Privacy Policy
Last updated: October 9, 2026
SmartWay Portal — LEAD EMPREENDIMENTO DIGITAIS LTDA
This document explains how the responsible company processes data through the platform and its integration, which remains subject to TikTok review and the permissions actually granted.
1. Controller and identification
The controller is LEAD EMPREENDIMENTO DIGITAIS LTDA, a Brazilian limited liability company and Small Business (EPP), registered under CNPJ 51.340.668/0001-19 and operating the SmartWay Portal brand. Registered office: Rua Mistral, No. 332, Edifício The Point, Room 209A, Despraiado, Cuiabá – MT, ZIP 78048-222, Brazil. Website: https://smartwayportal.com/. Privacy contact: contact@smartwayportal.com.
2. Scope and users
This Policy applies to the website, authenticated workspace, and SmartWay Portal integrations. The current version has no public registration and is initially intended for the company administrator. Any future connection of client accounts will require express authorization, a legitimate relationship with the account, and prior implementation of the applicable controls.
3. Data we process
Depending on actual use and authorized permissions, we may process: administrator authentication and session data; identifiers for advertising accounts, Business Centers, campaigns, ad groups, ads, identities, pixels, and catalogs; settings, status, metrics, and operational reports; OAuth tokens and authorization metadata; operation, security, failure, and audit logs; and information submitted in communications with the company.
The platform is not intended to collect ordinary TikTok user profiles or information beyond what is necessary for authorized advertising operations.
4. Purposes
We process data to authenticate the administrator; connect and maintain authorized accounts; retrieve and display advertising structures and metrics; perform requested and permitted operations; prevent misuse; maintain security and operation records; provide support; comply with legal obligations; and prepare, test, and maintain integrations with authorized providers.
5. Legal bases
Depending on the context, processing may rely on the performance of a contract or related procedures, the controller's legitimate interests in operating and protecting the platform, compliance with a legal or regulatory obligation, the exercise of legal rights, and consent where applicable. OAuth authorization does not replace any other required legal basis and may be revoked by the account holder through controls made available by the provider.
6. Integrations and sharing
Data may be transmitted to TikTok API for Business to perform authorized operations. Conversion metrics may be retrieved through a private UTMiFy integration only when configured. Hosting, infrastructure, and security providers may process data to deliver their services. We do not sell personal data. Additional sharing will occur only when necessary for the stated purpose, required by law, or based on a legitimate instruction.
Providers may process information outside Brazil, subject to applicable legal and contractual safeguards. Third-party services are also governed by their respective terms and policies.
7. Cookies and technical data
The workspace uses a strictly necessary session cookie, protected with security attributes when accessed through HTTPS. Network address, date and time, authentication outcome, requested operation, and technical information required for fraud prevention and diagnostics may also be recorded.
8. Security
The current implementation uses HTTPS in production, administrator authentication, an HttpOnly session, request-forgery protections, input-size limits, origin validation, and encrypted server-side storage for OAuth tokens. Secrets and tokens are not sent to the frontend and must remain in environment variables. No measure eliminates all risk, and controls will be reviewed as the platform evolves.
9. Retention and deletion
Data will be retained only while necessary for the purposes described, maintenance of the authorization, security, exercise of rights, and applicable legal obligations. Tokens should be removed or rendered unusable when a connection is terminated or authorization is no longer valid, except for information whose retention is required for legal or security purposes.
Pending item: the operational schedule containing specific periods for each data category is still being formalized and must be approved and implemented before client accounts are processed. Until then, the company will apply minimization and individual review of requests without promising a retention period that has not yet been established.
10. Data subject rights
Under Brazil's LGPD, data subjects may request, where applicable, confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or unlawfully processed data, portability, information about sharing, review of automated decisions, and withdrawal of consent, and may lodge a complaint with Brazil's National Data Protection Authority.
11. Requests and revocation
Privacy or deletion requests may be sent to contact@smartwayportal.com with the subject “Privacy — SmartWay Portal.” To protect accounts, we may request proportionate information to verify the requester's identity or authority. Authorization granted to TikTok may also be revoked through controls provided by TikTok. Responses will follow applicable law and legitimate technical limitations.
12. Children
The platform is a business tool and is not directed to children or teenagers. We do not knowingly seek to collect their data through the workspace.
13. Updates
This Policy may be updated to reflect legal, technical, or operational changes. The current version and date will be published on this page. Material changes will be communicated through channels appropriate to the context.
14. Contact
SmartWay Portal — LEAD EMPREENDIMENTO DIGITAIS LTDA · CNPJ 51.340.668/0001-19
contact@smartwayportal.com · https://smartwayportal.com/