Privacy policy

Ultraspy is operated by AVUS LTDA, CNPJ 50.958.915/0001-82, based at Rua Wilson Barbosa de Melo, 23, Térreo 01, Atalaia, Aracaju - SE, CEP 49037-590, Brasil ("we"). We are the controller of your personal data under Brazil's General Data Protection Law (LGPD, Law 13,709/2018).

Data Protection Officer (DPO): Marcos Vinícius Silva Viana, [email protected].
Contact for anything about this policy: [email protected].

2.1. Data you give us

• Account: e-mail, name, password (stored in a protected form, never in plain text) and, if you upload one, your profile photo.
• Usage profile: what you do (your role), and the niches and countries you pick when you start.
• Your work in Ultraspy: saved offers, collections, monitors, dossiers, messages with the dossier assistant, your Ads Library search history and the sites you track.
• Payments: your plan, billing cycle (monthly or annual), currency, and the history of credits bought and spent. We do not store card numbers. The card, the CPF (when you pay in reais) and the billing address are asked for and kept by the payment provider.
• AI assistant connections: if you connect Ultraspy to Claude or ChatGPT, we keep the connection's authorization and a record of the calls made through it.

2.2. Data collected automatically

• Session: when you sign in, we keep the IP address and browser (user agent) of that session, for security and so you can see and end sessions.
• Country, to pick the currency: our delivery network works out your country from the IP address of your request. We use it only to show the price in reais or dollars.
• First visit: when you arrive from an ad or a link, we keep the utm_* parameters (campaign source) and a random visitor ID, to know which campaigns bring sign-ups and subscriptions.
• Steps until purchase: opened a page, clicked something locked, opened the subscription, paid. This is tied to the random visitor ID and, only at payment, to your account.
• Server technical logs: the server records requests (address requested, date, result) to run and protect the service.

We do not use Google Analytics, Meta Pixel or any other third-party analytics or advertising tool on the website or the app.

2.3. Data we do not collect

We do not collect card data, we do not read your passwords for other sites and we do not record what you type on other pages.

We do not sell your data and we do not use it for third-party advertising.

The Ultraspy extension (Chrome and Firefox) shows, over the page you are looking at, what Ultraspy knows about it. This section says exactly what it reads, what it sends and what stays only on your device.

4.1. What it reads on the page without sending

The extension reads the open page and the tab's network requests (the webRequest permission) to find the sales video, the checkout link, hidden buttons and ad pixels. The result is counted and shown on your device (the number on the extension icon and the panel). This work happens on every http and https page you open, but nothing is sent to us because of it.

To do this, the extension keeps, per tab, in the browser's memory, only addresses that look like a video or a pixel, the addresses of frames embedded in the page (iframes) and a count of video pieces per server, with limits per tab. That list is erased when you close the browser.

4.2. What it sends to Ultraspy, and when

The extension sends data only to the Ultraspy server, and only when you are signed in (without an active plan, the server refuses the request). To show the cover and play the video in the panel, it loads the video straight from wherever the page itself already loads it, without going through us.

• Page address: while the extension panel is open, each time the tab's address changes, the extension sends that address (without the part after #) to learn whether the page is in the Ultraspy Library and show ads, funnels and site data. It spends no credits. We do not use that address to build a page history in your account. The server's technical logs (section 2.2) may contain the request address These logs are kept for 6 months, as Brazil's Marco Civil da Internet (art. 15) requires.
• "Rastrear" (Track): when you click it, we send the page address to track the site. This spends credits and creates a tracked site and a dossier in your account.
• Translation: when you ask for "Traduzir a página" (Translate the page), the extension sends the page's texts (in batches) to be translated. The translation is done by an AI model provider (see section 6). Translations are kept to be reused, with no link to your account.
• Video download: when you download a sales video, we send the page address and the video address. The server copies the video and returns a link, valid for 3 hours, for the extension to save it to your Downloads folder. It spends credits.
• Credits: the extension asks how much of the credit cycle you have used, only to draw the ring on the avatar.

No other information from the page (content, forms, passwords, history) is sent.

4.3. What stays only on your device

• Signing in: the extension uses the OAuth flow with PKCE (the identity permission) and keeps the access keys in the browser's storage.local. The access key lasts 1 hour and is renewed for up to 60 days. When you click "Sair" (Sign out) in the panel, they are erased from the device.
• Preferences: theme (light or dark) and the corner where the floating button sits.
• Captures: when you use "Capturar esta página" (Capture this page), the screenshot and the page code are saved to your Downloads folder (the downloads permission). They are not sent to Ultraspy.

4.4. Why each permission

Ultraspy's use of information received through the extension adheres to the Chrome Web Store User Data Policy, including the Limited Use requirements:

• We use the data only to provide or improve the extension's features that you see in the panel.
• We do not sell or transfer the data to third parties, except: to provide those features (the providers in section 6), to comply with the law, or in a merger or sale of the company.
• We do not use the data for advertising or to build ad profiles, and we do not use it to judge creditworthiness or lending.
• People do not read the data, except with your consent, for security or abuse, to comply with the law, or when it is aggregated and anonymous.

We use service providers that process data on our behalf. They receive only what their role needs.

A site you translate may show other people's data. Send it for translation only if you may.

The app and the database run on servers in Brazil, and your account data is stored in Brazil. Some providers, such as payment, e-mail and AI model providers, may process data outside Brazil. When this happens, we transfer data to countries or companies that offer adequate protection, or under contractual protection clauses, as art. 33 of the LGPD requires.

• While the account exists, we keep its data so the service works.
• When you delete the account, the data tied to it is erased (see section 10).
• Payment and tax records stay with the payment provider and with us for 5 years, as Brazilian tax law requires.
• Server technical logs are kept for 6 months.
• Sessions expire on their own. Extension keys expire in 1 hour (renewal for up to 60 days). Video download links are valid for 3 hours.
• Backups are kept for up to 30 days.
• Cached translations and copied videos have no link to your account and may be reused by other people; today they have no deletion deadline.
• Steps until purchase of visitors without an account keep only the random ID and the campaign parameters.

Under the LGPD (art. 18), you can ask at any time to:

• confirm that we process your data and access it;
• correct incomplete or wrong data;
• anonymize, block or delete data that is unnecessary or processed against the law;
• port your data to another provider;
• delete data processed with your consent;
• know who we share your data with;
• know that you may refuse consent and what follows;
• withdraw your consent;
• object to processing based on legitimate interest.

To use any right, write to [email protected]. We answer within the time the law sets. You may also complain to Brazil's National Data Protection Authority (ANPD).

In the app, open your account and click Apagar conta (Delete account). We ask for your password. When you confirm:

1. the subscription is cancelled;
2. the account and the data tied to it are erased: profile, collections, saved offers, monitors, dossiers, assistant messages, search history, credits, API keys and AI assistant connections;
3. the profile photo is erased.

This cannot be undone. What remains afterwards:

• the payment provider's records and those the law requires us to keep (section 8);
• visitor steps with no link to the account (the link to you is cut);
• offers you sent to the Library are left without your name;
• cached translations and videos, which are not tied to you.

If you cannot sign in, ask for deletion by e-mail at [email protected].

We use only our own cookies, needed for the service:

We do not use advertising or third-party cookies.

Passwords are stored in a protected form; the access keys of assistants and of the extension are short-lived and the server keeps only a fingerprint of them. Connections use HTTPS. No system is fully secure: if there is an incident that may harm you, we will tell you and the ANPD, as the law requires.

Ultraspy is for people aged 18 or older. We do not knowingly collect data from minors.

If we change something important, we tell you by e-mail or in the app before it takes effect. The date at the top shows the last update.