Privacy Policy
This Privacy Policy explains how LOJA VIRTUAL LLC, which operates under the trade names Kestra and Kestra Agency ("Kestra", "we", "us" or "our"), collects, uses, shares, stores and protects personal data when you visit our website, join our waitlist, subscribe to a plan, use the Kestra platform or contact us.
This Policy follows the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD") and good international data protection practices, and should be read together with our Terms of Use. Terms such as "personal data", "processing", "controller" and "data subject" have the meaning given to them by the LGPD.
- Controller
- LOJA VIRTUAL LLC
- Legal form
- Single-member limited liability company organized in the United States
- Trade names
- Kestra and Kestra Agency
- Address
- 7345 W Sand Lake Road, Suite 210, Office 3332, Orlando, FL 32819, United States
- Privacy and data subject requests
- contato@alojavirtual.fun
- Support (WhatsApp)
- +1 (954) 812-8173
1. Who the controller is
The controller of the personal data described in this Policy is LOJA VIRTUAL LLC, a single-member limited liability company organized in the United States, with its address at 7345 W Sand Lake Road, Suite 210, Office 3332, Orlando, FL 32819, United States. Kestra and Kestra Agency are the trade names under which LOJA VIRTUAL LLC offers the Services, and Kestra is the brand you interact with on the website, on the platform and in support. LOJA VIRTUAL LLC is the entity that decides how and why your personal data is processed.
In this Policy, "Services" means the provision of Meta ad accounts for our customers' campaigns, balance top-ups, the Kestra platform, the website kestraagency.com and customer support.
Requests addressed to the controller, including those directed to the data protection officer (the "encarregado" under the LGPD) or to the person responsible for the processing, are received at contato@alojavirtual.fun. This is also the channel for communications with the Brazilian National Data Protection Authority (ANPD).
2. Who this Policy applies to
This Policy applies to the personal data of:
- visitors of the website kestraagency.com;
- people who join our waitlist while new subscriptions are closed;
- customers who subscribe to a plan, and users registered on the Kestra platform under a customer's organization;
- representatives and contacts of our customers, and people who send top-ups on behalf of a customer, such as the sender of a wire transfer;
- anyone who contacts us through WhatsApp or email.
If you provide us with personal data of other people, such as members of your team or the sender of a transfer, you are responsible for making sure you are allowed to share it and that those people are aware of this Policy.
This Policy does not cover the processing of personal data that our customers carry out in their own businesses, including in the ads they run through the ad accounts, for which each customer is responsible. Nor does it cover the processing carried out by third-party services under their own policies, as described in section 12.
3. Data we process
We process only the data needed for the purposes described in section 4. The table below shows the categories of personal data, what each one includes and where it comes from.
| Category | Data | Source |
|---|---|---|
| Website visitors | Technical data about your browser and device, IP address, pages visited, visit source and campaign parameters (UTM), captured by the UTMify UTM script; page view events (PageView) recorded by the Meta Pixel, which uses Meta cookies and identifiers. The website fonts are loaded from Google Fonts, so your browser sends your IP address to Google when loading them. | Collected automatically from your browser when you visit the website. |
| Waitlist | Name, email, phone or WhatsApp number and the page from which you signed up. | Provided by you when you join the waitlist. |
| Subscription and billing | Name, email, phone number when provided, customer, subscription and invoice identifiers, amounts, payment status, refunds and disputes, and the campaign source of the purchase. Payment data, including card data, is collected and processed directly by Stripe in its checkout; Kestra does not receive or store your card data. | Provided by you in the Stripe checkout and received from Stripe. |
| Sales attribution | For the initial subscription sale: the buyer's name, email and phone number, the plan, the amount and the campaign parameters, which we send to UTMify to measure which ad generated the sale. | Derived from the subscription and website data above. |
| Platform account | Name, email, password (stored only as a cryptographic hash), organization, user role, access sessions, language and notification preferences, browser push notification subscriptions (endpoints of the push services of Google, Apple, Mozilla and Microsoft), API keys issued and an audit trail of the actions performed. | Provided by you or generated by your use of the platform. |
| Service operation | Ad account requests (the customer's Business Manager identifiers, destination URL and notes); ad accounts allocated to the customer; top-ups (amount, method, source wallet address and blockchain transaction hash, data of the sender of a wire transfer as shown on the bank statement, reference code, and proof of payment sent as an image or transaction ID); balance allocation, removal and withdrawal, including the withdrawal destination provided by the customer; and balance statement. | Provided by you, generated by the platform, and received from banks, blockchain networks and our payment providers. |
| Data obtained from Meta | Through the Meta API, data about the ad accounts we operate, such as status, spend, limits, the Business Managers with access and the ads run in the accounts. | Received from Meta Platforms. |
| Communications | WhatsApp support conversations (messages, audio, images and files), with internal notes from our team; transactional emails, such as password setup emails and notices. | Provided by you and generated by us. |
Some data is required to provide the Services. Without it, we may be unable to create your account, deliver ad accounts or process top-ups and withdrawals.
4. How we use data and legal bases
We use personal data only for the purposes below, each one supported by a legal basis of article 7 of the LGPD.
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Providing the Services and performing the contract: creating and managing your account, delivering and monitoring ad accounts, processing top-ups, withdrawals and refunds, billing the subscription, sending transactional emails and notifications, and providing support. | Performance of a contract or of preliminary procedures related to a contract (item V). |
| Managing the waitlist and letting you know when new subscriptions open. | Preliminary procedures related to a contract, at the request of the data subject (item V). |
| Complying with legal, regulatory, accounting and tax obligations. | Compliance with a legal or regulatory obligation (item II). |
| Preventing fraud, protecting the security of the Services and ensuring compliance, including verifying identity and the origin of funds, checking payments and investigating disputes. | Legitimate interest (item IX) and, where required by law, compliance with a legal or regulatory obligation (item II). |
| Defending Kestra in judicial, administrative or arbitration proceedings. | Regular exercise of rights in judicial, administrative or arbitration proceedings (item VI). |
| Improving the Services, measuring our marketing campaigns and attributing sales to the ads that generated them. | Legitimate interest (item IX). |
| Using non-essential cookies and tracking technologies, where the applicable law requires consent for them. | Consent (item I). |
When we rely on legitimate interest, we do so for legitimate purposes, taking into account your legitimate expectations and your fundamental rights and freedoms, and using only the data strictly necessary. You can object to this processing as described in section 10.
Automated checks
Some payment and fraud checks may be carried out automatically. You can ask for any such check that affects you to be reviewed by a person by writing to contato@alojavirtual.fun.
We do not sell personal data.
5. Cookies, pixels and similar technologies
Cookies are small files stored in your browser. Pixels, scripts and similar technologies collect information about your visit when a page loads.
On the website
- Meta Pixel: records page view events (PageView) and uses Meta cookies and identifiers to measure the performance of our ads. Meta receives this information and processes it under its own policies.
- UTMify UTM script: captures the visit source and campaign parameters (UTM) so that a later purchase can be attributed to the campaign that generated it.
- Google Fonts: the website fonts are loaded from Google servers; to deliver them, your browser sends your IP address and technical data to Google.
On the platform
- Technologies necessary for the platform: used to authenticate you and keep your access session active and secure. Without them, the platform does not work.
- Browser push notifications: activated only if you allow them in your browser. You can turn them off at any time in your browser settings or in your notification preferences on the platform.
Where the applicable law requires consent for non-essential cookies and tracking technologies, we rely on that consent. You can block or delete cookies and restrict tracking technologies in your browser settings at any time. Doing so may affect some features of the website and the platform.
6. Who we share data with
We do not sell personal data. We share it only to the extent necessary for the purposes described in this Policy, with the following recipients:
| Recipient | Purpose and data shared |
|---|---|
| Stripe | Processing of subscription payments. Stripe collects payment data directly in its checkout and provides us with the billing data described in section 3. |
| Meta Platforms | Operation of the ad accounts through the Meta API, including sharing the accounts with the customer's Business Manager, and the Meta Pixel on the website, which receives page view events, cookies, identifiers and technical data about your browser. |
| UTMify | Attribution of sales to marketing campaigns: visit source and campaign parameters from the website and, for the initial subscription sale, the buyer's name, email and phone number, the plan, the amount and the campaign parameters. |
| Delivery of the website fonts (Google Fonts), which receives your IP address and technical data about your browser, and delivery of push notifications through Firebase Cloud Messaging (FCM). | |
| Apple, Mozilla and Microsoft | Delivery of push notifications to browsers that use their push services. They receive the push subscription and the notifications addressed to your browser. |
| Cloud hosting and database provider in the United States | Hosting of our systems and storage of the data described in this Policy. |
| Twilio SendGrid | Sending of transactional emails: name, email address and message content. |
| WhatsApp integration provider | Operation of WhatsApp support: messages, audio, images and files exchanged with us. |
| Stablecoin custody and receiving providers and bank transfer providers | Receipt of top-ups and payment of withdrawals: amounts, wallet addresses, transaction hashes, sender data, withdrawal destinations and reference codes. |
| Banks and blockchain networks | Execution of transfers. Transactions recorded on a blockchain are public and permanent by nature: the wallet addresses, the amounts and the transaction hash can be seen by anyone and cannot be changed or deleted by Kestra. |
| Partners and suppliers that operate the agency infrastructure | Only the data necessary to deliver and share the ad accounts, such as the identifier of the customer's Business Manager. |
| Public authorities | When required by law, regulation or order of a competent authority. |
| Successors | In a merger, acquisition, sale of assets or other corporate reorganization, the data may be transferred to the successor, which will be subject to the obligations of the applicable law. |
Each of these providers has its own privacy policy. Some of them process data on our behalf, for the purposes described here; others, such as Stripe, Meta and the banks, may also process data for their own purposes, as independent controllers, under their own policies.
7. International data transfers
LOJA VIRTUAL LLC is located in the United States, and your personal data is processed in the United States and in other countries where our providers operate.
These transfers are based on the cases permitted by the LGPD, including when they are necessary for the performance of the contract with you or of preliminary procedures carried out at your request, for compliance with a legal obligation and for the regular exercise of rights (article 33, item IX). We adopt contractual safeguards and security measures to protect the data transferred, and we share with each provider only what is necessary for the corresponding purpose.
8. How long we keep data
We keep personal data for as long as our relationship with you lasts and, after that, for the time necessary to comply with legal, regulatory, accounting and tax obligations, resolve disputes, prevent fraud and exercise our rights in judicial, administrative or arbitration proceedings.
To determine the retention period, we take into account the nature of the data, the purpose for which it was collected, the applicable legal requirements and limitation periods. When the data is no longer necessary, it is deleted or anonymized, unless the law allows or requires it to be kept.
Data recorded on blockchain networks and data processed by third parties under their own policies, such as Meta and Stripe, follow the rules of those networks and providers.
9. Security
We adopt technical and administrative measures to protect personal data against unauthorized access and against accidental or unlawful destruction, loss, alteration or disclosure. These include:
- encrypted connections (HTTPS);
- passwords stored only as cryptographic hashes;
- integration secrets stored in encrypted form;
- isolation of data between customer organizations in the database;
- role-based access control.
No system is 100% secure. If a security incident may result in relevant risk or damage to data subjects, we will notify the affected data subjects and the competent authorities as required by the applicable law.
You also contribute to security: keep your password and API keys confidential, do not share your access, and let us know immediately at contato@alojavirtual.fun if you suspect unauthorized use of your account.
10. Your rights and how to exercise them
Under article 18 of the LGPD, you have the right to:
- confirmation of the existence of processing;
- access to your data;
- correction of incomplete, inaccurate or out-of-date data;
- anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the LGPD;
- portability of your data to another provider of services or products, upon express request, in accordance with the regulations of the ANPD;
- deletion of personal data processed with your consent, except in the cases in which the law allows it to be kept;
- information about the public and private entities with which we share your data;
- information about the possibility of not giving consent and about the consequences of refusing;
- revocation of consent;
- objection to processing carried out on the basis of another legal basis, in case of non-compliance with the LGPD.
You also have the right to file a petition regarding your data with the ANPD. If you are in another jurisdiction, the local law may grant you equivalent rights, which you can exercise through the same channel.
You may also ask for the automated checks described in section 4 to be reviewed by a person.
How to exercise your rights
Send your request to contato@alojavirtual.fun. To protect your data, we may ask you to confirm your identity before responding. We will respond within the deadlines set by the applicable law, at no cost to you. Some data may be kept even after a deletion request when it is necessary to comply with legal or regulatory obligations or for the other purposes permitted by law, as described in section 8.
Revoking consent does not affect processing carried out before the revocation.
11. Minors
The Services are not intended for people under 18 years of age, and we do not knowingly collect their personal data. If you believe that a minor has provided us with personal data, contact us so that we can take the appropriate measures, including deleting the data.
12. Third-party services
The Services depend on or lead to third-party services, such as Meta (including the Meta Pixel and its advertising platforms), Stripe (checkout and payments) and WhatsApp (support). When you use these services, your data is also processed under their own terms and privacy policies, which we recommend you read. Kestra does not control how these third parties process data for their own purposes.
13. Changes to this Policy
We may update this Policy to reflect changes in the Services, in our practices or in the law. Each new version will be published on this page with its date and version number. When a change is relevant, we will also let you know through the channels of the Services, such as email or a notice on the platform. If a change requires your consent under the applicable law, we will ask for it.
14. Contact
For questions about this Policy or about the processing of your personal data, or to exercise your rights, contact us:
- Email: contato@alojavirtual.fun
- WhatsApp: +1 (954) 812-8173
- Address: LOJA VIRTUAL LLC, 7345 W Sand Lake Road, Suite 210, Office 3332, Orlando, FL 32819, United States