always welcome. You can contact us at any time through the contact channels listed below.

Contact

You can contact us using the channels indicated below:

E-mail: [email protected]
Address: Alameda Rio Negro, 503, Sala 2020, ALPHAVILLE CENTRO INDUSTRIAL E EMPRESARIAL, Barueri SP, Brazil, 06448070

Data protection officer

We have appointed a data protection officer (hereinafter DPO) who is responsible for overseeing questions in relation to this Privacy Policy. If you have any questions about this privacy policy, including requests regarding your data, please contact the DPO using the details below:

Name: Uptide Solutions and Technology LTDA
E-mail: [email protected]