Privacy Policy

Under the LGPD, we define the following roles:

2.1 Contracting User Data

Data collected directly for registration, access and use of the Platform.

2.2 Lead Data

Data of customers and contacts captured and managed by the Platform on behalf of the Contracting User.

For compliance with Meta and the LGPD, we rely on the following legal bases:

MKT START reserves the right to cross-reference the lead data of all Contracting Users to generate market intelligence and general statistics.

This section does not apply to data obtained through Google APIs (see section 7).

For transparency, the possible sharing includes:

• With infrastructure and cloud storage providers, exclusively for the operation of the Platform.
• With Meta Platforms Inc. through the Meta API, limited to campaign measurement, attribution and tracking.
• With integrations expressly authorized by the Contracting User (e.g. WhatsApp Business API).
• Data obtained through Google APIs follows the rules in section 7.

The Platform uses the Meta API for campaign tracking and conversion attribution. When using the API, MKT START undertakes to:

• Use the data exclusively for the purposes described in this Policy.
• Ensure the security and confidentiality of the data obtained.
• Obtain explicit consent (opt-in) for communications, when applicable (e.g. WhatsApp Business).
• Act in compliance with Meta's Policies, including data protection and the prohibition of re-identification.
• Keep logs and access controls for security in the data traffic via the Meta API.

When a Contracting User connects a Google Ads account, the Kiron Platform asks Google for permission to use the Google Ads API (scope https://www.googleapis.com/auth/adwords) and to see the email address of the Google account (openid and email scopes).

7.1 Data We Access

• The email address and ID of the Google account that authorized the connection.
• The ID, name, currency and status of the Google Ads accounts (including manager accounts) that this Google account can access.
• The access and refresh tokens issued by Google.

7.2 How We Use It

We use this data to show the user which Google Ads accounts can be linked to each client, and which Google account authorized each connection. Today we only read data: we do not create, change or delete anything in Google Ads. If Kiron starts making changes, such as pausing campaigns or adjusting budgets, they will only happen at the user's request, and this policy will be updated first.

7.3 How We Store It

Tokens are encrypted (AES-256-GCM) and kept with the Platform's infrastructure providers, with restricted access.

7.4 Sharing

We do not sell Google user data and do not transfer it to third parties, except infrastructure providers that process it on our behalf to operate the Platform, or when required by law. This data is not used for advertising, is not part of the market intelligence described in section 4, and is not used to train artificial intelligence models. No one at MKT START reads this data, except with the user's permission, for security purposes or to comply with the law.

7.5 Deletion

When the user disconnects the integration in Kiron, we delete the tokens immediately and unlink the accounts from that client. We do the same when Kiron detects that access was revoked at Google. We keep a record of the disconnected connection (the Google account email and ID, the IDs of the Google Ads accounts that were linked, and the dates) in the client's history, for security and so the client knows which ad accounts were used and by whom. This record is kept for as long as the client exists in Kiron and is deleted, together with the rest of the client's data, within 7 days after deletion of the client or the company is requested. The user can also revoke Kiron's access at any time at https://myaccount.google.com/permissions. Deletion requests can be sent through the channels in the Contact section.

The data subject has the right to request confirmation of, access to, correction or deletion of their data.