PRIVACY

01Who we are and scope

This Privacy Policy explains how G. M. Cardoso Desenvolvimento de Sistemas Ltda. ("Pedreiros de Bit", "we", "us"), CNPJ 43.402.838/0001-14, based in São Paulo, SP, Brazil, collects, uses and protects personal data. We are the controller of personal data under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018).

It applies to our website pedreirosdebit.com and to our applications, including our platform that connects brands selling on TikTok Shop with affiliate creators (the "Platform"). It covers brands and their team members, creators, and visitors to our website.

02Data we collect

We collect only the data needed to run the Platform, from three sources.

Data you give us

• Account data: name, email address, company name and role (for brands), and password or sign-in method.
• Profile and partnership data: descriptions, categories, preferences and messages you write on the Platform.
• Support data: what you send us when you contact us.

Data from TikTok Shop and TikTok, when you connect your account

We access these accounts only through official APIs, after you authorize it, and only within the permissions you grant. You can disconnect at any time.

We never receive or store your TikTok or TikTok Shop password.

Data collected automatically

• Technical data: IP address, browser type, device and pages visited, used for security and to keep the Platform working.
• Error data: technical details when something fails, collected by our error monitoring provider with personal data removed whenever possible.
• Essential cookies: needed for sign-in and security. We do not use advertising or tracking cookies.

03How we use data and legal bases

Each use of personal data relies on a legal basis under article 7 of the LGPD:

We do not use your data for advertising, we do not sell it, and we do not use data obtained from TikTok Shop or TikTok to train artificial intelligence models. We do not make decisions about you based solely on automated processing.

04Who we share data with

Other Platform users. The Platform exists to connect brands and creators, so some data is visible to other users:

• Brands see the profile, statistics and showcase of creators who connected their accounts, and the content of sample requests and messages sent to them.
• Creators see brand profiles and the collaborations they take part in.
• A creator's shipping details are shown only to the brand that receives that creator's sample request.

We only display a creator's statistics to other users if the creator has connected their account and agreed to show them.

Service providers. We use the following providers to run the Platform. They process data only on our instructions:

Authorities. We may disclose data when required by law, court order or a competent authority.

We never sell or rent personal data.

05International transfers

Our database and files are stored by Cloudflare in the United States, and error data is processed by Sentry in the United States. This means your personal data is transferred outside Brazil.

These transfers are made under the mechanisms allowed by articles 33 to 36 of the LGPD, including the data processing agreements and standard contractual clauses offered by our providers. All of them protect data with encryption in transit and at rest and hold recognized security certifications. Emails are sent from Resend's region in São Paulo, Brazil.

06Retention and deletion

We keep personal data only for as long as needed for the purposes in this policy:

When you disconnect a TikTok Shop or TikTok account, we stop accessing it immediately. You can also revoke our access directly in TikTok Shop or TikTok settings, with the same effect.

07Your rights

Under article 18 of the LGPD, you can ask us at any time to:

• confirm whether we process your personal data, and give you access to it;
• correct incomplete, inaccurate or outdated data;
• anonymize, block or delete unnecessary or excessive data, or data processed in breach of the LGPD;
• provide a copy of your data in a structured format (portability);
• delete data processed based on your consent;
• tell you which companies we share your data with;
• withdraw your consent, for example by disconnecting a TikTok Shop or TikTok account;
• review decisions made solely by automated processing.

To exercise your rights, email privacy@pedreirosdebit.com from the address linked to your account. We reply within 15 days. If you are not satisfied with our answer, you can file a complaint with Brazil's National Data Protection Authority (ANPD).

If a brand or TikTok Shop asks us to correct, provide or delete data on behalf of one of their users, we will help them do so within the same period.

08Security, cookies, children and changes

Security. We protect personal data with encryption in transit and at rest, access restricted to what is necessary, multi-factor authentication and continuous monitoring. Our full practices are described in our Information Security Policy. If a security incident affects your data, we will notify you and the competent authorities as required by the LGPD.

Cookies. We use only essential cookies, needed for sign-in, security and remembering your preferences. They cannot be turned off without breaking the Platform. We do not use advertising or third-party tracking cookies.

Children. The Platform is intended for people 18 and older, in line with TikTok Shop's own age requirements. We do not knowingly collect data from children or adolescents. If we learn that we have, we will delete it.

Changes. We may update this policy when our products or the law change. The effective date shows the latest version. For significant changes, we will notify you by email or on the Platform before they take effect.