Privacy policy

Updated on October 15, 2026.

Translation provided for convenience. This page is an English translation of the Portuguese original. If there is any difference between the two, the Portuguese version prevails.

In short: we process the data of the companies that connect their accounts to Espectro, on their behalf, only to provide the service. We do not sell data, we do not use one advertiser's data for another, and the contact data sent to Meta leaves our server with one-way encryption.

1. Who we are

Espectro Soluções is the trade name of 62.060.485 JOAO FLAVIO DE SOUZA, registered in the Brazilian company registry under CNPJ 62.060.485/0001-66, with its registered office in São Sebastião do Paraíso/MG, Brazil. We offer:

• Espectro: ad sales tracking. It receives the sales from the advertiser's checkouts, matches them with the UTMs and the Meta ad spend, and shows revenue, profit, ROAS and CPA.
• Espectro Pay: PIX checkout for stores.
• AI-assisted campaign management: under development, not yet available.

This policy applies to the espectrosolucoes.com.br website and to the services above.

2. Our role: processor of other companies' data

Espectro and Espectro Pay are used by companies and individuals who sell online and advertise (the advertisers). When an advertiser connects their ad accounts, checkouts or store, the data that passes through our systems belongs to them.

• For this data, the advertiser is the controller and Espectro Soluções is the processor, under Brazilian Law 13.709/2018 (LGPD, the General Data Protection Law). We process the data only to provide the contracted service and in accordance with the advertiser's instructions.
• Each advertiser sees only their own data. We do not combine data from different advertisers and we do not use one advertiser's data to serve another.
• We are the controller only of the data of people who contact us through the website form and of the registration data of dashboard users.

3. Data we receive from Meta

We only receive data from Meta when the advertiser chooses to connect their ad account to Espectro (through Facebook Login or with an access token they generate themselves). We read only the accounts they have authorized.

What we receive

• Ad accounts: ID, name, currency, time zone, account status and business portfolio name.
• Campaigns, ad sets and ads: ID, name, status, objective and budget.
• Spend and results: amount spent, impressions, reach, frequency, clicks, CPC, CPM, CTR and actions recorded by Meta in the selected period.
• Pixels (datasets): the ID of the pixel the advertiser links to each product and the Conversions API access token they register.
• The access token granted by Meta for the connection.

What we use it for

• To show the advertiser, alongside their sales, how much each campaign, ad set and ad cost and how much it sold (CPA, profit and ROAS).
• To pause or reactivate a campaign only when the advertiser clicks to do so in the dashboard. Espectro does not change campaigns on its own.
• To send the advertiser's purchases to their pixel (section 5).

We do not use Meta data to advertise to anyone, we do not sell this data and we do not pass it on to third parties other than the subprocessors listed in section 7.

Pages, Instagram, customer service and posts

When the advertiser also connects their Facebook Page and Instagram professional account, we receive and store, only to show and operate them in the advertiser's dashboard:

• Page and Instagram: ID, name, picture, follower count and aggregated metrics (reach, visits and engagement).
• Comments on posts and ads: text, date, public name and ID of the person who commented, and the replies.
• Messages sent to the business on Messenger and Instagram Direct: text, date, public name and ID of the sender.
• Leads from ad lead forms: the fields the business itself chose for the form (for example, name, email and phone), with the source campaign.
• Posts created in the dashboard and the product catalog the advertiser sends to Meta.

We use this data only so the advertiser can reply to, hide or delete comments, reply to messages, view and export their leads, publish and schedule posts and keep the catalog up to date. Nothing is published, replied to, hidden or sent without a person's action or a rule the advertiser turned on. Messages outside the 24-hour window are only sent by a person, under Meta's rules.

4. Sales data and buyer data

In Espectro (tracking)

The checkouts the advertiser connects send the store's orders to Espectro. Each order may include:

• Order: number, product, amount, status and dates.
• Buyer: name, email, phone, CPF (Brazilian individual taxpayer number), city, state, postal code (CEP), IP address and browser.
• Source: campaign UTMs, the ad click identifier and the Meta pixel cookies.

The Espectro script, which the advertiser installs on their own pages, stores the UTMs and the click identifier in a cookie of the store itself (_esp, for 90 days) and in the browser's storage, and fires the product's Meta pixel. Each arrival on the page is also recorded on the Espectro server (a random click and browser identifier, the UTMs and ad identifiers, the page, the referring site, the IP address and the browser), with no third-party cookie. The click identifier goes in the checkout link and comes back with the sale. This data is used only to link the sale to the ad that brought it and for Meta's Conversions API.

In Espectro Pay (checkout)

People who buy from a store that uses Espectro Pay provide their name, email, CPF, phone and delivery address. We use this data to create the order, generate the PIX payment, send the purchase emails (confirmation, and a reminder with a coupon when the PIX expires or the purchase is left unfinished) and notify the store's systems. We do not ask for or store bank or card details: payment is made in the buyer's banking app. Here too, the store is the controller and we are the processor.

5. Purchases sent to Meta through the Conversions API

When an order is paid and the advertiser has turned on sending for that product, Espectro notifies Meta of the purchase, directly from our server to the advertiser's own pixel. This lets Meta know which ad brought the sale.

• With one-way encryption (SHA-256), applied on our server before sending: email, phone, first name, last name, city, state, postal code, country and CPF (as an external identifier). These values cannot be reversed into the original data.
• Without encryption, because Meta requires it this way: IP address, browser and the click and pixel cookie identifiers.
• Purchase data: amount, currency, product and the event identifier, the same one used in the browser, so that Meta does not count the sale twice.

6. Artificial intelligence

AI-assisted campaign management is not yet available. When it is:

• the AI will only analyze the advertiser's own campaign and sales data to suggest adjustments;
• no change will be made to the ad account without a person approving it;
• the data will not be used to train AI models, ours or third parties', and will only be sent to AI providers that commit to this;
• the AI provider will be added to the list of subprocessors before the feature is turned on.

7. Who we share data with (subprocessors)

To provide the service, we rely on the following providers, which process data only for this purpose:

• Server provider: hosts the systems and data of Espectro and Espectro Pay.
• Transactional email service: sends the Espectro Pay emails and the contact form notifications.
• The Espectro Pay payment processor: generates and confirms PIX charges.
• Meta Platforms: source of the ad data (section 3) and recipient of the purchases sent to the advertiser's pixel (section 5).

We may also disclose data when required by law or by an order from a competent authority. We do not sell data.

International transfers

Some of these providers, such as Meta and cloud providers, may process data outside Brazil. In those cases the transfer follows article 33 of the LGPD and is only made to providers that offer guarantees of compliance with the law, such as data protection contractual clauses (article 33, II).

8. Security

• HTTPS connections.
• Meta and Conversions API access tokens stored separately, with restricted access on the server, and never shown back in the dashboard.
• Each connected checkout has its own token; requests without the correct token are rejected.
• Server access by key only, daily backups and automatic security updates.

9. How long we keep data

• Meta and sales data: for as long as the advertiser uses the service. An account's access token is deleted as soon as the advertiser removes the connection. The other data from that connection is deleted within 30 days of the deletion request or the end of the contract, except for what the law requires us to keep.
• Comments, messages, leads and posts: while the Page or Instagram account is connected. They are deleted within 30 days after the connection is removed or the advertiser asks. Notifications received from Meta (webhooks) are kept for at most 7 days.
• Clicks recorded by the script on store pages (with IP and browser): 90 days, deleted automatically after that.
• Backups: replaced every 14 days.
• Espectro Pay: orders for as long as the store needs them for delivery, exchanges and legal and tax obligations; unfinished carts for up to 30 days.
• Website form: up to 12 months after the last contact. The sender's IP address is used only to limit repeated submissions and is not stored with the message.

10. Your rights

Under article 18 of the LGPD, the data subject may request at any time:

• confirmation that their data is being processed;
• access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the law;
• portability of the data to another provider;
• deletion of data processed with their consent;
• information about who the data has been shared with;
• information about the possibility of not giving consent and what happens in that case;
• withdrawal of consent.

We answer requests within 15 days, the deadline set by article 19, II, of the LGPD. Write to privacidade@espectrosolucoes.com.br or use the contact form.

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

If you bought from a store that uses our services, the store is the controller: you can make your request to the store, and we help the store comply. If you prefer, contact us directly through the contact form. To delete data, see the data deletion page.

11. Cookies

This website does not use cookies or visitor analytics tools. The Espectro dashboard uses a session cookie, which is needed to keep you signed in. The cookie set by the Espectro script on store pages is described in section 4.

12. Contact and data protection officer

Data protection officer: João Flávio de Souza. Email: privacidade@espectrosolucoes.com.br. You can also use the contact form.

13. Changes to this policy

When this policy changes, the date at the top of the page will be updated. Important changes will be communicated to advertisers before they take effect.