Privacy Policy

This Privacy Policy describes how BRYCKS (MATHEUS GOBETTI SILVA DESENVOLVIMENTO DE SOFTWARES LTDA, Brazilian tax ID 64.691.700/0001-52), operator of the Moovyi platform, collects, uses, stores, and shares personal data in compliance with the Brazilian General Data Protection Law (LGPD).

1. Who we are

Legal name: MATHEUS GOBETTI SILVA DESENVOLVIMENTO DE SOFTWARES LTDA. Trade name: BRYCKS. Tax ID (CNPJ): 64.691.700/0001-52. Address: Rua Pais Leme, 215, Unit 1713, Pinheiros, São Paulo/SP, Brazil, ZIP 05424-150. Phone: +55 (16) 99635-4165. General contact: contato@moovyi.com.

2. Roles

BRYCKS acts as Controller for Tenant data and as Processor for end-customer/lead data captured through the platform, where the Tenant is the Controller.

3. Personal data we collect

• Tenants: name, email, phone, CNPJ, address, access credentials, usage logs, and data of salespeople registered for commission purposes.
• Leads/End-customers: name, email, phone, CPF (stored encrypted with AES-256-GCM), date of birth, declared income, vehicle interest, IP address and user agent.
• Messaging data, when the Tenant activates the Meta integrations: WhatsApp number, Instagram profile name and handle, content of the messages exchanged, and ad campaign identifiers (e.g. CTWA).
• Sale, contract and electronic signature data: buyer details, amounts, payment methods, contract content and signature evidence (date, time, IP, signer email).
• Tenant financial data (Cash module): bank branch and account number and transaction descriptions, which may contain an individual counterparty name — encrypted at rest, with account lookup by blind index (HMAC).
• Payments are processed by Stripe (card and bank slip) or Abacate Pay (recurring PIX); full card numbers are never stored by BRYCKS.
• Free trial data: the details shared when requesting an invitation over WhatsApp (name, phone, CNPJ) and, upon redemption, the code, the CNPJ and the contact email, kept in an eligibility record. Refused requests are logged with the CNPJ root and a cryptographic hash of the email only.

4. Purposes

• Providing the SaaS services contracted by the Tenant, including inventory, CRM and messaging, financing simulations, websites, finance and commissions, appraisals, contracts and electronic signature, and integrations with marketplaces and official bodies.
• Measuring the performance of the Tenant's advertising campaigns when it activates the Meta Conversions API (see clause 7).
• Billing, invoicing, and fraud prevention.
• Granting and controlling the free trial, including preventing the same company from using it more than once.
• Legal and regulatory compliance, including vehicle transfer records (RENAVE).
• Support and operational communications.
• Audience measurement on the moovyi.com website, subject to consent (see clause 11).

5. Legal bases

Contract performance, consent (where required, notably for non-essential cookies and measurement technologies), legitimate interest (security, fraud and abuse prevention — including free trial eligibility —, panel usage measurement and product improvement), and compliance with legal obligations.

6. Sharing with processors

We share data strictly as needed with: Stripe (card payments), Abacate Pay (recurring PIX), Supabase (database, auth and file storage), Railway (API hosting), Resend (email), Vercel (frontend hosting and, subject to consent, audience measurement on the Tenant's website), Google (Maps and, subject to consent, Tag Manager, Analytics and Ads), Microsoft Clarity (subject to consent), PostHog (admin panel usage measurement, error diagnostics and session recording with full masking of text and form fields), ViaCEP/BrasilAPI/ReceitaWS/FIPE/API Brasil (Brazilian reference data), and — only when activated by the Tenant — Meta Platforms (WhatsApp Business, Instagram Messaging, Conversions API), Autentique (electronic signature), SERPRO (RENAVE) and the marketplaces Mercado Livre, OLX, Webmotors and iCarros.

7. Meta integrations and ad measurement

When the Tenant connects its Meta account, the platform receives and stores messages exchanged with Leads over WhatsApp and Instagram so that service happens inside the CRM. The Tenant is Controller of that data and responsible for holding a legal basis for the contact.

If the Tenant activates the Conversions API (CAPI), the platform sends conversion events (e.g. lead received, sale closed) to Meta containing end-customer identifiers transmitted exclusively as cryptographic hashes, solely to measure the performance of that Tenant's ads. In that operation Meta acts under its own terms and may qualify as an independent controller. Data subjects may request deletion of such data through our Data Deletion page.

8. International transfer

Some processors are located outside Brazil (Stripe, Supabase, AWS, Vercel, Railway, Resend, PostHog, Meta, Google, Microsoft). Transfers are carried out under article 33 of the LGPD and ANPD Resolution CD/ANPD No. 19, of August 23, 2024, relying on the Standard Contractual Clauses (SCCs) approved by ANPD executed with each processor or, where applicable, on Binding Corporate Rules approved by the Authority. In case of conflict between this document and the SCCs, the SCCs shall prevail.

9. Retention

Data is retained while the contract is in effect or as required by law. Each Tenant may configure retention policies for its leads/end-customers in the admin panel.

Free trial account that did not convert: 90 (ninety) days after access is suspended without a subscription, the account is closed and its data deleted or anonymised. The Tenant is notified by email at least 30 (thirty) days in advance and may request an export until closure.

Free trial eligibility record: the CNPJ and contact email used in the trial are kept for 5 (five) years and survive the closure of the account — without them the one-trial-per-company rule would cease to exist in practice. The retention relies on the legitimate interest in abuse prevention (clause 5), is limited to those two fields and is used for no other purpose. Refused requests follow the same period, stored with the CNPJ root and a hash of the email only.

Identification and listing evidence: the identification data of the Tenant and its legal representative, the electronic acceptance records of the legal documents (version, date, time and IP), the snapshots and audit records of published listings — including listings removed or purged by the Tenant — and the conversations exchanged with End Customers through the integrated channels are retained for 5 (five) years after the end of the contract. The legal basis is the regular exercise of rights in judicial, administrative or arbitration proceedings (LGPD art. 7, VI and art. 16, I), and the period matches article 27 of the Consumer Protection Code. Such data is restricted to that purpose, is not used to operate the product or to build profiles, is not available to the Tenant in the panel, and is deleted at the end of the period. A data subject deletion request therefore does not reach it while the period runs.

10. Data subject rights

Under LGPD article 18, data subjects may request confirmation of processing, access, correction, anonymization/deletion, portability, information about sharing, and consent withdrawal. Requests regarding leads must be addressed to the Tenant (Controller).

11. Cookies and measurement technologies

In the admin panel we use cookies and local storage strictly necessary for authentication, session and language/theme preferences.

The panel also uses PostHog to measure feature usage, diagnose errors and record browsing sessions. Recording is performed with full masking of text and form fields — it captures the path taken through the interface, not the content on screen — and therefore does not reach Lead or End-customer data. This relies on legitimate interest in the security and improvement of the contracted product (clause 5), not on consent; the Tenant may object at any time through the DPO channel in clause 13.

On the moovyi.com website we additionally use Google Tag Manager, Google Analytics 4, Google Ads and Microsoft Clarity — the latter recording browsing interactions (clicks, scroll and cursor movement) — loaded only after explicit consentin the banner shown on first visit. Until consent is given, every category stays denied (Consent Mode v2). On each Tenant's public website, audience and performance measurement (Vercel Analytics and Speed Insights) is likewise loaded only after the visitor's consent, with the Tenant as Controller. Consent can be changed or withdrawn at any time via the preferences banner or by clearing site data.

12. Security

• Encryption of CPF at rest (AES-256-GCM) with blind-index (peppered HMAC) lookup rather than a plain hash.
• Bank account numbers and transaction descriptions encrypted at rest.
• Audit logs on sensitive actions.
• TLS in transit, role-based access control with per-tenant isolation at the data layer, periodic backups.

13. Data Protection Officer (DPO)

Pursuant to article 41 of the LGPD and ANPD Resolution CD/ANPD No. 18/2024, BRYCKS has formally appointed a Data Protection Officer.

DPO: Matheus Gobetti Silva. Email: dpo@moovyi.com. Phone: +55 (16) 99635-4165. Requests under article 18 of the LGPD are answered within 15 days.