Privacy and Personal Data Security Policy

This Privacy and Personal Data Security Policy (“Privacy Policy”), prepared pursuant to Law No. 13,709 of 2018 – the Brazilian General Data Protection Law (“LGPD”), is intended to set out the commitment of ShopCom1 Intermediação e Agenciamento de Serviços S.A., a privately held corporation enrolled with the CNPJ under No. 45.106.699/0001-07, with its registered office at Rua Olimpíadas, nº 205, 4º andar, Vila Olímpia, São Paulo/SP – CEP 04551-000 (“Intelimidia”), to the privacy and protection of the personal data of users of Intelimidia’s platforms (“Users”), in particular Intelimidia’s mobile application, the “App”.

The Privacy Policy establishes rules for the processing of App User data provided to Intelimidia through the User’s registration with and use of the App, in accordance with the legal parameters. The Privacy Policy may be amended at any time, at Intelimidia’s discretion, and covers the data processing activities carried out by Intelimidia. Intelimidia may aggregate Users’ personal data obtained from different sources (websites, applications, third-party social networks, business partners, the Customer Service channel, among other forms of electronic or offline contact between the User and Intelimidia, in particular the App). The Privacy Policy applies to Intelimidia’s employees, shareholders, collaborators and partners who, directly or indirectly, process or in any way come into contact with the personal data collected from users for the provision of the services.

I — Definitions

(a) "User"

The natural or legal person to whom the personal data subject to processing refers.

(b) "Processing"

Any operation of access, collection, receipt, processing, use, classification, reproduction, transmission, distribution, filing, storage, deletion, transfer, modification, evaluation, dissemination, extraction or control of personal data, as provided in the LGPD, through any connection platform established by Intelimidia.

(c) "Personal Data"

Any information relating to an identified or identifiable natural person. By way of example: the CPF (individual taxpayer) number.

(d) "Anonymized Data"

Any data relating to a User who cannot be identified, considering the use of reasonable technical means available at the time of the Processing.

(e) "Sensitive Data"

Any Personal Data concerning racial or ethnic origin, religious belief, political opinion, membership of a trade union or of a religious, philosophical or political organization, data concerning health or sex life, or genetic or biometric data linked to a User.

(f) "Collected Data"

Any User data collected by Intelimidia under this Privacy Policy.

(g) "Affiliates"

Any person, natural or legal, that is controlled by, controls or is under common control with Intelimidia.

(h) "Controller"

The party responsible for the decisions concerning the Personal Data.

(i) "Processor"

The party that carries out the Processing of the Personal Data on behalf of the Controller.

(j) "Data Protection Officer"

The natural or legal person appointed by the Controller or Processor to act as the channel of communication between the Controller, the User and the Brazilian National Data Protection Authority (ANPD).

(k) "ANPD"

The Brazilian National Data Protection Authority (Autoridade Nacional de Proteção de Dados), the public body responsible for safeguarding the protection of Personal Data and for compliance with the LGPD.

(l) "Connection Platforms"

Websites, applications, third-party social networks, business partners, the Customer Service channel, among other forms of electronic or offline contact between the User and Intelimidia, in particular the App.

II — Collection and Purpose of the Collected Data

2.1. Personal Data will be collected by Intelimidia including, but not limited to, (i) when any User voluntarily provides it in the registration process through the App, including any other Connection Platform with Intelimidia; or (ii) when a User accesses, by entering a login and password, manually or automatically, Intelimidia’s App or any of the Connection Platforms offered by Intelimidia, thereby providing browsing data, date, time and place of access and the model of the device used for the connection.

2.2. The Data Collected upon a User’s registration with or access to any Connection Platform may be, among others, the following:

2.3. The services offered by Intelimidia depend directly on the data that may be collected upon the User’s registration and access. If the User chooses not to provide any of this data, the provision of the services by Intelimidia may be rendered wholly or partly unfeasible.

2.4. After the User registers on the Connection Platforms, Intelimidia, partner companies or Users may send communications concerning updates, promotions and management of the registration on the Connection Platforms.

2.5. Digital identification data may be recorded through browsing-tracking processes and tools, including Cookies or other tracking technologies. Cookies or other tracking technologies may be disabled or blocked directly in the User’s browser of choice. By disabling Cookies, the User may be unable to visit Intelimidia’s Connection Platforms or to access information made available in the App.

III — Processing of the Collected Data

3.1. The Processing of Personal Data will be carried out by Intelimidia in compliance with the terms of this Privacy Policy and of the LGPD.

3.2. The Processing of the Collected Data will be carried out after the User consents to the Privacy Policy by using or registering in the App, or by consenting to and accessing any Connection Platform.

3.3. The Collected Data subject to Processing will serve the general purposes of providing intermediation services to Users of Intelimidia’s App, creating a database and bringing App Users closer to Intelimidia’s Affiliates.

3.4. All Collected Data will be processed by Intelimidia in its capacity as Controller and Processor of the Personal Data, exclusively for the purposes for which it is intended, pursuant to this Privacy Policy and the LGPD.

3.5. The Processing of Personal Data of legally incapable persons or of persons under 18 (eighteen) years of age will be carried out upon the consent of their legal guardian. Activities carried out by persons over 16 (sixteen) and under 18 (eighteen) must be assisted by their parents or guardians.

3.6. After the User voluntarily transmits information or files through the Chat to any other Users, Intelimidia may erase, cancel, delete or in any way prevent access to the information and files disclosed through the Chat, and is not responsible for information and files copied to platforms and devices external to the App.

3.7. Intelimidia may disclose Users’ Collected Data and Personal Data to any third parties and Affiliates, subject to the legal limitations, when necessary or appropriate (i) for the provision of the services offered by Intelimidia; (ii) for Intelimidia’s own administrative and corporate purposes; (iii) in the event of a sale, merger, liquidation or dissolution of Intelimidia; and (iv) to comply with a legal obligation, an order of a competent authority or a court decision.

IV — Security of the Collected Data

4.1. Personal Data will be stored in Intelimidia’s database or in databases maintained by third parties engaged by Intelimidia, including in a cloud storage environment (cloud computing), and Intelimidia may transmit, process, store and take any measures necessary for the Processing of the Collected Data in Brazilian territory or abroad.

4.2. The User is responsible for the confidentiality of their Personal Data and, by consenting to the Privacy Policy, acknowledges that sharing access logins and passwords compromises the security of their Collected Data and violates this Privacy Policy.

4.3. By consenting to the Processing of the Collected Data, the User acknowledges that Intelimidia bears no liability for access to the storage systems, or for disclosure, alteration, destruction or any other acts carried out by third parties in violation of this Privacy Policy or of the applicable legislation.

4.4. Intelimidia will notify the ANPD and the User, through the registered e-mail address, of any incident that may cause relevant harm to the User, at which time it will state (i) a description of the nature of the Personal Data affected, (ii) information on the Users involved, (iii) the technical and security measures used to protect the Personal Data, (iv) the risks related to the incident, and (v) the measures that have been or will be taken to reverse or mitigate the effects of the harm.

V — Storage of the Collected Data

5.1. Intelimidia will keep under its Processing the Collected Data provided by Users for as long as the respective registrations are active and as necessary for the provision of its services or to comply with legal obligations. Personal Data collected upon the User’s registration may be stored for up to 5 (five) years after the end of the relationship, and Collected Data whose purpose is the digital identification of the User may be stored for up to 6 (six) months.

5.2. The Collected Data may be deleted, in whole or in part, upon total or partial withdrawal of consent by the User, to be made through the contact channel.

5.3. Intelimidia reserves the right to retain Users’ Collected Data if necessary to comply with legal or regulatory obligations, as well as for its exclusive use upon anonymization of the data.

VI — Biometric Data

6.1. Biometric Data, which includes fingerprints, facial recognition, voice recognition, retina patterns, hand geometry, signature patterns or others to be defined on the Platforms, is considered Sensitive Personal Data and will be processed in accordance with this Privacy Policy and the applicable legislation.

6.2. The User is aware and expressly agrees that Intelimidia may capture Biometric Data to use it in the certification, access and browsing of the User on the Platforms, and to give the User, Intelimidia and other users an additional layer of security.

6.3. The User is aware and agrees that, although the collection and use of Biometric Data offers a significant additional layer of security, it is not completely invulnerable, and failures may occur as a result of technical problems, poor lighting in facial recognition or technological problems with the electronic devices used by Users.

6.4. The storage period, the type of processing and the other forms of security, collection and purpose will be in accordance with clauses II to V of this Privacy Policy.

VII — Users’ Rights

7.1. Users may request from Intelimidia confirmation of the Processing, and the updating, amendment, correction or deletion of their Personal Data. The User may request from Intelimidia a full or partial copy of the data collected and subject to Processing, which will be sent to the User through the e-mail address registered in the App.

7.2. Intelimidia appoints Leila de Souza Castro as its Data Protection Officer (“DPO”), who is responsible for any and all communication between Users and the ANPD. The User may contact the DPO by e-mail at suporte@shoptourapp.com.br.

VIII — Publication and Review of the Policy

8.1. This Policy enters into force on the date of its publication and may be reviewed at any time by Intelimidia, at its sole discretion, always in compliance with the applicable legislation.

8.2. After reviews or updates to the Privacy Policy that require consent to be collected again, the User will be notified through their e-mail address or upon their first access to the Connection Platforms after the review or amendment.

IX — Final Provisions

9.1. The full text of the Privacy Policy may be accessed by Intelimidia’s collaborators and by all Users or interested parties through the App or at the website address intelimidia.com.br. Questions or queries relating to the Privacy Policy must be sent to the DPO in the manner set out above.

9.2. If any provision of this Privacy Policy is held to be unenforceable by a judicial authority or by the ANPD, the remaining terms and conditions will remain unchanged, in full force and effect, as from its publication.

9.3. The Privacy Policy will be interpreted in accordance with the Laws of the Federative Republic of Brazil, and the courts of the Judicial District of the Capital of São Paulo are elected to settle any questions or disputes arising from this Privacy Policy.

X — Connection with Artificial Intelligence Assistants

10.1. Intelimidia makes available a server compatible with the Model Context Protocol (“MCP Server”), at the address mcp.intelimidia.com.br, through which the User may, on their own initiative and at their sole discretion, connect their Intelimidia account to artificial intelligence assistants operated by third parties, such as Claude (Anthropic), ChatGPT and Codex (OpenAI), Grok (xAI) and Cursor (Anysphere), among other compatible applications (“AI Assistants”). The connection is optional, is not a condition for the use of Intelimidia’s services and requires the User to already hold an Intelimidia account; the MCP Server does not create accounts.

10.2. The connection is authorized by means of the OAuth 2.1 protocol, using the authorization code flow with PKCE. To authorize it, the User signs in, on a page of Intelimidia itself, with the same account they use in the App, authenticated by the Firebase Authentication service (e-mail and password, Google or Apple), and confirms the permissions on the consent screen. The User’s password is not provided to the AI Assistant and is not stored by the MCP Server. The AI Assistant receives only access credentials (tokens) linked to the User’s account and limited to the permissions granted by the User.

10.3. There are two permissions (“Scopes”), presented to the User on the consent screen before the connection is completed. The User may untick the change Scope and connect the AI Assistant for consultation only. The AI Assistant may only consult the data and perform the actions covered by the Scopes authorized:

10.4. Neither Scope allows the AI Assistant to subscribe to, change or cancel a plan, make charges, move wallet funds, consult card numbers or other payment data, consult CPF or CNPJ numbers, delete the User’s account or access administrative functions. These operations remain available only on Intelimidia’s Connection Platforms.

10.5. The User may provide videos and images through the AI Assistant, by file or by web address (URL). When sending by file, the MCP Server generates a single-use, time-limited upload link, and the file is transmitted to Intelimidia’s servers by the AI Assistant or by the User. When sending by URL, including YouTube links or links to posts of the connected Instagram account, Intelimidia’s servers access the address indicated and retrieve the video, so that the service hosting it receives a request originating from Intelimidia. The files so received or retrieved are processed in order to perform the operation requested (creating or editing an advertisement, automatic filling or AI video analysis). Files sent through an upload link and not used are erased about 1 (one) hour later; those used in an advertisement become part of the content of the advertisement and are processed like the other Collected Data. The User must provide only files and addresses that they are authorized to use.

10.6. The data consulted by the AI Assistant is transmitted to the provider of the AI Assistant chosen by the User, which processes it in the capacity of an independent Controller, in accordance with its own terms of use and privacy policy, including, as the case may be, in foreign territory. Intelimidia does not control the Processing carried out by the provider of the AI Assistant and is not responsible for it, and it is for the User to become acquainted with the applicable terms and policies before authorizing the connection, in particular as regards the Personal Data of third parties indicated in clause 10.3, such as clients and contacts captured by the advertisements.

10.7. The User may revoke the authorization at any time: (i) by removing the connector or the connection with Intelimidia in the settings of the AI Assistant itself, which requests the MCP Server to revoke the access; or (ii) by requesting the revocation from Intelimidia by e-mail at suporte@shoptourapp.com.br, in which case Intelimidia will end the authorization and invalidate the access credentials issued. Regardless of revocation, access credentials are valid for 30 (thirty) minutes and are renewed automatically, and a new authorization is required after 180 (one hundred and eighty) days or after 30 (thirty) days without use. Data transmitted to the provider of the AI Assistant before the revocation remains subject to that provider’s terms and privacy policy, and the User must address any deletion request to that provider.

10.8. The MCP Server does not keep a copy of the data of the User’s account. It stores the authorization granted (the application authorized, the Scopes and the dates) and the access credentials only in irreversibly hashed form, and keeps an audit record with the operation performed, the date, the time and the outcome, without the parameters, the responses, names or e-mail addresses, identifying the User only by a pseudonym. These records are intended for security, fraud prevention and compliance with legal obligations, subject to the periods set out in clause V.