Version 1.0 · effective 27 October 2026
Privacy Policy
This Policy explains which personal data Portal Vision processes, why, with whom it is shared and what your rights are, under the Brazilian General Data Protection Law (Law 13,709/2018, "LGPD") and, where applicable to customers abroad, the EU General Data Protection Regulation ("GDPR") and similar laws. It covers the website portalvision.com.br, the platform app.portalvision.com.br, the dashboard and the Station program.
1. Who we are
The controller of the data processed by the website and the platform is Portal Vision, CNPJ 13.647.263/0001-39, based in Vila Velha, ES, Brazil. Data protection officer (DPO) contact: [email protected].
2. Camera images: what leaves your computer and what doesn't
This is the most important point of this Policy, which is why it comes first.
- The Station program analyses the camera video on the Customer's computer. The images are not sent to our servers, are not recorded by us and do not leave the premises for counting purposes.
- What the Station sends to the platform are numbers: how many people or vehicles crossed each line, per hour; how many are inside a zone and for how long; the heat-map grid (how long someone was present in each cell of a 64×36 grid); traffic-gate measurements.
- For the heat map, the Station sends a background frame of the camera captured when nobody is in the scene, to serve as the backdrop for the heat blobs. This frame is refreshed periodically and never contains people.
- The program does not perform face recognition, does not estimate age, gender or any characteristic of people, does not read license plates and does not recognise the same person across different cameras. It detects silhouettes and follows them while they are in frame, with a temporary number that is then discarded.
- Live remote access: a user authorised by the Customer (or our support, with authorisation) can open the Station through the platform and see the camera image in real time, with the lines drawn, for configuration and support. This image passes through our servers in transit only, is not recorded, and each access is logged (who, when, which station).
- For diagnostics the Customer can record 10 minutes of video on its own computer; that recording only reaches us if the Customer sends it manually.
3. Data we collect
| Category | Data | Source |
|---|---|---|
| Account and billing | name or company name, tax identification number, contact person, e-mail, phone/WhatsApp, city and country, plan purchased, order history, payment status (we do not store card numbers) | provided by the Customer at purchase or on the platform |
| Platform users | login, name, e-mail, role (administrator, manager, viewer), password (stored only as a cryptographic hash), two-factor authentication secret (if enabled) | created by the Customer or by our team |
| Usage and security | date, time and IP address of each login and of relevant actions (user creation, remote access, license changes), browser used | generated automatically |
| Stations | computer name, program version, operating system, source IP address, camera status (no images), computer identifier (cryptographic hash, to bind the license) | sent by the Station program |
| Counts and measurements | the numbers described in section 2 | sent by the Station program |
| Contact | messages exchanged by e-mail or WhatsApp with support | sent by you |
We do not collect special-category data (health, biometrics, racial origin, religion, etc.) and we do not process data of filmed people in a way that identifies them.
4. Why we use it and on what legal basis
| Purpose | Legal basis (LGPD / GDPR) |
|---|---|
| Create and maintain the account, deliver access, link code and license; show the dashboard | performance of a contract |
| Issue charges and invoices and comply with accounting and tax obligations | legal obligation and performance of a contract |
| Send service e-mails: access, password, billing, cameras-over-plan warning, important updates | performance of a contract |
| Log accesses and actions, prevent fraud and misuse, protect accounts | legitimate interest and legal obligation (Brazilian Internet Act, art. 15) |
| Provide support, including remote access to the Station when requested | performance of a contract |
| Improve the service with aggregated, anonymised statistics | legitimate interest |
| Send commercial communications about Portal Vision news | consent — you can opt out at any time via the link in the e-mail or by contacting us |
5. Who we share it with
- Payment processors — for customers in Brazil, Asaas Gestão Financeira S.A. (Pix, bank slip, card); for customers abroad, an international card processor named on the invoice. They receive name, tax identification, e-mail, phone and amount. Asaas policy: asaas.com.
- Infrastructure providers — cloud and network services used to publish the website and the platform (such as Cloudflare) and e-mail services for service messages. They process data on our behalf and under contract.
- Authorised resellers and partners — only when the Customer subscribes through a partner, who then sees its own customers' data on the platform.
- Authorities — when required by law or court order.
We do not sell personal data and do not share it for third-party advertising. The platform's servers are located in Brazil; some infrastructure providers may process data in other countries, with the safeguards provided by law. For customers in the EU/EEA this means your data is transferred to Brazil, which is necessary to perform the contract with you.
6. How long we keep it
- Account and registration data: while the subscription is active and for 90 days after termination, for possible reactivation and export; then deleted or anonymised.
- Tax and billing records: for the period required by tax law (as a rule 5 years).
- Access logs (login, IP): 6 months, as required by the Brazilian Internet Act, or longer under court order.
- Counts and measurements: while the account exists; in the Station program, for up to 400 days (counts) and 180 days (heat maps, zones and traffic) on the Customer's computer.
- Heat-map background frame: replaced on each refresh; deleted with the camera.
7. Your rights
As a data subject you may, at any time and free of charge: confirm whether we process your data; access it; correct incomplete or outdated data; request anonymisation, blocking or deletion of unnecessary data; request portability; know with whom we share it; withdraw consent; and object to processing based on legitimate interest. Much of this data can be viewed and corrected directly on the platform (My account and Customer details). For other requests, write to [email protected]; we reply within 15 days. You may also lodge a complaint with the Brazilian data protection authority (ANPD) or, if you are in the EU/EEA, with your local supervisory authority.
8. Security
- All communication between the browser, the Station and the platform uses HTTPS.
- Passwords are stored only as cryptographic hashes; integration keys are encrypted in the database; the Station license is digitally signed.
- Automatic lock-out after failed login attempts; two-factor authentication available to all users; audit log of sensitive actions.
- Periodic backups of the database, kept in a protected location.
- In the event of a security incident posing a risk to data subjects, we will notify those affected and the competent authority as required by law.
9. Cookies and browser storage
The website uses no tracking cookies and no advertising tools. The platform stores in the browser only what is needed to work: your session token (so you don't have to sign in on every page), screen preferences (selected site, tab) and the progress of an installation in course. This data stays in your browser only and can be removed by signing out or clearing the site data.
10. Children
The service is intended for businesses and for people aged 18 or over. We do not knowingly collect personal data from children; counts do not identify age. If you believe a minor has provided us with data, contact us and we will remove it.
11. People filmed at the Customer's premises
The cameras belong to the Customer and are located at its premises. With regard to the images, the Customer is the controller; Portal Vision acts as processor, processing on the Customer's computer and receiving only the numbers described in section 2. The Customer is responsible for complying with the law on video capture at its premises — in particular, visibly informing people of the cameras and of the counting purpose. Because Portal Vision does not identify people, access or deletion requests about a specific filmed person cannot be fulfilled by us; such requests must be addressed to the premises.
12. Changes
This Policy may be updated. The current version is always on this page, with its date. Material changes are communicated by e-mail or on the platform.
13. Data protection officer and contact
Data protection officer (DPO): Portal Vision — [email protected]. For data-related requests, state your name, the registered e-mail and what you need.