Privacy Policy

This Privacy Policy describes the privacy practices for the Site operated by spyou (hereinafter referred to as the Site, if singular, or Sites) and how the Site operated by spyou collects and uses the personal data you provide on the Site of spyou for the purpose of using the spyou Service. It also describes the choices available to you regarding our use of your personal information and how you can access, update and delete that information.

Paulo Roberto ([email protected]) is the designated representative of spyou in accordance with law 13.709/209 regarding the protection of individuals with regard to the processing of personal data (the LGPD). Use of the Site is possible without any indication of personal data; however, if a user wants to use the spyou Service through our Site, the collection and processing of personal data may be necessary. If the processing of personal data is necessary, we generally obtain the user's consent as an interested individual.

The processing of personal data such as the name, address, email, telephone number or billing information of an interested individual will always be in accordance with the General Data Protection Law (LGPD) and in accordance with the data protection regulations. country-specific data applicable to spyou. Through this Privacy Policy, we would like to inform the general public as to the nature, scope and purpose of the personal data we collect, use and process. In addition, interested individuals (users) are informed, through this Privacy Policy, as to the rights that apply to them.

Como controladora, a spyou implementou inúmeras medidas técnicas e organizacionais para garantir a mais completa proteção dos dados pessoais processados por meio deste Site. Nesta Política de Privacidade, “spyou, nós e nosso significam spyou.

Personal data means any information relating to an identified or identifiable natural person (“interested individual/user”). An identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as name, identification number, location data, an online identifier or one or more factors specific to physical or psychological identity, genetic, mental, economic, cultural or social of that physical person.

Interested individual/user is an identified or identifiable natural person, whose personal data are processed by the controller responsible for processing; a user of the Spyou Softwares.

Processing is any operation or set of operations that are performed on personal data or sets of personal data, whether by automated means or not, such as collecting, recording, organizing, structuring, storing, adapting or altering, retrieving, consulting, using, disclosing by transmission, dissemination or otherwise making available, aligning or combining, restricting, deleting or destroying.

Pseudonimization is the processing of data in such a way that personal data can no longer be assigned to a specific interested individual/user without the use of additional information, as such additional information is kept separately and is subject to technical and organizational measures to ensure that personal data are not assigned to an identified or identifiable natural person.

Encryption is a security measure for personal data; as a form of encryption, it is a process whereby personal data is transformed into an encoded and intelligible version using encryption algorithms and an encryption key, and whereby a decryption key or a code allow users to decode the data again.

Consentimento do indivíduo interessado/usuário é qualquer indicação específica, informada, inequívoca e dada livremente quanto aos desejos do indivíduo interessado/usuário mediante o qual ele ou ela, por meio de uma declaração ou por uma ação afirmativa clara, indica estar de acordo com o processamento de dados pessoais relacionados a ele ou ela.

Controller for the purposes of the General Data Protection Act (LGPD), and other provisions related to data protection is:

spyou LTDA ME, CNPJ : 10176559/0001-20 | R. Manuel Borba, 292 - Santo Amaro, São Paulo - SP, 04743-011 Telefone: +55 11 3042-4808 E-mail: [email protected]

Anyone can access our Site without the need to provide their personal data. The purpose of spyou processing your personal data and collecting information about you is as follows (the Purpose):

• Your intent when using our Service; • For spyou to provide the User with the Service ordered and purchased; • For the execution of a contract to which the user is a party, in accordance with Article 11 of the LGPD, and the data collected is necessary for spyou to identify the user and charge if necessary. • To verify your identity and provide customer service and assistance; • Analyze your use of our Site and Service to better understand how they are being used so that we can improve our Services and user experience, and thereby attract and retain users.

As you are willing to use our Service, you must provide your personal data (to register an account and purchase software), thus becoming a user of spyou. For this Purpose, we collect and process two types of information: aggregate monitoring (collective data relating to a group or category of customers) and Site usage information that we automatically collect as you access our Site, such as (1) types and versions of the browsers used, (2) the operating system used by the access system, (3) the website through which the access system reached the Site (also called referrer), (4) the subsites, (5) the data and time of access to the Site, (6) the Internet access system provider, (7) data provided by Google Analytics, Facebook, AdWords, Instagram, Tawk.to, and (8) any other similar data and information that can be used in the event of attacks on our information technology systems.

By using this data and general information, we do not draw any conclusions as to the individual concerned. Rather, this information is necessary to (1) enter the content of our Site correctly, (2) optimize the content of our Site in addition to its advertisements, (3) ensure the viability of our information technology and technology systems of the Site in the long term, and (4) provide law enforcement authorities with the information necessary for prosecution in the event of a cyber attack. Therefore, we anonymously analyze the data and information collected in order to increase the protection and security of our company's data, and to ensure a level

optimal protection for the personal data we process. The anonymous data in the server log files is stored separately from all personal data provided by an interested individual (depersonalization), and personal data that you voluntarily provide, subject to your consent, when placing an order for a subscription plan. Spyou Software and accept the usage, privacy and cancellation policies. Please be aware that you are not obligated to provide us with your personal data. However, if you do not provide us with your name and email address, you will not be able to create an account to log in and make a purchase of the Spyou Software and consequently use our Service.

We strive to comply with the LGPD and implement the principle of data minimization. Personal data, as defined above, which we collect, consists of: full name (first name and last name), (ii) email address, providing the interested individual with the ability to register an account and become a user of the our Service for the purpose of using the spyou Software accordingly, (iii) billing information, which includes full address, zip code, city, country (iv) method of payment (not full credit card number and date expiration date), (v) IP address – assigned to the Internet provider (ISP) and used by the interested individual/user, and (vi) location data – for statistics regarding user areas.

The storage of this data is based on the premise that this is the only way to prevent the misuse of our Service, and, if necessary, to enable the investigation of crimes. Storage of this data is necessary to protect the controller. These data are not transmitted to third parties, unless there is a legal obligation to transmit the data, or if the transfer serves the purpose of criminal proceedings. Personal data entered by the interested individual/user is collected and stored solely for the controller's internal use and for its own purposes. Personal data is stored separately in spyou's database to avoid identifying the interested individual using depersonalization features in accordance with the LGPD's storage limitation principle. We do not authorize the use of your personal data by any third parties (only under exceptional conditions described below under “Legal Matters”). We operate and maintain a variety of online security measures to protect and keep your personal information private and secure.

When purchasing the Software from spyou, you must fill in the User Information, which must contain your personal information, such as identification (first name, last name) and e-mail address, which are processed and stored by spyou. You must also fill in the Billing Information and Payment Method, which must contain your personal data, which is partially stored by spyou and processed by payment providers. Based on the personal data you provide us during account registration, we may send you a welcome email to verify your login and password. You can log into your account on the Site using the login and password sent to your email. All activity on your account is password protected, and you must maintain and take all necessary steps to protect the confidentiality of your password. We will also communicate with you to answer your questions regarding any information or Service you request.

Our Site contains information that enables quick electronic contact with us, in addition to direct communication with us, which also includes an email address, telephone number and WhatsApp. If a user contacts us in any way, the Personal data transmitted by that user is automatically stored. We will communicate with you by email or any other method you choose (including, but not limited to, telephone). We may use your Personal data to: (a) improve your browsing experience by customizing the Site and to improve the Service; (b) send you information by email regarding registration status, password verification, payment confirmation; (c) send you communications regarding your use of the Service.

We may use your Personal Information to contact you with newsletters, promotional or marketing materials and other information that is related to the Service. In this regard, you must consent separately within your account for each communication. You can always unsubscribe from any type of communication in your account. As you use our Service, you may import information that you have collected from target devices into your account. All information is stored and encrypted on servers contracted by spyou. Information downloaded by a user to their device or browser is not encrypted and the user is solely responsible for protecting it. We do not have a direct relationship with anyone other than you, and as such, you are solely responsible for ensuring that you have the appropriate consent to collect and process information from an owner of a target device. If you use a computer in a public place or share a computer with others, please remember to sign out of your account and close your browser window when you finish your access to our Site and Service to prevent others from accessing your personal information. You are solely responsible for the control and use of each password you create.

We use security hardware and software, software updates and network scanning procedures designed to protect the information (including personal data) under our control, following generally accepted industry standards. We work with third-party service providers and vendors who use encryption and authentication to keep your personal data confidential. If stored, we host personal information on systems protected by firewalls that are accessible only to limited personnel and under a data processing agreement (DPA).

User credentials are stored in the database. User password is not stored. We only store the password hash generated from the user's password. We receive open data from devices using encrypted HTTPS protocol

spyou considers your use of its Services to be private. However, we may disclose your personal data stored in your account and/or on spyou servers and databases to:

1 comply with the law or legal processes that are handed over to us; (2) enforce and investigate potential violations of this Privacy Policy; including using this Service to participate in or facilitate activities that violate the law; (3) investigate potential fraudulent activities; (4) protect the rights, property, or safety of spyou, its employees, its customers, or the public.

No caso de uma troca de controle da spyou (como transferência de ativos por meio de fusão, cessão ou liquidação da entidade comercial, ou de qualquer parte de suas propriedades, ativos ou ações), ou no caso de uma venda direta ou indireta de qualquer parte de suas propriedades de publicação e/ou seu(s) Site(s), dados pessoais dos usuários do(s) Site(s) afetado(s) em nossa posse serão transferidos ao novo proprietário/sucessor. Você será notificado de tal transação e poderá exercer seus direitos legais, de acordo com a LGPD. Você pode sempre alterar ou apagar seus dados pessoais, ou cancelar sua participação entrando em contato conosco como disposto abaixo, ou se o adquirente publicar uma nova Política de Privacidade com novas informações de contato, você pode alterar ou apagar seus dados pessoais, ou cancelar sua participação seguindo quaisquer novas instruções que forem publicadas.

We may share Aggregated Information with third parties, including strategic partners, for promotional or marketing purposes under data processing agreements, which protect the transfer and processing of personal data (DPA) in accordance with the LGPD. We may share Aggregated Information with third parties, including strategic partners, for promotional or marketing purposes under data processing agreements, which protect the transfer and processing of personal data (DPA) in accordance with the LGPD. The controller may also transfer to one or more processors (eg payment provider under data processing agreement) the personal data of an interested individual for payment processing purposes, which is attributable to the controller and without which a user does not could acquire the Software and use the Service from spyou.

As we use a third party Technology Service to provide the Service, we may transfer your personal data internationally. Providers of such Technology Service may process personal data collected during the process of providing their Services to us in the form of a subcontractor only upon data processing agreement (DPA) in accordance with the LGPD. If there is a risk of unauthorized disclosure of personal data, the controller communicates the breach of personal data to the interested individual without undue delay. However, as the controller has implemented appropriate technical and organizational protection measures, such as encryption, having been applied to personal data affected by the personal data breach, the controller is not obligated to communicate the interested individual. However, encryption is useless if the access password or other credentials are poorly protected and stored by the interested individual. In this case, the controller is not responsible for the breach of personal data. In the event of a breach of personal data, the controller will notify, without undue delay, whenever practicable, within 72 hours of becoming aware of this fact, the breach of personal data to the competent supervisory authority.

a Direito de confirmação Cada indivíduo interessado terá o direito concedido pelo legislador de obter do controlador a confirmação quanto a se dados pessoais relacionados a ele ou ela estão sendo processados. Se uma das razões citadas acima se aplicar, e um indivíduo interessado quiser solicitar a remoção dos dados pessoais armazenados pela spyou, ele ou ela podem a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

b Direito de acesso Cada indivíduo interessado terá o direito concedido pelo legislador de obter do controlador informações livres sobre seus dados pessoais armazenados a qualquer momento e uma cópia dessas informações. Além disso, as diretivas e regulações europeias concedem ao indivíduo interessado o acesso às seguintes informações: • os propósitos do processamento; • as categorias de dados pessoais envolvidas; • os destinatários ou categorias de destinatários para os quais os dados pessoais foram ou serão divulgados, em particular destinatários de países terceiros ou organizações internacionais; • onde for possível, o período previsto para o qual os dados pessoais serão armazenados, ou, se não for possível, o critério usado para determinar tal período; • a existência do direito de solicitar ao controlador a retificação ou remoção de dados pessoais, ou a restrição de processamento de dados pessoais envolvendo o indivíduo interessado, ou o objetivo de tal processamento; • a existência do direito de apresentar uma queixa com uma autoridade supervisora; • onde os dados pessoais não forem coletados do indivíduo interessado, quaisquer informações disponíveis quanto à sua fonte; • a existência de tomada de decisão automatizada, incluindo caracterização, conforme indicado no Artigo 20(3) da LGPD e, pelo menos nesses casos, informações significativas quanto à lógica envolvida, além da significância e consequências previstas de tal processamento para o indivíduo interessado. Além disso, o indivíduo interessado terá o direito de obter informações quanto a se os dados pessoais são transferidos a um país terceiro ou uma organização internacional. Onde esse for o caso, o indivíduo interessado terá o direito de ser informado quanto às garantias apropriadas com relação à transferência. Se uma das razões citadas acima se aplicar, o indivíduo interessado pode a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

c Direito a retificação Cada indivíduo interessado terá o direito concedido pelo legislador de obter do controlador sem atraso indevido a retificação de dados pessoais incorretos quanto a ele ou ela. Levando em consideração os propósitos do processamento, o indivíduo interessado terá o direito de completar seus dados pessoais incompletos, incluindo por meio de uma declaração suplementar. Se uma das razões citadas acima se aplicar, o indivíduo interessado pode a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

d Direito a remoção (Direito de ser esquecido) Cada indivíduo interessado terá o direito concedido pelo legislador de obter do controlador a remoção de dados pessoais relativos a ele ou ela sem atraso indevido, e o controlador terá a obrigação de apagar os dados pessoais sem atraso indevido onde uma das seguintes razões se aplicarem, contanto que o processamento não seja necessário: • Os dados pessoais não são mais necessários em relação aos propósitos para os quais eles foram coletados ou de algum modo processados. • O indivíduo interessado retira o consentimento no qual o processamento está baseado, e onde não houver qualquer motivo legal para o processamento. • O indivíduo interessado contesta o processamento e onde não houver razões legítimas predominantes para o processamento, ou o indivíduo interessado contesta o processamento. • Os dados pessoais foram processados ilegalmente. • Os dados pessoais devem ser apagados para cumprir com uma obrigação legal ao qual o controlador está sujeito. • Os dados pessoais foram coletados em relação à oferta de Serviço da sociedade de informações. Se uma das razões citadas acima se aplicar, e um indivíduo interessado quiser solicitar a remoção dos dados pessoais armazenados pela spyou, ele ou ela podem a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

e Direito de restrição do processamento Cada indivíduo interessado terá o direito concedido pelo legislador de obter do controlador restrição do processamento onde uma das seguintes questões se aplicarem: • A exatidão dos dados pessoais é contestada pelo indivíduo interessado, por um período permitindo que o controlador verifique a exatidão dos dados pessoais. • O processamento é ilegal e o indivíduo interessado se opõe à remoção dos dados pessoais e, em vez disso, solicita a restrição do seu uso. • O controlador não precisa mais dos dados pessoais para os propósitos do processamento, mas eles são exigidos pelo indivíduo interessado para estabelecimento, exercício ou defesa de ações judiciais. • O indivíduo interessado contestou o processamento, dependendo da verificação de que as razões legítimas do controlador sobrepõem as do indivíduo interessado. Se uma das razões citadas acima se aplicar, o indivíduo interessado pode a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

f Direito a portabilidade dos dados Cada indivíduo interessado terá o direito concedido pelo legislador de receber os dados pessoais relativos a ele ou ela, que forem fornecidos a um controlador, em um formato estruturado, comumente usado e legível por máquina. Ele ou ela terão o direito de transmitir esses dados a qualquer outro controlador sem impedimento por parte do controlador para o qual os dados pessoais foram fornecidos, contanto que o processamento seja baseado em consentimento, conforme previsto na LGPD. O processamento é feito por meios automáticos, contanto que o processamento não seja necessário para o cumprimento de uma tarefa que seja de interesse público ou no exercício de uma autoridade oficial conferida ao controlador. Além disso, exercendo seu direito de portabilidade de dados, o indivíduo interessado terá o direito a ter seus dados pessoais transmitidos diretamente de um controlador para outro, onde for tecnicamente possível e quando fazer isso não afetar negativamente os direitos e as liberdades de terceiros. Se uma das razões citadas acima se aplicar, o indivíduo interessado pode a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

g Direito de contestar Cada indivíduo interessado terá o direito concedido pelo legislador de contestar, por razões ligadas a sua situação particular, a qualquer momento, o processamento de dados pessoais envolvendo ele ou ela, baseado na LGPD. Isso também se aplica à caracterização com base nessas disposições. Se uma das razões citadas acima se aplicar, o indivíduo interessado pode a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

h Tomada de decisão individual automatizada, incluindo caracterização Cada indivíduo interessado terá o direito concedido pelo legislador a não estar sujeito a uma decisão baseada unicamente em processamento automatizado, incluindo caracterização, que produza efeitos legais envolvendo ele ou ela, ou que o afete significativamente de forma similar, contanto que a decisão (1) não seja necessária para firmar ou cumprir com um contrato entre o indivíduo interessado e o controlador dos dados, ou (2) não seja autorizada pela lei a qual o controlador está sujeito e o qual também estabelece medidas cabíveis para proteger direitos e liberdades e interesses legítimos do indivíduo interessado, ou (3) não seja baseado no consentimento explícito do indivíduo interessado. Se uma das razões citadas acima se aplicar, e um indivíduo interessado quiser solicitar a remoção dos dados pessoais armazenados pela spyou, ele ou ela podem a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

i Direito de retirar o consentimento de proteção dos dados Cada indivíduo interessado terá o direito concedido pelo legislador de retirar o seu consentimento de processar os seus dados pessoais a qualquer momento. Se uma das razões citadas acima se aplicar, o indivíduo interessado pode a qualquer momento entrar em contato conosco, conforme instruído no fim desta Política de Privacidade. Nós garantiremos prontamente que a solicitação de remoção será cumprida imediatamente.

The provision of our Service is generally not aimed at children. This Site is not intended for use by children under 18 years of age. We do not knowingly collect information from children and minors. We encourage parents and legal guardians to monitor their children's Internet usage and help enforce our Privacy Policy by instructing their children never to provide information on our Site without their permission. Our Site and Service are not directed at, nor do we knowingly collect personal data from children under 13 years of age. If we have factual knowledge that we have collected a child's personal data, we will comply with industry guidelines and applicable laws and will promptly delete it, unless we are legally obligated to retain such data. We do not collect information collected by you from a child's target device. All information is encrypted.

Target Device Data. When registering an Account with spyou, the Service begins to collect data from a target device linked to the Account, which may include personal data relating to you, the user(s) of a target device or third parties (“Data from the User”, including information about a target device, websites and apps that are used, contacts, connections, payments, messages and other communications, published and received content, etc.). In accordance with applicable privacy law, as far as it applies to the Service, you are the Data Controller for that Target Device, and you appoint us as the Data Processor of such data for the purpose of providing the spyou Service.

Your Use of Target Device Data. As Data Controller, you warrant that you have the proper authority to collect and process the Target Device Data and you agree to process and use the Target Device Data in accordance with this Privacy Policy, the Terms of Use and applicable law, and only for the express purposes of the Service. You will not submit to the Service any personal data relating to an individual who has not authorized such processing. Through the Service, you may also access a copy of the Target Device Data collected by us on your behalf. You will protect the confidentiality of any accessible Target Device Data and prevent access by or disclosure to unauthorized third parties. You will inform us within 24 hours of any issues arising from the management of your Account and/or Target Device Data. You will be responsible for any illegal use of another person's data (personal or otherwise) through the Service on a target device, including any use that is contrary to applicable data protection laws and/or that violates this Privacy Policy.

Data Processor Obligations. As Data Processor on your behalf, we (a) will implement appropriate technical and organizational measures to protect any Target Device Data from unauthorized or illegal access, loss, destruction, theft, use or disclosure; (b) we will limit access to Target Device Data to only those employees who need to know it to allow Processor to perform the Service; (c) we will only process Target Device Data as specified by this Policy and in accordance with its instructions, and (b) we will not use Target Device Data for any purpose unrelated to the performance of the Service or as provided in its instructions. in writing. Upon expiration or termination of this Agreement upon cancellation of registration or upon your request, we will terminate any and all use of Third Party Data and will destroy or return it to you, except as provided above with respect to data backup and termination. We will not disclose Target Device Data to third parties without your prior written consent or pursuant to a court or administrative decision.

Warranties. You are solely responsible for the use of the Account and the processing of personal data linked to your Account, which includes, without limitation, collecting, storing and analyzing personal data from a target device. spyou automatically uses the configuration and instructions given by you and you are solely responsible for setting up your Account. You warrant, as solely responsible for the Target Device Data we process on your behalf as a Data Processor, that (a) you have informed any users 18 years of age or older that the devices they use include spyou software and you have obtained such users' consent to such activity as provided in our terms of use and cancellation, and (b) you comply with all applicable laws with respect to the monitoring and control software. You agree to fully comply with this Privacy Policy.

Indemnity. You agree to indemnify and hold us harmless from any claims, damages and losses we may suffer in connection with or arising out of the processing of Target Device Data and other third party personal data submitted to our systems during the use and delivery of the Service.

The criterion used to determine the period of storage of personal data is the respective legal retention period. After this period expires and when we no longer need the personal data, we will routinely and securely erase or destroy it as long as it is no longer needed for the Purpose.

The data controller will process and store the personal data of the interested individual for the period necessary to achieve the purpose of providing the Service, or as long as this is allowed by the legislator in laws or regulations to which the controller is subject. spyou does not store and process personal data of an interested individual for more than is necessary to achieve the purpose of providing the Service. However, if a plan is not purchased after the free trial or after a package expires, the data will only be stored for 30 days if not deleted by the individual user within the platform. For the data to no longer be registered on the online platform, the Software must be completely removed from the device(s), to request the procedure for deleting the Software, just contact our team on the website or e- mail: [email protected]

We generally retain all records and information downloaded from a target device in an identifiable form for a period of 1 month after expiration, so that the individual user can retrieve this data if they wish. Please be informed that all records and information downloaded from a target device using the spyou Software stored in the spyou database for more than 1 month will be automatically deleted for security reasons. Records can be downloaded before the package expires or redeemed in a new purchase (if not made within 30 days after the initial package expires) In the case of expired free accounts, all information downloaded from a target device is also erased within a period of one (1) month. In addition, through the Account, you can delete all saved historical data at any time. This data will no longer be accessible and will be completely removed from our systems at the next backup, except as noted below. If you would like to remove all records, your account and information downloaded from a target device in your Account, please uninstall the spyou Software from your device(s), and send an email to support @spyou.com.br. Your Account will be permanently removed within 2 days or less from our active systems, servers and backups. Upon deleting your Account, all of your personal data, with the exception of billing information pursuant to a legal obligation, which requires processing by law of the Member State, to which we are subject, and information collected from a target device will also be removed.

To unsubscribe from future email communications from us, simply click the unsubscribe button in the email, or contact us as instructed at the end of this Privacy Policy. We need up to 10 (ten) business days to ensure compliance with your request. To change your personal data you have provided us, please contact us as instructed at the end of this Privacy Policy

We may modify this Privacy Policy at any time and post any changes to this Privacy Policy on the Site, so please review it frequently. We've date the current version of this Privacy Policy below so that you know when it was last updated. Changes to this Privacy Policy may not affect your personal data that we collect from you previously or after such changes. If you dispute these changes, please contact us as indicated below.