Privacy Policy

Effective November 2, 2026. This is a translation of the Portuguese version, which prevails in case of conflict.

1. Who we are

Trily is an online store platform for small businesses: the store owner sets up the store, receives orders paid online and manages products, inventory, delivery and point of sale in one place. It is operated by Sintetiza Soluções Estratégicas Ltda, a Brazilian company registered under CNPJ 45.726.415/0001-85, headquartered at Rua Oscar Hugo Martin, 334, Santa Cruz do Sul/RS, Brazil, ZIP 96816-800, which also operates the Hello Pitaya brand. In this text, "Trily", "we" and "us" refer to it.

For any matter about your data, including to contact our data protection officer, write to [email protected].

2. Two different roles

The Brazilian General Data Protection Law (LGPD, Law No. 13,709/2018) distinguishes whoever decides about the data from whoever only stores it on someone else's behalf. Trily holds both roles, depending on the data:

• Data of people with a Trily account (the store owner): we decide how it is used. We are the controller.
• Data of the store's customers (people who place an order on the storefront): the store owner decides why and how to use it, and we only store and process it on their behalf. We are the processor, and the store owner is the controller.

3. What data we collect

From people who create an account (the store owner):

• Your email and, if you create one, your password. The password is stored only in encrypted form (hash) by the authentication service; not even we can read it. To sign in without a password, we send a code to your email.
• If you turn on sign-in with Face ID or fingerprint (passkey): only the passkey's public key. Your biometrics never leave your device.
• If you choose to sign in with Google or Apple: the name and email the provider shares with us. We do not receive your Google or Apple password. If you use Apple's option to hide your email, we receive a forwarding address that Apple creates for you.
• The store's data: name, storefront web address, logo, categories, products, descriptions, prices, photos, inventory, opening hours, frequently asked questions, social networks, and the store's WhatsApp number and address. You choose whether the address and the WhatsApp number appear on the storefront.
• To receive payments online: the data the chosen payment provider requires to open or connect your account, such as name, CPF or CNPJ (Brazilian tax IDs), email, phone and address.
• To calculate shipping: the access credentials of the shipping account you connect (Melhor Envio or a Correios contract).
• What you send to the assistant: messages, photos and, if you use the microphone, your voice, which is turned into text.
• If you turn on new order alerts: the technical notification address of your browser or device.
• How the dashboard is used: records of which features were used and of errors that occurred, linked to your account.

From people who place an order on a store's storefront:

• The items, the total and the order note.
• Name, phone number and email.
• Delivery address and ZIP code, when the order is for delivery.
• CPF or CNPJ, when the payment provider requires it.
• Payment data. For cards, it passes through our servers only to reach the payment provider, or it is encrypted in the browser by the provider itself; we do not store card numbers or security codes. For payments by code, we store the charge code and the payment status.
• Product reviews, if the person chooses to leave one: rating, comment and name.

Technical operating data: IP address, browser type and access logs, generated by the infrastructure that hosts the service, to deliver pages and protect the system against abuse. For card payments, we store only an encrypted summary of the IP address, to limit attempts. The country of access, inferred from the IP address, is used to suggest the country of the store's address.

4. Why we use it, and on what legal basis

• Creating and maintaining your account and your store and showing the storefront to the public: performance of the contract you accept when creating the account (LGPD, art. 7, V).
• Recording orders, charging payments and calculating shipping on behalf of the store: performance of a contract with the store owner and pre-contractual steps requested by the customer.
• The artificial intelligence features you use (recognizing products in photos, writing descriptions, answering in the assistant, turning voice into text, setting up the store in the sign-up conversation): performance of the contract.
• Sending service emails and WhatsApp messages (sign-in codes, account notices and, when the store turns them on, order notices to the customer): performance of the contract. We do not send advertising through these channels.
• Understanding how the product is used and fixing errors: legitimate interest (art. 7, IX), limited to what is necessary.
• Security and prevention of fraud and abuse (bot verification and limits on card attempts): legitimate interest.
• Complying with legal obligations and defending rights in legal proceedings: art. 7, II and VI.

We do not sell personal data and we do not use it for advertising.

5. Who we share it with

We use service providers that process data on our behalf, each for one function:

• Supabase: database, authentication and storage of photos and logos.
• Cloudflare: hosting, page delivery, bot verification and protection against attacks.
• Resend: sending service emails and the emails the store sends to its customers.
• OpenAI and Google (Gemini): the artificial intelligence features. They receive the photos, text and voice needed for each request.
• Meta (WhatsApp): WhatsApp messages, such as order notices.
• Asaas, Mercado Pago and PagBank: payment for orders, according to the provider the store chooses, with the payment data and the payer's data. Asaas also processes the subscription to Trily's paid plan.
• Melhor Envio and Correios: shipping calculation, when the store connects its account, with ZIP codes and package dimensions. ViaCEP and BrasilAPI: completing the address from the ZIP code.
• DataForSEO: fetching the store's public Google reviews, when the store owner asks for it.
• Google and Apple: only if you choose to sign in with them.
• Your browser's or device's notification service: receives only an empty signal. The text of the alert is put together on your device, directly from Trily.

Orders placed on a storefront are visible to the owner of that store and to no other store owner: the database separates data by store. We may also share data when a law or an order from an authority requires it.

Some of these providers keep servers outside Brazil. When that happens, the transfer follows art. 33 of the LGPD, with providers committing to compatible protection.

6. Cookies and on-device storage

We use cookies and browser storage only to run the service: keeping you signed in, remembering your language and saving dashboard preferences, such as notices you have already answered. We do not use advertising cookies or third-party behavior analytics tools.

7. App permissions

In the mobile app, Trily asks for each permission only when it is needed: the camera, to photograph products and scan barcodes; the microphone, to talk to the assistant; and photos, to choose product images and the logo. You can turn each one off in your device settings.

8. How long we keep it

• Account and store data are kept while the account exists. You can delete your account and your store in the dashboard itself, under Profile; we delete everything, except what the law requires us to keep.
• Orders stay with the store while it exists.
• Backups may keep data for a short additional period, until they are replaced.
• Records that must be kept to comply with a legal obligation or for defense in legal proceedings are kept for the period the law determines.

9. Your rights

Under the LGPD (art. 18), you may request: confirmation that we process your data; access to it; correction; anonymization, blocking or deletion of unnecessary data; portability; information about who we share it with; and withdrawal of any consent given. You may also object to processing you consider irregular.

To exercise any of them, write to [email protected] from your account email, so we know the request is yours. We reply within 15 days.

If you are a customer of a store: the store owner decides about your order data. Contact them first; if they do not solve it, write to us and we will help forward your request.

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd.

10. Security

All traffic uses HTTPS. Each store sees only its own data, and this separation is enforced by the database itself, not just by the screen. Passwords are encrypted, and we do not store card data. No system is completely immune; if an incident occurs that may cause relevant risk, we will notify those affected and the ANPD, as the law requires.

11. Children and teenagers

Trily is intended for people who can enter into contracts on their own. We do not create accounts for people under 18.

12. Changes to this policy

If we change something relevant, we update this page, with the new effective date at the top, and notify account holders by email.