Privacy policy
Version of October 23, 2026. It explains what personal data VORTZ processes, for what purpose, who we share it with, how long we keep it and how you exercise your rights under the Lei Geral de Proteção de Dados (Law No. 13,709/2018, the LGPD, Brazil's General Data Protection Law).
This is a translation for convenience; in case of conflict, the Portuguese version prevails.
- 1. Who we are
- 2. What data we process
- 3. What we use it for and on what legal basis
- 4. Instagram and Meta data
- 5. WhatsApp data
- 6. Who we share it with
- 7. International transfer
- 8. How long we keep it
- 9. Security
- 10. Your rights
- 11. Cookies and third-party resources on the site
- 12. Changes to this policy
1. Who we are
VORTZ is a content automation service that rewrites news with artificial intelligence, creates designs with the customer's brand and publishes them to Instagram and the WhatsApp Channel. It is operated by VERGS PARTICIPAÇÕES, CNPJ (Brazilian company tax ID) 59.867.173/0001-54, which is the controller of the personal data described here.
Contact for privacy matters and for our data protection officer (DPO): fale@vortz.com.br.
2. What data we process
| When | Data |
|---|---|
| Waitlist | Email, the type of publisher you choose (optional), the page you came from and the sign-up date. We do not store your IP address. |
| Purchase and subscription | Name, email, CPF or CNPJ (Brazilian individual or company tax ID), phone number and order details, received from Kiwify or Stripe. Card details stay with them only; VORTZ does not receive them. |
| Use of the platform | Login email and password (stored only as a hash, never as text), names of the account's users, brand settings (logo, colors, fonts, Instagram handle, website, hashtags), editorial line, article links and text, generated designs, schedules and posting history. |
| Integrations | ID and username of the professional Instagram account and the access token issued by Meta; the WhatsApp session of the connected number and the list of channels it manages. |
| Technical logs | Access logs required by the Marco Civil da Internet (Brazil's Internet Civil Rights Framework): date, time and IP of access to the application; error and security logs. |
VORTZ is not designed to process sensitive data or children's data. The articles you publish may mention people; taking care with that content is your job, as the responsible editor (see the Terms of use).
3. What we use it for and on what legal basis
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Letting people on the waitlist know when accounts open and about VORTZ news | Consent, which you can withdraw at any time |
| Creating and maintaining your account, generating text and designs, publishing to the networks you connected | Performance of a contract |
| Billing, invoicing and fraud prevention | Performance of a contract and compliance with a legal obligation |
| Keeping access logs for the period set by the Marco Civil | Compliance with a legal obligation |
| Measuring usage and cost, fixing errors and improving the service | Legitimate interest, always with the minimum data |
We do not sell personal data, and we do not use your content to train artificial intelligence models.
4. Instagram and Meta data
When you connect Instagram, you authorize VORTZ through Meta's official login (Instagram API with Instagram Login). We ask for only two permissions:
- instagram_business_basic: read the ID, username and photo of the professional account, to show in the dashboard which account is connected;
- instagram_business_content_publish: publish the posts, carousels and Reels you approved or scheduled.
We do not read direct messages, comments, followers or other people's data. The access token is stored encrypted and used only for these two functions. You can disconnect at any time in the VORTZ dashboard or in Instagram's settings (Settings → Apps and websites). When you disconnect, or if Meta tells us you removed the app, we delete the token within 48 hours. To request deletion of all data linked to your Instagram account, write to fale@vortz.com.br.
5. WhatsApp data
Posting to the WhatsApp Channel uses a WhatsApp Web-style connection, made by scanning a QR code with your phone. We store this connection's session, encrypted, and the list of channels the number manages, only to post to the channel you chose. We do not read or store your conversations. Disconnecting in the dashboard ends the session and deletes its data.
6. Who we share it with
We share data only with suppliers that help us provide the service (processors), each with the minimum needed:
- Railway: hosting for the servers and the database;
- Cloudflare: DNS, network protection and storage of designs and images (R2);
- Kiwify and Stripe: sales, billing and subscription management;
- Meta: publishing to Instagram, as you authorized;
- Artificial intelligence providers: they receive the source article's text and your editorial instructions to generate the new version, with no permission to use them for training;
- Resend: sending the access code emails and account notices.
We may also share data when the law or a court order requires it.
7. International transfer
Some of these suppliers store or process data outside Brazil, mainly in the United States. In those cases the transfer follows art. 33 of the LGPD, with contractual clauses and data protection safeguards offered by the suppliers.
8. How long we keep it
| Data | Period |
|---|---|
| Waitlist | Until you ask to be removed, or up to 12 months after accounts open, whichever comes first |
| Instagram tokens and WhatsApp session | While the integration is active; deleted within 30 days after the subscription is canceled |
| Articles, designs and history | While the account exists; after cancellation, 90 days for you to export, then deleted |
| Access logs | 6 months (Marco Civil da Internet, art. 15) |
| Tax and payment data | For the period required by tax law |
9. Security
Connections always use HTTPS; integration tokens and sessions are encrypted (AES-256-GCM) with a key kept separate from the database; each customer's data is isolated from the others; internal access is limited to those who need it. If there is an incident that may cause significant risk or harm, we will notify you and the Autoridade Nacional de Proteção de Dados (ANPD, Brazil's National Data Protection Authority), as the LGPD requires.
10. Your rights
Under the LGPD (art. 18), you can ask for: confirmation that we process your data; access to it; correction; anonymization, blocking or deletion of anything unnecessary; portability; deletion of data processed with consent; information about who we share it with; and withdrawal of consent. To leave the waitlist, just ask.
Write to fale@vortz.com.br from your registered email. We reply within 15 days. You can also file a complaint with the ANPD.
11. Cookies and third-party resources on the site
The vortz.com.br site does not use advertising or tracking cookies. The platform uses only the session cookie needed to keep you signed in. The site loads fonts from Google Fonts and sample images from Unsplash; when you open the page, your browser connects to these services, which receive your IP address as with any visit.
12. Changes to this policy
If we change this policy in a significant way, we will let you know by email or in the dashboard before the change takes effect. The version date is at the top of the page.