Privacy Policy
Effective November 2, 2026. This policy explains in plain language what personal data Umapage processes, why, who receives it, and how you can exercise your rights under the GDPR, the UK GDPR, the CCPA/CPRA, Brazil's LGPD and similar laws.
1. Who is responsible
The controller (the "business" under the CCPA) is Kaio Luiz Rocha de Almeida Costa, que atua sob o nome Orbzz, an individual, taxpayer ID (CPF) 150.677.017-73. For privacy questions write to hello@orbzz.com; it is answered by Kaio Luiz Rocha de Almeida Costa, our privacy contact.
2. What data we process, why, and on what legal basis
| Data | Source | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Name, email, phone of the account | You | Create and run your account, contact you, give support | Performance of a contract (Art. 6(1)(b)) |
| Business brief: name, industry, city, description, address, hours, WhatsApp, email, social links | You | Generate, edit and publish your site | Performance of a contract |
| Photos, logo and text you upload or write | You | Display on your site | Performance of a contract |
| Billing data: tax ID, name or company, address, payment status. Card data stays with the payment provider | You and the payment provider | Charge the subscription and issue receipts or invoices, where applicable | Contract and legal obligation (Art. 6(1)(c)) |
| Domain holder data: name, tax ID, address, email | You | Register and renew the domain in your name (Complete plan) | Performance of a contract |
| Access logs: IP address, date and time, browser, account actions | Automatic | Security, fraud prevention, records required by law | Legal obligation and legitimate interests (Art. 6(1)(f)) |
| Messages sent to support | You | Reply and improve support | Contract and legitimate interests |
| Waitlist: name, email, WhatsApp (optional) and industry | You, through the website form | Notify you when the product for your industry launches | Consent (Art. 6(1)(a)), which you can withdraw at any time |
We do not ask for sensitive personal data (health, racial or ethnic origin, religion and similar). Please do not put it in your brief or on your site.
3. Other uses
- Service notices, such as domain expiry and billing: part of the contract.
- Improving the service with aggregated data that does not identify you: legitimate interests. This includes keeping AI adjustment requests that could not be fulfilled, without your email, phone or name, and with emails, phone numbers and links removed from the text, so we can build new features. We do not use them to train AI models.
- News and promotions: only with your consent, which you can withdraw at any time.
We do not use your content to train AI models ourselves, and we do not make decisions about you that have legal effect by automated means. The AI generates site text from your brief; you review it before it is published.
4. Visitors to your site
Sites published through Umapage do not collect visitor data on their own: no forms, no cookies and no trackers. The WhatsApp button only opens the conversation in the app, and WhatsApp's own rules apply from there. If you add your own tools (analytics, forms, ad pixels), you become responsible for that data and must provide your own privacy notice and, where required, a cookie consent banner.
5. Who we share data with
We do not sell or share your personal data for cross-context behavioral advertising. We share only what is needed with the providers that help us run the service (our processors or "service providers"):
- AI provider (currently Anthropic): receives the text of your brief and edit requests to generate and change the site.
- Payment provider Stripe (cartão e Pix): billing and card data.
- Hosting and infrastructure Vercel e Supabase: where the service and sites run.
- Domain registry (Registro.br or another registrar): domain holder data.
- Accountant and invoicing service, where applicable: billing data.
- Authorities, when required by law or a court order.
If the company is sold or reorganized, data may pass to the new owner, who must follow this policy.
6. International transfers
We are based in Brazil, and some providers, such as the AI provider and part of the infrastructure, are in the United States or elsewhere. When personal data from the EEA, the UK or Switzerland is transferred to a country without an adequacy decision, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses (and the UK Addendum), or on an adequacy decision where one exists. Brazil's LGPD (Art. 33) sets equivalent conditions for transfers from Brazil. The AI provider's use of your content is governed by its own terms: https://www.anthropic.com/legal/privacy. You can ask us for a copy of the safeguards at hello@orbzz.com.
7. How long we keep data
| Data | Retention |
|---|---|
| Account and site content | While the account is active and 30 days after cancellation |
| Billing data and invoices | As long as tax and contract law require (5 years) |
| Access logs | 6 months, or longer if a legal order requires |
| Support messages | 12 months |
After these periods we delete or anonymize the data.
8. Security
We use reasonable measures to protect data: restricted access, encrypted connections and backups. No system is 100% secure. If an incident is likely to put you at risk, we will notify you and the competent authorities within the time limits the law sets (for example 72 hours for the GDPR).
9. Your rights
Depending on where you live, you can ask us, free of charge, at hello@orbzz.com to:
- confirm that we process your data and give you access to it;
- correct inaccurate or incomplete data;
- delete your data (right to erasure);
- restrict or object to processing, including processing based on legitimate interests;
- give you your data in a portable format;
- withdraw consent at any time, without affecting earlier processing;
- tell you who we share data with.
California residents also have the right to know, delete, correct and opt out of sale or sharing of personal information. We do not sell or share personal information and we do not discriminate against you for exercising these rights.
We may ask you to verify your identity, and we reply within 30 days. If you are not satisfied, you can complain to your local data protection authority (for example in the EU or UK) or to Brazil's ANPD.
10. Children
The service is for people aged 18 and over and does not knowingly collect data from children. If you believe a child has given us data, write to hello@orbzz.com and we will delete it.
11. Changes to this policy
When we change this policy we will publish the new version here with its effective date and tell you by email if the change is material.