Privacy Policy

1. Introduction

This Privacy Policy explains how Gambiarra, the company behind the Capy Contentproduct (“we”, “our company”), collects, uses, stores, shares, and protects the personal data of users (“you”) of our SaaS platform.

Because we serve users around the world, this policy has been prepared in compliance with:

• LGPD(Brazil’s General Data Protection Law — Law No. 13.709/2018);
• GDPR(General Data Protection Regulation — European Union);
• General principles of privacy laws such as the CCPA (California, USA), where applicable.

By creating an account or using Capy Content, you agree to the practices described in this Policy, including any future updates published in accordance with Section 13 (“Changes to this Policy”).

2. Who we are (Data Controller)

• Company: Gambiarra
• Product: Capy Content
• Country of headquarters: Brazil
• CNPJ: 68.541.801/0001-06
• Contact (Data Protection Officer / DPO): capycontent@zimbo.africa

3. What data we collect

3.1 Data you provide

• First and last name
• Email address
• Profile information you choose to add
• Content you create, upload, or store on the Platform

Your password is created and managed entirely by Clerk, our authentication provider — we never collect, see, or store it ourselves.

3.2 Payment data

Processed directly by Stripe. We do not store full credit card numbers on our servers. We may receive information from Stripe such as: the last 4 digits of your card, transaction status, billing history, and data needed to manage your subscription.

3.3 Automatically collected data

• IP address
• Browser and device type
• Operating system
• Pages visited, browsing time, clicks, and product usage events (via PostHog)
• Cookies and similar identifiers (see section 7)

3.4 Data from minors

Our Service is intended for users aged 13 and older, the same minimum age adopted by most social networks. We do not intentionally collect data from children under 13. If we become aware that we have collected data from a child below that age without proper consent, we will delete that information as soon as possible.

4. How we use your data (purposes)

We use your data to:

• Create and manage your account;
• Process payments and subscriptions via Stripe;
• Provide, operate, and improve the features of Capy Content;
• Process your content and brand information (such as tone of voice, niche, and base text or ideas) through AI models — including third-party AI providers — to generate carousel copy, headlines, and content suggestions;
• Study and improve our AI content-generation systems and other product features, using content generated on the Platform always in anonymized or aggregated form (i.e., without identifying you or your brand);
• Send essential service communications (e.g., sign-up confirmation, billing changes, security alerts);
• Send marketing communications when you opt in (you can unsubscribe at any time);
• Analyze usage and performance of the Platform (via PostHog);
• Prevent fraud, abuse, and violations of these Terms;
• Comply with legal and regulatory obligations.

5. Legal bases for processing (LGPD/GDPR)

We process your data based on one or more of the following legal bases:

• Contract performance: to provide the Service you contracted;
• Consent: for non-essential cookies, analytics, and marketing communications;
• Legitimate interest:for Platform improvements — including studying anonymized or aggregated content to improve our AI content-generation systems —, security, and fraud prevention;
• Legal obligation: to comply with tax, accounting, and regulatory requirements.

6. Who we share your data with

We do not sell your personal data. We may share data with:

All third parties that process data on our behalf are contractually obligated to maintain adequate security and confidentiality standards.

7. Cookies

We use cookies and similar technologies to operate the Platform, keep you signed in, remember your preferences, and understand how you use Capy Content. For full details on the categories of cookies we use, the third parties involved, and how to manage your preferences, see our Cookie Policy.

8. International data transfers

Because we serve users worldwide, your data may be transferred and processed in countries other than your country of residence, including Brazil and countries where our providers (such as Stripe, Clerk, PostHog, and our AI and hosting providers) operate servers.

In such cases, we adopt appropriate safeguards, such as standard contractual clauses and verifying that the involved third parties maintain adequate data protection levels, in compliance with LGPD and GDPR.

9. Data storage and retention

• We keep your personal data for as long as necessary to fulfill the purposes described in this Policy, or as required by law (e.g., tax obligations).
• After your account is closed, your data will be deleted or anonymized within a reasonable period, except when we must retain it due to legal or contractual obligations, or to exercise rights in judicial or administrative proceedings.

10. Data security

We adopt technical and organizational measures to protect your data, including:

• Encryption of sensitive data in transit and at rest;
• Restricted access control to personal data;
• Monitoring against unauthorized access.

No system is 100% secure. In the event of a security incident affecting your data, we will notify you and the relevant authorities as required by applicable law.

11. Your rights

Depending on your location, you may have the following rights regarding your personal data:

• Confirmation and access: know whether we process your data and access it;
• Correction: correct incomplete, inaccurate, or outdated data;
• Deletion: request the removal of unnecessary data or data processed in non-compliance with the law;
• Portability: receive your data in a structured format;
• Consent withdrawal: withdraw consent at any time, where applicable;
• Objection: object to processing based on legitimate interest;
• Information about sharing: know who we share your data with.

To exercise any of these rights, contact us at capycontent@zimbo.africa. We will respond within the deadline required by applicable law (generally up to 15 days in Brazil under LGPD, or 30 days under GDPR).

Users in the European Union also have the right to file a complaint with their local data protection authority. Users in Brazil may file a complaint with the ANPD (Brazilian National Data Protection Authority).

12. Minors

Capy Content is not directed at children under 13. Users between 13 and 18 must have authorization from a legal guardian to use the Service, especially for purchasing paid plans via Stripe.

13. Changes to this Policy

We may update this Policy periodically to reflect legal, technical, or operational changes. Relevant changes will be communicated by email or notice on the Platform. We recommend reviewing this page periodically.

14. Contact

For questions, requests, or the exercise of rights related to this Privacy Policy:

capycontent@zimbo.africa