Privacy and LGPD
This Policy explains the processing of data carried out by the website and by authorized Nyv Sentinel accounts. Sign-up, checkout and other capabilities are released in stages; the processing described here applies once each capability is enabled. The static copy of this version (in Portuguese) can be saved and consulted even after a future update.
This is an English translation of version 2026-08-12.sentinel-web-v1. The Portuguese text is the one accepted at sign-up and prevails if the two differ. LGPD is Brazil's General Data Protection Law (Law No. 13,709/2018), and ANPD is Brazil's National Data Protection Authority. Ler em português.
1. Controller and scope
The controller is NYV IQ TECNOLOGIA LTDA, trade name Nyv IQ, CNPJ 68.508.081/0001-79, located at Rua Pais Leme, 215, Conjunto 1713 - Pinheiros, São Paulo/SP - CEP 05424-150. This Policy applies to the website, contacts, authorized accounts, Nyv Sentinel and the records needed to operate and secure these environments. Nyv Recupera has separate rollout and contracting; before a partnership, the specific processing will be described in the proposal or in its own instrument.
2. Categories of data
We may process: name, email, phone number and company; subject, message and support reference; protected credentials and session data; plan, billing cycle, subscription status and billing identifiers; tax data needed for the NFS-e (Brazilian electronic service invoice); product addresses, monitoring settings, evidence, change history and alert preferences; WhatsApp number used for notifications; consents, contract acceptance and rights requests; IP address transformed or restricted when possible, browser, device, date, time, access logs, security events, failures and audit records.
Full card data is collected by Stripe in its hosted environment and is not stored by Nyv IQ. We do not ask for passwords, keys, authentication codes or full card numbers by email or contact form.
3. Sources of data
We receive data directly from the data subject or a company representative; from use of the website and the account; from the products and recipients registered by the customer; from providers that perform payments, messaging, email, infrastructure and observability; and from external sources monitored according to the Sentinel configuration. The customer is responsible for being authorized to provide other people's data, including contacts who will receive alerts.
4. Purposes and legal bases
We process data to respond to contacts and pre-contractual requests; verify and protect the account; record acceptance; provide monitoring and deliver alerts; manage trials, plans, payment, cancellation, support and the NFS-e; prevent fraud and abuse; investigate incidents; maintain evidence and continuity; comply with legal and regulatory obligations; exercise rights in proceedings; and improve security, stability and experience.
Depending on the context, we rely on performance of a contract or preliminary procedures, compliance with a legal or regulatory obligation, the regular exercise of rights, legitimate interest subject to an assessment of necessity and impact, credit protection, and consent when it is the appropriate basis. Consent will not be used to hide processing that the contract requires and can be withdrawn for the processing that depends on it, without affecting prior lawful acts.
5. Processors and sharing
We share the minimum necessary with processors and sub-processors that support the service: Stripe for checkout, payments and the billing portal; Resend for transactional emails; Meta and the WhatsApp infrastructure for enabled alerts; hosting, database and network providers; observability and operational alerting services; external storage and backups; and professional service providers, authorities or involved parties when there is a legal obligation, fraud prevention or defense of rights.
Names and roles may change with the architecture or contracting. Nyv IQ keeps an internal inventory and a contractual assessment proportionate to the risk. We do not sell personal data or share it for third-party behavioral advertising.
6. International transfers
Some global processors, including Stripe, Resend and Meta, may process or support data outside Brazil. Hosting, observability or backups may also use infrastructure in other countries. In these cases, we use providers with data protection commitments, access controls and contractual or legal mechanisms applicable to international transfers. Additional information about a specific transfer can be requested through the privacy channel, respecting trade secrets and security.
7. Retention and deletion
We do not apply a single period to all data. Contact data is kept for as long as needed to respond to and document the request; account and monitoring data, during the relationship and its secure deactivation; acceptance, billing, NFS-e and tax records, for the legal periods and for the defense of rights; security logs, while they are useful and proportionate to prevention and investigation; backups, until their secure rotation according to the technical cycle. At the end of the applicable criterion, data is deleted, anonymized or kept in a restricted way when there is a legal obligation or the regular exercise of rights.
8. Security and incidents
We apply access control, protected credentials, restricted sessions, encryption in transit, separation of environments, attempt limiting, origin validation, auditable records, monitoring, backups and response procedures. No measure eliminates all risk. When an incident may cause relevant risk or damage, Nyv IQ will investigate, contain, document and notify the ANPD and the affected data subjects in the cases and within the deadlines required, with mitigation guidance available.
9. Data subject rights
The data subject may request confirmation and access; correction; anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-compliance; portability, when regulated and applicable; deletion of data processed with consent, except where retention is permitted; information about sharing and about the consequences of not consenting; withdrawal of consent; objection to irregular processing; and review of decisions made solely on the basis of automated processing that affect their interests. They may also file a petition with the ANPD and consumer protection bodies.
To protect the data subject, we may ask for proportionate information to confirm identity or representation. The response will follow the legal deadlines and formats. If we cannot fully comply, we will explain the reason, including retention obligations, protection of third parties or trade secrets.
10. Automated decisions
Sentinel automates collection, comparison, classification of changes and sending of alerts, but it does not change the store or carry out business decisions on the customer's behalf. Fraud and security controls may limit or suspend actions automatically to reduce risk. The data subject may ask for information about the applicable criteria and for human review when a decision made solely by automated means affects their interests, observing security and trade secrets.
11. Cookies and local storage
The theme preference is kept in the browser's local storage. Strictly necessary cookies maintain the session and security when the account is available; they are not used for advertising. Technical metrics without advertising purposes may be used for stability and security. If tools with non-essential cookies are adopted, this Policy and the choice interface will be updated before activation.
Note outside the translated text: the Cookies and local storage notice lists each item this website stores, including the session cookies that remember the language you choose.
12. Children and sensitive data
The services are intended for people able to enter into contracts or represent businesses and are not directed at children. We do not ask for sensitive personal data for ordinary use of Sentinel. The customer must not enter sensitive data, personal documents, secrets or credentials in product, support or alert fields.
13. Privacy channel
The operational channel for data subjects is maintained by the Nyv IQ Privacy Team at privacidade@nyviq.com and through the contact form. Requests receive a reference for follow-up. This channel does not, by itself, represent the formal appointment of a data protection officer (encarregado). The documented decision on the waiver or appointment of a data protection officer will be kept separately and reflected on this page when applicable.
14. Updates
This Policy is identified by the version and date at the top. Material changes will generate a new version and will be communicated through appropriate means when they affect data subjects or an ongoing relationship. The version accepted at sign-up remains recorded as evidence and can be exported with the other account data.
Note outside the translated text, for readers outside Brazil: you may also have rights under the data protection law where you live. You can exercise them through the same privacy channel, and you may contact your local data protection authority. Prices shown in US dollars on this website are indicative; there is no US-dollar checkout yet.