Privacy Policy

01

Scope and roles in data processing

This Policy applies to the institutional website and to authorized users of organizations that use Creative Studio to organize briefs, produce or adapt creative assets, review materials, record approvals, and deliver final assets.

Advolve AI Ltda., with an address at Rua Sader Macul, 96, provides Creative Studio. For account data, security, support, and service operations, Advolve determines the purposes described in this Policy. For content submitted by corporate customers, Advolve generally processes the data on behalf of the customer organization and in accordance with its instructions and the applicable agreement.

If there is any conflict between this Policy and a data processing agreement entered into with a customer organization, the specific agreement will prevail with respect to that relationship, without limiting any rights afforded under applicable law.

02

Information we process

Depending on the features used, we may process the following categories of information:

• Account and organization: name, business email address, user identifier, company, team, roles, and permissions.
• Authentication: login events, confirmations, authentication factors, and Creative Studio session tokens.
• Campaign content: briefs, text, images, logos, references, files, formats, versions, and instructions provided by users.
• Collaboration: comments, assignees, invitations, change history, and approval decisions.
• Usage and security: IP address, browser, device, access logs, operational telemetry, and error events necessary for security and support.
• Communications: messages sent to support and support-related preferences.

This institutional website does not incorporate advertising or marketing analytics tools. The hosting service may generate technical logs strictly necessary for availability, abuse prevention, and security.

04

Purposes and legal bases

We process information to:

• authenticate users and manage accounts, organizations, roles, and permissions;
• receive and organize campaign materials;
• produce, adapt, render, preview, and deliver creative assets;
• enable editing, commenting, review, and approval;
• perform integrations requested by the user, such as exporting to Google Drive;
• provide support, protect accounts, prevent abuse, and investigate failures;
• fulfill contractual obligations, comply with legal obligations, and exercise legal rights.

Depending on the context and applicable law, these activities may be based on the performance of a contract, compliance with a legal obligation, the lawful exercise of rights, legitimate interests assessed on a proportionate basis, or consent, where required. A Google authorization may be declined or revoked without preventing access to Creative Studio features that do not depend on that integration.

05

Sharing and service providers

We may share information, only to the extent necessary, with:

• authorized users and administrators of the customer organization;
• cloud, authentication, storage, processing, observability, and support providers engaged to operate the service;
• creative generation or processing providers, when an authorized user requests a feature that depends on such processing and subject to the applicable contractual requirements;
• government authorities, where required by law or a valid order;
• parties involved in a corporate reorganization, subject to appropriate safeguards and to the extent permitted by law.

Data received through Google APIs is not shared for advertising or for any purpose other than the functionality presented to the user. Files generated by Creative Studio are sent to Google Drive only at the user's direction.

06

Retention, deletion, and files in Google Drive

We retain account data while the account or the organization's agreement remains active and, following termination, for the period necessary to comply with legal obligations, resolve disputes, and protect legal rights. Campaign content, versions, and approval records are retained in accordance with the periods and instructions established with the customer organization.

Technical and security logs are retained for as long as necessary to investigate events, prevent abuse, and maintain the reliability of the service. Data in backups is removed in accordance with the applicable secure backup rotation cycle, unless it must be retained by law.

Temporary Google Drive export tokens are not persisted by the backend. Files that have already been uploaded remain in the user's or organization's Drive and may be managed or deleted directly from that service. Revoking the integration prevents new access but does not automatically delete files that have already been delivered to Google Drive.

Requests to delete an account or content may be sent to contact@advolve.ai. Advolve will verify the requester's identity and authority and will comply with the organization's agreement and any applicable legal exceptions.

07

Security

We implement technical and organizational measures proportionate to the relevant risks, including account- and organization-based access controls, authentication, protection of data in transit, logical segregation, operational logging, and restricted access to environments and data.

No system is completely secure. Relevant incidents are assessed and addressed in accordance with internal procedures, applicable agreements, and applicable legal obligations.

08

User rights and controls

Under the LGPD and other applicable laws, data subjects may request confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about data sharing, and review of automated decisions, where applicable.

• To exercise privacy and deletion rights, email contact@advolve.ai.
• To revoke the Google connection, use the Google Account permissions page.
• For organization access matters, also contact your workspace administrator.

Creative Studio is intended for professional use by authorized individuals within organizations and is not directed to children.

09

International data transfers

Some technology providers may process information outside Brazil. When this occurs, we use contractual mechanisms and safeguards consistent with applicable law and limit processing to what is necessary to operate the service.

10

Updates and contact information

We may update this Policy to reflect changes to the product, integrations, or applicable law. The date at the beginning of the page indicates the current version. Material changes will be communicated through appropriate channels where required.