Privacy Policy

TupiCart is a hosted checkout platform developed and operated by FLOWBORDER LLC, a company incorporated in the United States of America. For the purposes of this Policy, "we", "our" and "TupiCart" refer to FLOWBORDER LLC.

This Privacy Policy describes how we collect, use, store and protect the personal data of Merchants, Buyers and visitors of the tupicart.comwebsite, in compliance with Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018) and other applicable laws.

We collect and process personal data for the following purposes and legal bases (under Article 7 of the LGPD):

We do not sell personal data. We share data only in the following cases:

• Payment gateways (Stripe, Adyen, Airwallex, PayPal, Mercado Pago, etc.) — to process transactions;
• E-commerce platforms integrated by the Merchant (e.g., Shopify, WooCommerce);
• Infrastructure providers (e.g., cloud services, CDN, transactional email) — under confidentiality agreements;
• Competent authorities — when required by law, court order or regulatory investigation;
• Controlling Merchant — Buyer data is shared with the Merchant who operates the checkout.

Because FLOWBORDER LLC is a U.S. company, data may be transferred to and processed outside Brazil. We ensure such transfers take place with appropriate safeguards, such as:

• Standard contractual clauses with sub-processors located in countries without recognized adequacy;
• Use of providers that adhere to the EU-U.S. Data Privacy Framework or equivalents;
• Explicit consent of the data subject when necessary (Article 33, IX, LGPD).

We keep personal data for as long as necessary for the purposes described in this Policy or as required by law:

• Transaction data: 5 years after the transaction (tax/AML requirement);
• Merchant account data: until the account is closed + 5 years;
• Access logs: 6 months (under Brazil's Internet Civil Framework — Law 12,965/2014);
• Marketing data: until consent is withdrawn.

Under the LGPD, you have the following rights regarding your personal data:

• Confirmation and access — to know whether we process your data and receive a copy;
• Correction — to request the update of incomplete or inaccurate data;
• Anonymization, blocking or deletion — of unnecessary or excessive data;
• Portability — to receive your data in a structured format;
• Withdrawal of consent — at any time, for processing based on consent;
• Objection — to processing based on legitimate interest, where grounds exist;
• Review of automated decisions.

To exercise any of these rights, send a request to suporte@tupicart.com. We will respond within 15 calendar days.

We adopt technical and organizational measures to protect personal data against unauthorized access, alteration, disclosure or destruction, including:

• Encryption in transit (TLS 1.3) and at rest (AES-256);
• Tokenization of payment data (PCI-DSS via gateways);
• Multi-factor authentication for administrative access;
• Continuous monitoring and incident response.

In the event of a security incident that may affect your data, we will notify data subjects and Brazil's National Data Protection Authority (ANPD) within the legal deadlines.

Under Article 41 of the LGPD, TupiCart designates the following contact channel for privacy matters and the exercise of rights:

This Policy may be updated periodically. We will notify material changes by email or notice on the Platform at least 10 (ten) days in advance. Continued use after the notice constitutes acceptance of the updated version.