This policy explains how GoLiveCommerce processes the personal data of merchants (those who subscribe to the platform) and of buyers (those who buy during a merchant's live stream), in accordance with Brazil's General Data Protection Law (Lei Geral de Proteção de Dados, Law No. 13,709/2018, the "LGPD").
1. Who is responsible for your data
- Merchants and website visitors: GoLiveCommerce is the controller: GoLiveCommerce, CNPJ (Brazilian company registration number) 57.602.927/0001-19.
- Buyers: the controller is the merchant who ran the live stream and sold the product. The merchant decides what your data is used for (delivery, customer service, invoicing). GoLiveCommerce is the processor (operador): it processes the data on the merchant's behalf and only to make the sale happen. Requests about your purchase data may be made to the merchant or to us, and we forward them to the merchant where applicable.
2. Data Protection Officer (DPO) and contact
Officer in charge of personal data processing (encarregado): GoLiveCommerce privacy team. Contact for privacy matters and general questions: contato@golivecommerce.com.br.
3. What data we process
Merchants
- Registration: name, email, password (stored only in irreversible form) and store name.
- Instagram/Facebook account connected through Meta's official login: account and page identifiers and access tokens (stored encrypted).
- Subscription: plan, status and billing history. Card details are entered in Stripe's environment and do not pass through our servers.
- Store content: products, stock, coupons, settings and automations.
Buyers
- Instagram: username, identifier and the text of comments and direct messages exchanged with the store during and after the live stream.
- Checkout: name, CPF (Brazilian individual taxpayer number), email, phone number and delivery address.
- Order and payment: items, amounts, shipping, coupon and payment status. Card details, when applicable, are entered in the payment provider's environment and do not pass through our servers.
All visitors
- Technical access logs (IP address, date and time, browser), kept for security and to meet legal obligations.
- Cookies and local storage, as described in the Cookies section.
4. What we use it for and on what legal basis
| Purpose | Data subject | Legal basis (LGPD, art. 7) |
|---|---|---|
| Creating and maintaining the account, providing the contracted service and billing the subscription | Merchant | Performance of a contract |
| Reading live stream comments, identifying the order, reserving stock and sending the checkout link by DM | Buyer | Performance of a contract (on the merchant's behalf) |
| Processing checkout and payment (Mercado Pago) and calculating shipping | Buyer | Performance of a contract |
| Keeping access logs (Brazilian Civil Rights Framework for the Internet, Marco Civil da Internet) and tax records | All | Compliance with a legal obligation |
| Preventing fraud and abuse, and protecting the platform | All | Legitimate interest |
| Transactional emails (account confirmation, password, order) | Merchant and buyer | Performance of a contract |
| Website usage statistics (Google Analytics): cookies only with consent; before acceptance, aggregate measurement without cookies | Visitors | Consent (cookies) and legitimate interest (measurement without cookies) |
5. Who we share it with
We do not sell personal data. We share only what is necessary with these suppliers (processors):
| Supplier | Purpose | Where it processes |
|---|---|---|
| Cloudflare | Website hosting, content delivery network and protection against attacks | Global (including the US) |
| Supabase | Database and merchant authentication | Brazil (São Paulo, sa-east-1) |
| Vultr | API server (VPS) and processing queues | Brazil (São Paulo) |
| Meta (Instagram/Facebook) | Reading comments and sending messages through the merchant's connected account | US and others |
| Mercado Pago | Processing the buyer's payment into the merchant's own account, which the merchant connected to Mercado Pago (PIX, Brazil's instant payment system, and other available methods) | Brazil |
| AbacatePay (temporarily inactive) | Generating and confirming the PIX payment in the merchant's own account; not used while the provider is inactive | Brazil |
| Stripe | Billing merchant subscriptions | US and others |
| Melhor Envio | Shipping quotes (CEP postal code and package dimensions) | Brazil |
| OpenAI | Interpreting the comment text to identify the product ordered | US |
| Resend | Sending transactional emails | US |
| GoHighLevel | CRM, only when the merchant enables the integration | US |
| Website statistics (Google Analytics): cookies only with your consent; without consent, only aggregate measurements without cookies | US and others |
Buyer payment: the amount goes directly to the merchant's Mercado Pago account (AbacatePay is temporarily inactive and is not used). GoLiveCommerce neither receives nor holds this money; it only sends the provider the data needed to generate the charge and receives the payment status in return. The merchant (the controller) decides how the buyer's data is used; GoLiveCommerce acts as the processor.
We also share data with public authorities when required by law or by a court order.
6. International transfer
Some suppliers process data outside Brazil, mainly in the US. These transfers follow art. 33 of the LGPD and are made to companies that adopt contractual clauses and security measures compatible with Brazilian law.
7. How long we keep it
- Merchant account, products, orders, comments and messages: while the account is active and for the legally required period. The merchant can delete comments and messages from the dashboard.
- Orders and tax data: for the period required by tax legislation.
- Access logs: for the period set by the Marco Civil da Internet (art. 15).
- Meta tokens: until the merchant disconnects Instagram or Meta notifies us that the app was removed.
- Cookies: for the period in the table below or until you change your choice.
You may request the deletion of your data at any time (section 9), except for data that the law requires us to keep.
8. Security
Always-encrypted connections (HTTPS), access tokens stored encrypted, passwords in irreversible form and internal access restricted to those who need it to operate the service.
9. Your rights
Under art. 18 of the LGPD, you may request at any time:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
- portability to another supplier;
- deletion of data processed on the basis of consent, and withdrawal of consent;
- information about who we share your data with.
Send your request to the DPO's email (contato@golivecommerce.com.br). We reply within 15 days. Some data must be kept even after a deletion request, such as tax data. To disconnect Instagram and request the deletion of Meta-related data, see Data deletion. You may also file a complaint with Brazil's National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD) at gov.br/anpd.
11. Changes
This policy may change. The version published on this page, with the date above, is the one in effect.