How we handle your data

1. Plain language summary

This policy explains which data GetLocalClient handles, why, who it is shared with and how you exercise your rights. It follows the Brazilian General Data Protection Law, the LGPD (Law 13.709/2018).

In one sentence: we collect the minimum needed to create your account and deliver the estimates, we measure site usage with analytics tools, we send part of the content to an artificial intelligence provider to generate copy, and we do not sell your data.

2. Who handles your data

The controller of the data handled on the platform is GetLocalClient, responsible for deciding the purposes and the means of the processing described in this policy.

To talk about privacy, request information or exercise any right, use the channels listed at the end of this page. We answer within the deadlines set by the LGPD.

3. Data we handle

We handle three groups of data. First, what you provide yourself:

• Registration: name, email address and password, needed to create and access the account.
• Agency data: name, contact person, logo and brand colors, used in the white label report.
• Commercial contact: the address left in capture forms, along with what you were looking up at that moment.
• Lists you paste into the tools: customer WhatsApp numbers used to request reviews are processed in your browser only to assemble the conversation links and are not stored in our database.
• Second, data collected automatically as you browse: IP address, access date and time, pages visited, session identifiers and technical data about your device and browser.
• Third, public business data collected from Google Maps, described in the section about third party data.

4. Why we use it and on which legal basis

Each processing activity has a purpose and a legal basis under article 7 of the LGPD:

• Creating and maintaining your account, processing credits and delivering the contracted service. Legal basis: performance of a contract.
• Storing the IP address of visitors who run queries without logging in, to apply the free daily limit and prevent abuse. Legal basis: legitimate interest.
• Measuring audience and understanding how the site is used, to fix problems and improve the product. Legal basis: legitimate interest.
• Sending communications about your account, your monitored profiles and product news. Legal basis: performance of a contract and legitimate interest, with opt out available at any time.
• Complying with legal and regulatory obligations and keeping access logs as required by the Internet Civil Framework. Legal basis: compliance with a legal obligation.
• Preventing fraud and keeping the platform secure. Legal basis: legitimate interest.

5. Cookies and audience measurement

We use strictly necessary cookies, which keep your session authenticated and store the language you chose. Without them the platform does not work.

We also use audience measurement tools: Google Analytics 4, which records page views and traffic sources in aggregate, and Microsoft Clarity, which produces heatmaps and session recordings of browsing on the public site. Those recordings exist to reveal usability problems and are not used to identify you personally.

In addition, the Material Symbols icon library is loaded from a Google server on every visit, which means your IP address reaches Google as in any internet request.

We do not currently display a cookie consent banner. If you prefer not to be measured, you can block third party cookies in your browser settings, install the official Google Analytics opt out add on or use the Microsoft Clarity exclusion mechanism. Blocking those tools does not prevent you from using the platform.

6. Who we share with

We do not sell, rent or trade your personal data. We share the minimum necessary with suppliers acting as processors, each within its own purpose:

• Supabase: authentication, database and storage of the files you upload.
• OpenRouter: intermediation of access to the artificial intelligence model that generates analyses and copy.
• Apify: collection of public Google Maps data, triggered when our own collection fails.
• Resend: delivery of transactional and follow up emails.
• Google Analytics and Microsoft Clarity: audience measurement on the public site.
• Hosting infrastructure contracted to run the application and the database.
• We may also share data with authorities where there is a legal obligation, a court order or a need to defend ourselves in proceedings.

7. Use of artificial intelligence

When you request an analysis or ready made copy, we send the artificial intelligence provider the public data of the analyzed profile, such as category, rating, review count, review excerpts and neighborhood ranking. The model returns the diagnosis and the suggestions you see on screen.

We do not send the model your password or payment data. Processing carried out by the provider follows its own policies, which may include temporary retention of content for service operation and security.

Output generated by artificial intelligence can contain inaccuracies. Review the text before publishing it on your profile or sending it to a client.

8. International data transfer

Some of the suppliers named in this policy process data on servers outside Brazil. In those cases, the international transfer follows article 33 of the LGPD and relies on the contractual safeguards offered by each supplier, including data protection clauses and security commitments.

9. Public business data and review authors

The platform collects and stores public information from business profiles on Google Maps: name, address, category, business phone number, rating, review count, photos and review content, including the display name of the person who wrote the review.

That data is public by decision of whoever published it and is handled on the basis of legitimate interest, set out in article 7, item IX of the LGPD, for the purpose of local market competitive analysis. We do not use that data for targeted advertising and we do not enrich it with private sources.

If you wrote a review, own a listed business or represent one and want us to remove or correct the information associated with your profile in our database, contact us through the channels at the end of this page. We handle objection and erasure requests under the LGPD.

Business phone numbers appear in prospecting lists for the professional use of our users. Actual outreach is performed by the user, who answers for the content and the form of the messages sent, and for honoring do not contact requests.

10. How long we keep it

Account data is kept while the account exists. After closure we keep what is needed to comply with legal obligations, exercise rights in proceedings and retain access logs for the period required by the Internet Civil Framework.

Collection results and monitoring history are kept so comparison over time remains possible, which is the very function of the product. Audience measurement data follows the retention periods of the tools used.

11. Your rights as a data subject

Under article 18 of the LGPD, you may at any time request:

• Confirmation that we handle your data, and access to it.
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or erasure of unnecessary or excessive data, or data handled outside the law.
• Portability of the data to another supplier, upon express request.
• Erasure of data handled on the basis of your consent.
• Information about who we share your data with.
• Withdrawal of consent, where consent is the applicable legal basis.
• Objection to processing based on legitimate interest, stating the reason.
• To exercise any of these rights, use the contact channels at the end of this page. We may ask for additional information to confirm your identity before acting, which protects you against fraudulent requests. You may also file a complaint with the Brazilian National Data Protection Authority.

12. Information security

We adopt technical and administrative measures to protect data: encrypted traffic, passwords stored irreversibly by the authentication provider, role based access control and separation between the user area and the administrative area.

No system is fully immune. If a security incident poses relevant risk to your rights, we will notify you and the Brazilian National Data Protection Authority as required by article 48 of the LGPD.

13. People under 18

The platform is aimed at professionals and companies and is not directed at people under 18. We do not knowingly collect data from children and adolescents. If we identify a registration in that situation, the account is closed and the data is erased.

14. Changes to this policy

This policy may be updated when the product, the suppliers or the law change. The date of the last update is shown at the top of the page, and material changes are communicated through your registered contact channels.