MyCreations — Privacy Policy

IFM Hub Serviços LTDA, Brazilian company registration (CNPJ) 66.191.755/0001-29, registered office at R. Angelo Leite de Campos, 87, Jardim Residencial Villa Olympia, Sorocaba/SP, Brazil, ZIP 18.087-287, e-mail contact@myifmhub.com.

For any request concerning your personal data, use the Data subject channel described in Section 13.

For the purposes of this Policy: Data subject: you, the MyCreations User; Personal data: any information that identifies or may identify a natural person (art. 5, I, Brazilian General Data Protection Law — LGPD); Controller: IFM Hub (which decides on the processing); Processor: third parties that process data on behalf of IFM Hub.

The website uses essential cookies for the operation of the service (authenticated session and browsing preferences), which do not require consent because they are indispensable to the contracted service.

It also uses, only with your prior and express consent, the Meta Pixel — a third-party technology (Meta Platforms, Inc.) that records browsing events such as page views, interest in plans, and clicks on the sign-up and contact buttons. The purpose is to measure the performance of our advertising campaigns and to show ads to similar audiences. Consent is collected through the cookie banner displayed on first access.

You may decline in the banner itself, with no impact whatsoever on your use of the Platform, and withdraw at any time by clearing the site's browsing data in your browser — the banner will be shown again and your new choice will be respected. We do not use advanced matching: no personal data of yours (e-mail, phone, name) is sent to Meta by the pixel.

There is no advertising tracking whatsoever in the mobile apps (iOS and Android). The pixel and the cookie banner are not loaded inside the apps — they exist on the website only.

IFM Hub shares only strictly necessary data with:

We do not sell, rent, or trade your personal data with third parties.

About this list: only Supabase and Hostinger had their location measured; for the others, the place of processing is the one set out in the contract or data processing agreement of the provider. The Platform also queries public image archives (Openverse, Wikimedia Commons) sending only the search term, with no data identifying the User — which is why they are not in the table.

Part of the processing takes place outside Brazil. The destinations are:

- Platform storage and processing — United States: the database, authentication and storage (Supabase) and the application server (Hostinger). - Artificial intelligence providers: Anthropic (text generation — receives the content of the request, which may include brand name and business description), Google (image and video generation — receives, when the User so requests, reference images uploaded by the User) and ElevenLabs (audio and voice-over generation — receives, when the User so requests, voice samples provided by the User). The place of processing for each is the one set out in the contract or data processing agreement of the provider. - Other processors listed in Section 5, in the locations stated there.

Transfer instrument: IFM Hub adopts the standard contractual clauses approved by the Brazilian National Data Protection Authority (ANPD Resolution CD/ANPD no. 19 of 2024), pursuant to art. 33, II, "a", of the LGPD, with the providers that have already adopted them (Google, ElevenLabs) and, for the others, in the process of adoption, under the provider's own contractual safeguards, to ensure that processing carried out abroad observes the principles and rights set out in the LGPD.

Images of real people and voice samples, when uploaded by the User, may constitute sensitive personal data. They are sent to the providers above only through the User's own action, in order to perform the feature the User requested.

About backups: when data is deleted from the active database, any backups still containing it are deleted in the next backup cycle, within 7 days at most. During that interval, the data is not used for any purpose.

The User may, at any time, exercise the following rights by request to contact@myifmhub.com, with a reply within the legal period of 15 (fifteen) days:

- Confirmation and access to the data processed; - Correction of incomplete, inaccurate or outdated data; - Deletion of data processed on the basis of consent or after the purpose has been fulfilled; - Portability — export in a structured format (already implemented); - Withdrawal of consent, without prejudice to the lawfulness of prior processing; - Objection to processing based on legitimate interest, where applicable; - Information about data sharing.

Data export is implemented and available in the dashboard. A deletion request is recorded and the erasure is carried out within 90 (ninety) days, including for requests received through Meta's deauthorize and data-deletion webhooks.

Users outside Brazil: the rights listed above are granted to all Users, wherever they are located. If the law applicable in your country, state or province grants you additional rights regarding your personal data, you may exercise them through the same channel in Section 13, and we will respond in accordance with the applicable law.

MyCreations is intended for persons aged 18 (eighteen) or over. We do not knowingly collect data from minors; if we become aware of an account held by a minor, we will delete it immediately. The fact that the User produces content aimed at children and teenagers (e.g. Roblox, Minecraft) does not change this policy — the User is an adult and is responsible for the content they produce.

The use and transfer of information received from Google APIs is subject to the Google API Services User Data Policy, including the Limited Use requirements. IFM Hub: does not sell or share data obtained from Google APIs with unauthorized third parties; does not use it for purposes unrelated to the publishing requested by the User; and does not transfer it to third parties without explicit consent, except where necessary to provide the Service.

We adopt technical and organizational measures: encryption at rest of OAuth tokens (AES-256-GCM); per-user data isolation (Row-Level Security in Supabase); encrypted traffic (HTTPS/TLS); role-based access control; and incident response procedures. In the event of a security incident involving relevant risk or harm, we will notify the ANPD and the affected Data subjects within the legal period (art. 48 LGPD).

This Policy may be updated to reflect legal, regulatory, technical or operational changes. The most recent version will always be available on this page. Material changes will be communicated by e-mail.

To exercise any of the rights in Section 8, or for any question about this Policy, write to contact@myifmhub.com with the subject "Personal data — MyCreations". We will reply within the legal period of 15 (fifteen) days.

IFM Hub is a small-scale processing agent under the regulations of the Brazilian National Data Protection Authority and, in that capacity, maintains this communication channel with Data subjects.