Privacy Policy

This Privacy Policy explains clearly and transparently how Lions Central Multimídias collects, uses, stores, shares, and protects personal and operational data within its internal automotive multimedia catalog and listing management platform ("Superapp Lions" or "Platform"), as well as on this public portal.

The Platform is a private, restricted enterprise operating environment designed exclusively for authorized personnel to automate auto parts cataloging, image processing, marketplace listing drafts, and internal team workflow tracking.

---

1. Data Controller Information#

The entity responsible for processing your personal data is:

• Corporate Legal Name: Lions Central Multimidias LTDA
• Trade Name: Lions Central Multimídias
• Company Tax ID (CNPJ): 61.989.755/0001-55
• Registered Address: Av. Brasil, QD 01 - Lt 07 - Residencial Aquários II, Goiânia - GO, 74370-457
• General Support Email: lionscentralmultimidias@gmail.com
• Data Protection Officer (DPO): Gustavo Araújo
• Privacy & DPO Inquiries: privacidade.lionscentralmultimidias@gmail.com

For inquiries regarding this Privacy Policy or your data protection rights under Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), please contact our DPO via the privacy channel above.

---

2. Google API Services Data Accessed and Purposes#

Superapp Lions integrates with official Google APIs strictly in accordance with the principle of least privilege:

2.1 Internal User Authentication (Google Login / OIDC)#

• Requested Scopes: openid, https://www.googleapis.com/auth/userinfo.email, https://www.googleapis.com/auth/userinfo.profile.
• Data Accessed: Google unique identifier (subject ID), verified business email address, full name, and public profile picture URL.
• Purpose: Secure identity verification (OpenID Connect). Google does not grant authorization, roles, or module permissions. Permissions are managed exclusively through an internal database allowlist maintained by Lions administrators. External Google accounts not pre-registered in our database are strictly denied access.

2.2 Media Storage and Disaster Recovery Backup (Google Drive)#

• Requested Scope: https://www.googleapis.com/auth/drive.file.
• Access Level: The drive.file scope grants access strictly and exclusively to files and folders created or explicitly opened by Superapp Lions within the company's dedicated Google account. The Platform cannot see, list, or access any other personal or pre-existing files on the account.
• Data Accessed and Managed:
  1. Product original photos and rendered cards: Uploading original product photos supplied by staff and archiving finalized 4:5 aspect ratio ad cards organized in SKU-specific folders (SKU: [code] - [part name]).
  2. Encrypted daily database backup: Creating and updating a single daily encrypted PostgreSQL logical backup file in a dedicated root subfolder, identified by a stable file ID.
• Purpose: Google Drive serves as a durable system of record for media and encrypted database backups. Lions PostgreSQL database only stores remote Drive IDs, SHA-256 integrity checksums, and metadata. Customer business data is never read from Drive.

2.3 Operational Notifications (Gmail)#

• Planned Scope: https://www.googleapis.com/auth/gmail.send (or standard authenticated SMTP connection).
• Data Accessed: No email inbox data is accessed. Access is strictly limited to sending outgoing system messages.
• Purpose: Automated dispatch of daily operational task reports (sent Monday through Friday at 17:40, America/Sao_Paulo timezone) and critical security alerts to a pre-configured list of internal administrators (relatorios.lionscentralmultimidias@gmail.com).
• Zero Inbox Access: The Platform never reads, indexes, scans, or intercepts incoming emails, drafts, or personal address books.

---

3. Google API Limited Use Disclosure#

Superapp Lions strictly complies with Google's API policies:

Limited Use Disclosure:
"Lions Central Multimídias's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements."

Declaração em Português:
"O uso e a transferência para qualquer outro app das informações recebidas das APIs do Google adotarão a Google API Services User Data Policy, incluindo os requisitos de Limited Use."

---

4. What We DO NOT Do With Your Data#

To safeguard user trust and uphold international privacy standards:

1. We do not sell data: We never sell, rent, lease, or monetize user data with data brokers or any third parties.
2. We do not serve targeted advertisements: Data received from Google APIs is never used for behavioral advertising or marketing campaigns.
3. We do not train AI models on Google data: User data received from Google APIs (identities, Drive files, email content) is never used to train, evaluate, or tune artificial intelligence or machine learning models.
4. No human reading of Google user data: No staff member has access to read user data obtained via Google APIs, except:
   • When explicitly requested by the user for technical support;
   • When strictly necessary to investigate security incidents;
   • When required by applicable law or a binding court order.

---

5. Storage, Security and Technical Governance#

Superapp Lions is built with Security and Privacy by Design:

• Encrypted Credentials and OAuth Tokens: Access tokens and refresh tokens are encrypted at rest using industry-standard AES-256-GCM. Master encryption keys are stored outside the database in secure runtime environment variables. Tokens are sanitized and never written to logs.
• Multi-Tenant Logical Isolation: PostgreSQL enforces tenant isolation (organization_id), Role-Based Access Control (RBAC with granular resource:action grants), and Row-Level Security (RLS) on sensitive tables.
• Secure Sessions: Sessions utilize HttpOnly, Secure (HTTPS/TLS 1.3), SameSite=Lax/Strict cookies with short time-to-live (TTL).
• Immutable Audit Trail: All system activities produce append-only audit events tracking actor, UTC timestamp, sanitized payload, and correlation ID.
• Local Temporary File Isolation: Local files exist only temporarily in job-exclusive directories and are deleted immediately in finally execution blocks.
• Source-Encrypted Backups: Daily PostgreSQL logical dumps are encrypted before being uploaded to Google Drive. Restore decryption keys are not kept on the backup runner container.

---

6. Third-Party Service Providers (Data Processors)#

Lions Central Multimídias shares data under strict contracts with trusted processors:

---

7. Data Retention and Deletion#

Data is retained strictly for the duration necessary to fulfill its legitimate business purpose:

• Audit Logs: Retained for 6 meses pursuant to statutory security obligations.
• Deactivated Accounts: When an employee account is disabled, access is instantly revoked, sessions terminated, and basic account records archived for 5 meses before permanent erasure.
• Database Backup: The platform maintains exactly 1 (one) active daily backup file on Google Drive, updated atomically every day at 03:00. Operational retention cycle is up to 24 horas.
• Drive Media: Retained while the associated automotive product remains in active commercial inventory.

Revoking Google Account Permissions#

Users can revoke Superapp Lions access at any time through Google's official security settings:
👉 https://myaccount.google.com/permissions

Deletion Requests#

To request data deletion, contact our Data Protection Officer at privacidade.lionscentralmultimidias@gmail.com. Requests will be processed within 15 calendar days, subject to mandatory legal recordkeeping requirements.

---

8. Data Subject Rights (LGPD Art. 18)#

Under the Brazilian LGPD, data subjects enjoy rights to confirm processing, access data, correct inaccuracies, request anonymization or deletion, request data portability, and revoke consent. Inquiries may be submitted to privacidade.lionscentralmultimidias@gmail.com.

---

9. Cookies Policy#

• This Public Site (lions-legal): Employs zero cookies, trackers, web beacons, or third-party analytics scripts.
• Internal Platform (superapp): Uses strictly necessary, encrypted first-party session cookies (HttpOnly, Secure) to maintain staff authentication.

---

10. Children's Privacy#

Superapp Lions is an internal enterprise B2B tool. It is not intended for or directed to individuals under 18 years of age.

---

11. International Data Transfers#

Google LLC and OpenAI, LLC operate infrastructure primarily in the United States. International data transfers comply with LGPD Article 33 via standard contractual clauses and rigorous security certifications.

---

12. Policy Revisions#

• Version: 1.0.0
• Effective Date: October 22, 2026
• History: Version 1.0.0 established for Google Cloud OAuth verification and LGPD compliance.

---

13. Contact Information#

Lions Central Multimídias
Data Protection Officer (DPO): Gustavo Araújo
Privacy Email: privacidade.lionscentralmultimidias@gmail.com
General Support: lionscentralmultimidias@gmail.com
Address: Av. Brasil, QD 01 - Lt 07 - Residencial Aquários II, Goiânia - GO, 74370-457