Privacy policy

This international Policy explains how Via Hype processes personal data on viahype.store, in accounts, orders and support for customers worldwide, including Brazil. The Brazilian General Data Protection Law (LGPD, Law 13,709/2018) applies to processing data of people in Brazil under article 3, regardless of where the party responsible for processing is located. The GDPR and the UK GDPR may apply to processing data of people in the European Union and the United Kingdom, respectively, according to their scope, including when offering services to those people. Also read the Terms of use.

1. Who is responsible for the data

Via Hype is the controller of the personal data processed under this Policy. For any privacy matter or to exercise your rights, write to hello@viahype.store.

You can also use support, choosing "Something else", to submit a privacy request.

2. Data processed, purposes and legal bases

We process the data needed to provide the service, handle requests, protect operations and meet legal obligations. The legal basis depends on the purpose, not just the type of data, and must be valid under the law applicable to the processing.

Data	Purpose	Legal basis
Name, email and Via Hype account credentials	Create the account, authenticate access and enable use of the dashboard	Performance of contract and preliminary procedures requested by you
With Google sign-in: name, email and Google account identifier	Create the account or log in without a Via Hype password, when you choose "Continue with Google"	Performance of contract and preliminary procedures requested by you
Acceptance record, with date and version of the Terms	Demonstrate the conditions accepted and defend rights in proceedings	Regular exercise of rights
Public link, selected option, quantity, order number and status	Fulfill the order and show its history in the dashboard	Performance of contract
Comment texts and instructions provided for the order	Perform the purchased option	Performance of contract
Payment data, top-ups where applicable and refunds, including amount, method and transaction ID	Check payments, maintain records and process refunds where applicable	Performance of contract; compliance with legal obligations where required
Coin, network, addresses and crypto transaction identifiers	Identify the payment, check the amount received and credit the balance	Performance of contract
Email, topic, message, language and details provided to support: payment method, amount, transaction ID or order number	Register the ticket, investigate the case, send confirmation and respond	Performance of contract or preliminary procedures; compliance with legal obligations in consumer support
Ticket number and support records	Track the request and document the response	Performance of contract; regular exercise of rights where needed
IP hash in support	Apply the limit of 3 requests per hour and prevent form abuse	Legitimate interest in support security, respecting your rights
IP and email hashes and authentication attempt counters	Limit attempts and prevent abuse	Legitimate interest in account security, respecting your rights
Business name, sales channel, description and acceptance of the Reseller terms	Review API access requests and administer resale	Performance of contract and preliminary procedures requested by you
API key name, prefix, hash, creation, usage and revocation dates	Authenticate the reseller, manage keys and apply usage limits	Performance of contract; legitimate interest in API security

We do not request your password or access to your account on the target platforms. Via Hype account credentials are used to access our dashboard. Do not send social media passwords or unnecessary data, including sensitive data, in comments or support requests.

Crypto payments are processed by NOWPayments. We keep the payment request and confirmation data needed to check the payment and the credit proportional to the amount received. We do not collect your tax ID at sign-up.

Order links may identify public profiles or content. Being public does not remove their protection as personal data. Only use links to profiles you control or are authorized to promote.

Support tickets are saved to the database only by the server. In support records, we store the IP hash, not the plain IP address. The hash does not make all ticket data anonymous.

3. Sharing and international transfers

We share only what is needed for each purpose:

• Partners who carry out the services: receive the link, option, quantity and, where applicable, comment texts and fulfillment instructions. We do not send them your name, email or payment data. Avoid including these details in the texts and links you provide.
• Vercel: website hosting and operation, processing technical data needed for requests.
• Supabase: authentication and database, including support records and data needed for accounts and orders.
• Google: only when you choose "Continue with Google". Google confirms who you are and sends us your name, email and Google account identifier. We do not receive your Google password or access to any other data or services in your Google account; Google's processing follows its own privacy policy.
• Resend: sending transactional emails, including the recipient and content needed for authentication, confirmation and support messages.
• NOWPayments: processing and confirming crypto payments, with the data needed for the transaction.
• Cloudflare Turnstile, if configured: bot protection in authentication forms, with technical data needed for verification.
• Backups: the procedure in section 5 may store encrypted copies in GitHub Actions or restricted local storage.
• Authorities and competent bodies: where there is a legal obligation or valid request; data may also be used for the regular exercise of rights in proceedings, within legal limits.

Vercel, Supabase, Resend, NOWPayments, Google (for Google sign-in) and, if enabled, the analytics tools in section 4 may process data on servers outside your country, including outside Brazil.

4. Cookies

Necessary cookies: keep you logged in to your account. We also use temporary cookies for Google sign-in and password recovery. When a cookie notice is available, your choice is stored for 1 year.

Google Analytics 4: if we enable this Google tool, it will load only after you click "Accept" in the cookie notice, to measure page usage, referral sources and technical browsing characteristics. It may set the _ga and _ga_<ID> cookies. We do not configure names, emails, order links or comment texts to be sent as analytics events. Advertising features are disabled. Google may process this data on servers outside your country.

Microsoft Clarity: if we enable this tool, it will also load only with "Accept", to analyze clicks, scrolling and navigation and identify confusing or broken parts. It may use cookies such as _clck and _clsk. Form and account data areas are marked for masking in recordings. Microsoft may process this data on servers outside your country.

If you refuse, nothing is sent to Google Analytics or Microsoft Clarity, and the service works normally. When these tools are configured, you can change your choice through the Cookies link in the website footer; when you refuse, we delete the Google Analytics cookies and the _clck and _clsk cookies from your browser.

We do not use advertising cookies.

5. How long we keep data

We keep data only as long as needed for the stated purpose, to meet legal obligations or to defend rights. Closing your account or withdrawing consent does not require deleting records that have another valid legal basis.

• Account data: while the account exists.
• Orders, payments, refunds and records of acceptance of the Terms: for as long as needed to meet legal obligations and defend rights.
• Comment texts and instructions: form part of the order record, for as long as needed for fulfillment, support and defense of rights. They are not automatically deleted at the end of delivery or refill.
• Support tickets: for as long as needed to complete the support request and defend rights.
• Analytics data, if we enable these tools: retention will depend on each tool's configuration, disclosed upon activation. Collection will require the consent described in section 4.

Deletion or anonymization is handled according to the purpose, retention obligations and requests under section 6; it does not occur automatically when an order closes.

The database backup procedure includes account, authentication, order, payment and support data. When run, it creates an encrypted recovery copy with restricted access. The GitHub Actions workflow specifies 30-day retention; the local alternative also defaults to 30 days. Data deleted from the main database may remain in these copies until their retention ends.

6. Your rights and how to exercise them

You may request the rights below, subject to the conditions, limits and exceptions of the law applicable to the processing, including the LGPD, GDPR and UK GDPR where applicable:

• confirmation of processing and access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• portability, subject to applicable regulations and protection of commercial and industrial secrets;
• deletion of data processed with consent, subject to statutory retention exceptions;
• information about entities with which we share data;
• information about the possibility of refusing consent and the consequences of refusal, and withdrawal of consent;
• objection to data processing in the circumstances provided by applicable law;
• review of decisions based solely on automated processing that affect your interests and information about the criteria and procedures used, subject to commercial and industrial secrets.

Send your request to hello@viahype.store or through support, under "Something else", indicating the right you wish to exercise and the details needed to locate your record. Requests may be made by you or a legally appointed representative, free of charge. We may request proportionate information to verify identity and protect your data against disclosure to third parties.

Through support, you receive an immediate VH-XXXXXX ticket number, email confirmation and a reply within 24 hours, with a limit of 3 requests per hour. To add information, reply to the confirmation with the ticket number in the subject. The privacy email is also available; the form limit does not prevent you from exercising your rights.

The initial support reply does not replace fulfillment of the requested right. For data subjects in Brazil, the LGPD provides, for confirmation of processing or access, for an immediate simplified response or a clear, complete statement within 15 days of the request. Other requests and requests subject to other laws follow applicable statutory and regulatory deadlines. If we cannot comply, we will explain the reasons and any applicable retention exceptions.

You may lodge a complaint with the data protection authority in your country, for example, the ANPD in Brazil, and contact consumer protection bodies. The ANPD guidance on data subject rights details the rights provided by the LGPD.

7. Security

We adopt technical and administrative measures to protect data, including HTTPS connections and access restricted to the people and services that need it. Via Hype account credentials must be protected; we never request social media credentials to fulfill orders.

No system is immune to failures. Incidents will be assessed and, where legally required, reported to data subjects and the competent data protection authorities, such as the ANPD in Brazil, within applicable deadlines. If you suspect misuse of your data, contact hello@viahype.store or support.

8. Minors

The service is intended for people aged 18 or older. We do not intentionally collect minors' data. If you become aware of a minor's registration or submission of data, notify the privacy channel so we can investigate, stop improper processing and delete the data, subject to statutory retention obligations.

9. Changes to this Policy

We may update this Policy. The version and update date appear at the top of the page. Significant changes will be announced by email or on the website. New purposes that require consent will only be activated after obtaining it.

10. Governing law and contact

This Policy observes the data protection laws applicable to the processing, including the LGPD for people in Brazil under article 3 and the GDPR and UK GDPR where applicable. The laws of Brazil and the courts of the consumer's place of residence apply, as set out in section 12 of the Terms of use, without displacing mandatory data protection and consumer protection rules that apply, including those of the customer's country of residence.

Controller: Via Hype. Website: viahype.store. Privacy contact: hello@viahype.store or support.