Privacy Policy

1. Introduction

VSL Max (the "Platform", "we") is a hosting and optimization platform for sales videos powered by artificial intelligence. We process personal data in accordance with Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018) and other applicable laws.

This Policy explains what data we collect, why we use it, who we share it with and how we protect it. Questions: contato@vslmax.com.

2. Data we collect

2.1. Sign-up and account data

When you create and use an account, we collect:

Email address
WhatsApp number provided at sign-up
Name, when you fill it in on your profile
Account (organization) name and the emails of team members you invite
Billing data processed by Stripe (the card number is entered directly with Stripe and never passes through our servers)
Login credentials, stored by the authentication service and never in plain text

2.2. Platform usage data

When you use VSL Max, we record:

The videos you upload and their information (title, duration, images, transcript)
Player and per-video settings
History of tests and of changes made by the AI or by you
Configured integrations (conversions, webhooks, Meta Pixel, Google Analytics)
Audit log of actions taken in the account

2.3. Conversion and revenue data

When you connect a payment platform, we receive via webhook:

Sale data sent by the platform (amount, currency, date, status)
The tracking parameter that links the sale to the video
Buyer data the platform includes in the event, such as name and email

This data is used to attribute the sale to the right video and show your results in the dashboard.

2.4. Technical and access data

To operate and protect the Platform, we collect:

IP address
Browser type and operating system
Access and error logs
Essential cookies and, with your permission, website measurement cookies

2.5. Data about your video viewers (you are the controller)

When someone watches one of your videos hosted on VSL Max, the player collects:

A viewer identifier (vslmax_u cookie)
The page where the video is embedded and the traffic source
Playback events (start, sound on, progress)
Interactions with the player, such as button clicks
Events sent to Meta Pixel and Google Analytics, if you set up those integrations

For this data, you are the controller and VSL Max acts as processor, handling it to provide the contracted service. It is up to you to inform your viewers and obtain any required consent on your pages.

3. Legal bases

We process personal data based on:

Performance of a contract: to create the account, host and deliver videos, count plays and bill
Consent: for website measurement cookies, which you can withdraw at any time
Legitimate interest: for security, fraud prevention and improving the Platform
Legal obligation: to keep records required by law, such as tax records

4. How we use data

We use personal data to:

Provide the service: hosting, video conversion, transcription, AI optimization and reports
Billing: process payments and issue invoices through Stripe
Communication: send service emails, such as sign-up verification, play and billing alerts and the optimization notifications you choose to receive
Security: detect abuse, fraud and unauthorized access
Improving the Platform: aggregated analysis of usage and test results. Aggregated learnings from tests may improve AI suggestions for all customers, without copying one customer's texts to another

5. Sharing data

5.1. Processors and vendors

We share data only with those we need to provide the service:

Stripe: payment and invoice processing
Amazon Web Services (AWS): infrastructure, storage, authentication and email delivery (Amazon SES)
Artificial intelligence providers: transcription and text generation from video content, when you use those features
Video and delivery infrastructure: conversion, storage and delivery of videos to viewers
Integrations you set up: Meta Pixel, Google Analytics, Zapier and webhooks receive the events you chose to send

5.2. Legal obligation

We may disclose data when required by law, court order or a competent authority, or to protect the rights and safety of the Platform and its users.

5.3. Company reorganization

In the event of a merger, acquisition or reorganization, data may be transferred to the successor, which must keep the protections of this Policy.

6. Retention

Account data: while the account is active
Removed videos: stay in the trash and can be restored for 30 days
After the account is closed: we keep only what the law requires, such as billing records, for the legal period
Access logs: for the period required by Brazilian law (Marco Civil da Internet)

7. Your rights

Under the LGPD, you may request:

Confirmation that we process your data
Access to the data
Correction of incomplete or outdated data
Anonymization, blocking or deletion of unnecessary data or data processed in breach of the law
Portability
Deletion of data processed based on consent
Information about who we share data with
Withdrawal of consent

To exercise these rights, write to contato@vslmax.com with "LGPD" in the subject line, stating which right you want to exercise. Viewers of a customer's videos should first contact that customer, who is the controller of that data.

8. Cookies

On the website and in the dashboard we use:

Essential cookies: session, security and preferences, required for operation
Measurement cookies: to understand website usage, only with your permission in the cookie notice

In the video player, the vslmax_u cookie identifies the viewer to count plays and measure results. You can manage cookies in the website cookie notice and in your browser settings.

9. Security

We take measures to protect data, including:

Encryption in transit (TLS)
Authentication managed by AWS, with passwords never stored in plain text
Role-based access control (admin and member)
Audit log of account actions

No system is fully immune to incidents. If you find a security issue, let us know at contato@vslmax.com.

10. International transfers

Data is stored and processed on cloud provider servers that may be located outside Brazil, including in the United States. In those cases, we apply the safeguards set out in the LGPD for international transfers.

11. Minors

The Platform is not intended for anyone under 18 and we do not knowingly collect data from minors. If you become aware of such a case, let us know at contato@vslmax.com so the data can be deleted.

12. Changes to this Policy

We may update this Policy. Material changes are announced by email or in the dashboard. The date of the last update appears at the top of this page.

13. Data protection officer

For privacy and data protection matters, contact our data protection officer at contato@vslmax.com, with "DPO" in the subject line.

14. Complaints

If you believe the processing of your data violates the LGPD, you may file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.