Privacy policy

1. About this policy

This policy explains how ShyMango processes the personal data of creators, visitors and customers of the SaaS hosted on the platform. It complements the terms of use.

Controller: FABIO VF VANESSA BERGER TERAPEUTA LTDA, CNPJ 53.535.234/0001-08, registered at Rua Samuel Heusi, 586, Sala 01, Centro, Itajaí – SC, CEP 88301-320, Brazil. Data protection contact: [email protected].

2. Our role

• For the data of ShyMango creators and visitors, ShyMango is the controller.
• For the data end customers enter inside a creator’s SaaS, the creator is the controller and ShyMango is the processor: we process that data to host and operate the SaaS, following the creator’s instructions and the terms of use.
• End customers are charged on the platform’s Stripe account. For those charges, ShyMango also processes payment data to meet financial, tax and fraud-prevention obligations.
• If you are a customer of a SaaS hosted on ShyMango, contact that SaaS’s creator first. If you write to us, we forward the request and help the creator answer.

3. Data we process

Account

Name, email, hashed password, verification codes and sessions. If you sign in with Google, also the Google account identifier and email. We do not store Google access tokens.

Projects

Ideas, scopes, change requests, attachments, versions, settings and change history.

Generated brands and sites

Names, taglines, logos, colors, copy and interfaces generated for each version, and the edits you make.

SaaS customers

Data end customers enter in each SaaS, such as name, email, credentials, records, bookings and subscription status. It is kept isolated per SaaS.

Payments and payouts

Amounts, statuses, invoices and Stripe identifiers. Card data is handled only by Stripe and does not pass through our servers. For payouts, Stripe collects your identity and bank details; ShyMango only sees the bank’s name and the account’s last 4 digits.

Technical use

IP address, access and security logs, errors and usage metering. We do no advertising tracking.

Communications

Messages you send us and records of the emails we send.

4. What we use it for and legal bases

• Creating, generating, hosting and maintaining your SaaS: performance of the contract.
• Charging subscriptions and usage, calculating the revenue share and making payouts: performance of the contract.
• Measuring AI and infrastructure usage: performance of the contract.
• Sending emails about your account, charges, domains, payouts and use of the service: performance of the contract and legitimate interest.
• Authenticating access, preventing fraud and abuse and protecting the platform: legitimate interest and performance of the contract.
• Keeping financial, tax and security records: compliance with a legal obligation.
• Answering requests from you and from authorities: compliance with a legal obligation and the exercise of legal rights.

We do not sell personal data and do not use it for advertising.

5. Artificial intelligence

To generate brands, copy, code and interfaces, we send your idea, your scope, your change requests and the attachments you include to AI model providers: OpenAI, Anthropic and Google, directly or through Vercel AI Gateway. These providers process the content to return the response, under their own terms for API use.

We do not use the content of your projects to train our own models. Avoid including other people’s personal data or sensitive data in ideas and attachments.

6. Who we share it with

• Railway: hosting of the platform, the SaaS and the databases.
• Cloudflare: DNS, network and attack protection.
• Vercel: AI Gateway and domain registration.
• Stripe: payments, subscriptions, payout accounts and payouts.
• Resend: email delivery.
• Google: sign-in, if you choose to sign in with Google.
• OpenAI, Anthropic and Google: AI content generation.
• Authorities, when the law or a valid order requires it.

These suppliers receive only what they need to provide the service. Stripe also processes data as an independent controller, under its own privacy policy.

7. Cookies

• Session: an essential cookie that keeps you signed in and protects your account. Each SaaS has its own session, on its own domain.
• Language: the shymango-locale cookie stores your language when you choose one from the menu.
• Country: on your first visit, we use the country header sent by Cloudflare only to choose the language.

We use no advertising cookies and no third-party analytics cookies. Cloudflare may use technical security cookies.

8. International transfers

ShyMango is global, and the suppliers above may process data outside your country, including in the United States. For these transfers, we use the safeguards provided by the LGPD and the GDPR, such as standard contractual clauses, where applicable.

9. Retention

• Account and project data: while the account exists.
• Financial, tax, security and audit records: for the period required by law, including after the account is deleted, without your name or email.
• End-customer data: while the SaaS operates, or as the creator instructs.
• Technical logs: for as long as security and operations require.

10. Account deletion

You can delete your account at shymango.com/delete-account. The request has a 14-day grace period, during which you can cancel it. After that:

• we erase or anonymize your name, email, credentials, sessions and verification codes, and the free text of your projects (names, ideas, scopes and proposals);
• we keep, without your name or email, the financial, tax and audit records and the version history of the SaaS already generated;
• the data of end customers of SaaS already created is not erased by this flow; to request its deletion, write to [email protected].

Deletion is blocked while anything is outstanding, as described in the terms of use. Copies kept by suppliers, such as the customer record at Stripe, follow their own rules.

11. Your rights

Under the LGPD, the GDPR and equivalent laws, you can request: confirmation of and access to your data; correction; anonymization, blocking or erasure of data that is unnecessary or processed unlawfully; portability; information about who we share it with; restriction of processing; objection to processing based on legitimate interest; and review of decisions made solely by automated means. Where processing depends on consent, you can withdraw it.

Write to [email protected]. We may ask you to confirm your identity. We answer within 30 days. You can also complain to the ANPD, in Brazil, or to the data protection authority in your country.

12. Security

We use per-SaaS data isolation, encryption in transit, hashed passwords, domain-restricted sessions and access controls. No system is completely immune; in the event of a relevant incident, we will notify you and the authorities when the law requires it.

13. Children

ShyMango is not intended for children. If we learn that we have processed a child’s data without the authorization the law requires, we will delete it.

14. Changes

If this policy changes in a relevant way, we will tell you on the platform or by email before it takes effect. The date and the version are at the top of the page.

15. Contact

For any request about data, write to [email protected]. FABIO VF VANESSA BERGER TERAPEUTA LTDA, Rua Samuel Heusi, 586, Sala 01, Centro, Itajaí – SC, CEP 88301-320, Brazil.