Privacy Policy & Data Protection

1. Identification of Data Controller and Processor

Tryone (accessible via tryone.com.br) is a software-as-a-service (SaaS) platform developed, owned, and operated by:

• Company: Tryone
• Tax ID (CNPJ): 66.331.153/0001-20
• Primary Domain: tryone.com.br
• Data Protection Officer (DPO): Kelvin Rosa
• Official Privacy Channel: privacidade@tryone.com.br

This Privacy Policy outlines with full transparency how Tryone collects, processes, stores, and protects data belonging to our business customers (merchants and retail clients) and end consumers interacting with integrated messaging channels, in strict compliance with the Meta Platform Terms, Google API Services User Data Policy, LGPD (Brazilian General Data Protection Law - Law No. 13,709/2018), and applicable international privacy frameworks.

2. Our Role as an Independent Tech Provider (ITP)

In the ecosystem of business communication tools, Tryone operates as an Independent Tech Provider (ITP) and Data Processor:

• Data Controllers: The retail merchants, brands, and businesses that subscribe to Tryone to manage their sales channels, digital catalog, AI virtual try-on, automated workflows, and customer service.
• Data Processor (Tryone): We process messaging metadata, technical payloads, and customer interaction data solely on behalf of, under the instructions of, and within the scope of our agreement with the merchant (Data Controller), providing secure technology infrastructure connected to official Meta APIs.

3. Integration with Meta Platforms (WhatsApp & Instagram)

To provide merchants with unified omnichannel customer communication, automated replies, and transactional notifications, Tryone integrates with official Meta APIs (WhatsApp Cloud API and Instagram Graph API). We process only the data strictly necessary to deliver these capabilities:

A. WhatsApp Business Platform (Cloud API)

• Data Processed: Sender and recipient phone numbers, WhatsApp profile display names, customer service message content (text and media submitted during customer conversations), unique message IDs, and delivery/read timestamps.
• Strict Purpose: Facilitating live customer support, routing incoming conversations to merchant attendants, and dispatching authorized transactional notifications (e.g., order confirmations and delivery alerts with prior consumer opt-in).

B. Instagram & Messenger (Direct & Comments)

• Data Processed: Instagram Scoped User IDs (IGSID), public profile usernames, Direct Messages (DMs) exchanged between shoppers and the merchant's business account, and public comments posted on connected merchant media.
• Strict Purpose: Centralizing merchant helpdesk operations within a unified inbox, enabling support agents to answer product inquiries, resolve order tickets, and moderate comments.

4. Compliance with Meta Platform Terms & Developer Policies

In full alignment with the Meta Platform Terms and Meta Developer Policies, Tryone explicitly confirms:

• No Sale or Commercial Transfer: Tryone does not sell, rent, license, or transfer data obtained via Meta APIs to third parties, including data brokers, ad networks, commercial surveillance firms, or targeted advertising platforms.
• No Discriminatory Profiling: Customer conversation data and identifiers are never used for credit scoring, eligibility decisions, employee surveillance, or automated discriminatory profiling.
• Protection of Access Tokens: Meta System User Tokens, Page Access Tokens, and WABA credentials are stored with envelope encryption, never written to debug logs, and never exposed in client-facing browser bundles.
• No Unauthorized AI Model Training: Private customer communications, message payloads, and Meta user data are never used to train or fine-tune public or third-party artificial intelligence models.

5. Authorized Subprocessors & Infrastructure Partners

To ensure high availability, global low-latency routing, and reliable message delivery, Tryone partners with industry-leading subprocessors governed by Data Processing Agreements (DPA):

6. Use of Google API Services Data

Tryone's use and transfer of information received from Google APIs adheres strictly to the Google API Services User Data Policy, including the Limited Use requirements:

Requested Google Scopes

• analytics.readonly: Used solely to view aggregated traffic metrics and conversion events in Google Analytics 4 (GA4), allowing merchants to monitor virtual try-on engagement inside their dashboard.
• analytics.edit: Used exclusively to create Audiences and Key Events automatically within the merchant's GA4 property to measure ROI.

No raw Google Analytics data is ever sold, transferred, or disclosed to unauthorized third parties.

7. Information Security & Secrets Management

We enforce rigorous technical, administrative, and organizational safeguards to ensure data confidentiality and platform durability:

• Encryption at Rest (AES-256-GCM): All integration credentials (Meta System User Tokens, Page Tokens, Google Refresh Tokens, and merchant API keys) are encrypted at rest using AES-256-GCM with versioned cryptographic envelopes.
• Encryption in Transit (TLS 1.3 / HTTPS): All traffic between user browsers, Meta webhook delivery workers, application runtimes, and external APIs is strictly enforced over TLS 1.3 encrypted connections.
• Cryptographic Webhook Verification: Inbound Meta webhooks are cryptographically validated using HMAC-SHA256 (via the X-Hub-Signature-256 header) to ensure payload integrity and prevent spoofing or replay attacks.
• Zero Plaintext Secret Exposure: Production secrets are injected dynamically at runtime, never committed to revision repositories, and never exposed in client endpoints or application logs.

8. Data Retention & Disposal

• Operational Data: Customer service messages, webhook events, and delivery records are retained only for the duration required to allow merchant attendants to service the conversation or as mandated by statutory compliance obligations.
• Account Termination: Upon cancellation of a merchant's Tryone subscription, all API connection tokens are instantly revoked, and associated merchant records are purged or irreversibly anonymized within 30 days.

9. User Data Deletion Instructions (Meta Compliance)

In accordance with the Meta Platform Data Deletion Policy, LGPD, and GDPR, we provide clear and immediate options for any end user or business to request the deletion of their personal data or account records.

10. Data Subject Rights (LGPD & GDPR)

Under applicable data protection laws, individuals whose data is processed by Tryone have the following fundamental rights:

• Confirmation of the existence of data processing;
• Access to personal data held by the platform;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or elimination of unnecessary or excessive data;
• Portability of data to another service provider upon formal request;
• Revocation of consent at any time without retroactive penalty.

11. Contact & Data Protection Officer (DPO)

For questions, formal data subject inquiries, or security verification audits, contact our Data Protection Officer directly:

• Data Protection Officer (DPO): Kelvin Rosa
• Direct Privacy Contact: privacidade@tryone.com.br
• Corporate Inquiries: contato@tryone.com.br
• Official Website: tryone.com.br