Privacy Policy – Westpace

Westpace takes the privacy of its users seriously. This Policy describes how we collect, use, store, and protect your information when you use our multi-marketplace management platform, in compliance with the Brazilian General Data Protection Law (LGPD – Law No. 13,709/2018).

1. Data Controller

The controller of personal data collected through the Platform is Westpace, reachable at privacy@westpace.us.

2. Data We Collect

We collect only the data necessary to provide the contracted services. Categories of data processed include:

Registration and account data

Name, email address, phone number, tax ID (CNPJ/CPF), and information required to create and manage your Platform account.

Marketplace integration credentials

Access tokens, API keys, and account identifiers for integrated marketplaces (Mercado Livre, Shopee, Amazon, Magalu, TikTok Shop), provided by the User to enable integrations.

Operational data

Orders, items, payments, shipments, shipping labels, invoices, and other information generated within the User's marketplace operation and transmitted to the Platform via integration.

Usage and navigation data

IP address, device and browser type, pages visited, session duration, and interaction events with the Platform, collected in anonymized form for analysis and service improvement purposes.

3. How We Use Your Data

Collected data is used exclusively for the following purposes:

·Providing, operating, and maintaining the contracted services;
·Account authentication and access security;
·Synchronizing orders, labels, and fiscal documents with integrated marketplaces;
·Generating dashboards, reports, and performance metrics;
·Essential service communications (updates, alerts, billing);
·Compliance with legal and regulatory obligations;
·Continuous Platform improvement based on anonymized usage data.

We do not use User data for third-party advertising purposes, nor do we sell it to any company.

4. Legal Basis for Processing

Westpace processes personal data based on the following legal grounds under the LGPD:

·Contract performance (Art. 7, V): data necessary to provide the contracted services;
·Legitimate interest (Art. 7, IX): usage analysis for Platform improvement and fraud prevention;
·Legal obligation (Art. 7, II): retention of records required by tax and accounting legislation.

5. Sharing with Third Parties

Westpace does not sell or rent personal data. Data may be shared only in the following circumstances:

·Integrated marketplaces: transmission of operational data (orders, labels, invoices) required for integration functionality;
·Infrastructure providers: cloud services (AWS) used for hosting, storage, and processing, under confidentiality agreements;
·Legal obligation: when required by a competent authority, court order, or applicable law.

6. Storage and Security

Data is stored on secure servers operated by Amazon Web Services (AWS), with infrastructure located in the us-east-1 (N. Virginia) region. We apply the following security measures:

·Data-in-transit encryption via TLS 1.2+;
·Passwords stored as cryptographic hashes (never in plain text);
·Role-based access control (RBAC) and JWT token authentication;
·Access logging and continuous monitoring for suspicious activity.

Data is retained while the account is active or for the period required to meet legal obligations. After account closure, data is deleted within 90 (ninety) days, except where retention is legally mandated.

7. Cookies and Tracking Technologies

The Platform and institutional website use cookies and similar technologies for:

·Essential cookies: required for authentication and user session management;
·Analytics cookies: Google Analytics (anonymized) for understanding usage of the institutional website.

Users may manage and disable non-essential cookies through their browser settings, without affecting access to the Platform.

8. Your Rights as a Data Subject (LGPD)

Under the LGPD, you have the following rights regarding your personal data:

Access

Confirm the existence of processing and obtain a copy of your data.

Correction

Request the update of incomplete, inaccurate, or outdated data.

Deletion

Request the removal of unnecessary data or data processed in violation of the law.

Portability

Receive your data in a structured format for transfer to another provider.

Objection

Object to processing carried out on the basis of legitimate interest.

Information

Obtain information about entities with which your data has been shared.

To exercise any of these rights, contact our Data Protection Officer (DPO) at privacy@westpace.us. We will respond to your request within 15 (fifteen) business days.

9. Minors

The Platform is intended exclusively for legal entities and individuals aged 18 or older. We do not intentionally collect data from minors.

10. Changes to This Policy

This Policy may be updated periodically. Significant changes will be communicated by email or in-Platform notification at least 15 (fifteen) days in advance. We recommend reviewing this document regularly.

11. Contact and Data Protection Officer (DPO)

For questions, requests, or complaints related to this Policy or the processing of your personal data, please contact:

DPO email
privacy@westpace.us

General support
contact@westpace.us

You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) at www.gov.br/anpd.