SAPIANS
Providers
Providers described in the sharing section of the privacy policy.
Source document · Source text in Portuguese
4. Sharing and international transfers
For XRESET, the information on cookies, tracking and diagnostics in this section has been corrected by the addendum dated 15 October 2026. The June institutional text below is retained as a record and must not be used as a current description of these XRESET processing activities. Read the new options. Read the XRESET addendum
XRESET
Google Analytics 4
Google Analytics 4 is distinct from Google Cloud/Vertex AI used by VITA.
If you allow Analytics, Google code measures the visit and limited click position and also generates technical first-visit, session-start and engagement-time events. It receives pseudonymous browser/session identifiers, technical browser/device data and the connection IP address. This is therefore neither anonymous collection nor only two manual events.
Meta Pixel
The Meta option, if made available, requires its own authorisation and sends only the canonical home-page visit, without query, fragment, sensitive referrer or free-form parameters. Meta receives IP and technical browser/device data, may use existing third-party cookies and associate the visit with your Meta account for measurement, personalisation and ad delivery.
Pixel first-party cookies, matching, automatic events and custom audiences are disabled for this offer; we do not send Lead, Purchase, XRESET account, order or personal/health content. A Google choice does not authorise Meta.
International transfers
Google and Meta may process data outside Brazil under each service's processing and transfer terms. This information describes the offer and its limits without certifying contracts or compliance; it does not enable data prohibited by the provider, even after consent.
Hosting and diagnostics
Vercel Web Analytics and Speed Insights have been suspended since 15 October 2026. Vercel continues to host the application and process operational logs.
Three VITA operational event types — message sent, answer delivered and technical error — retain the account and session correlation needed to detect failures. Sentry receives operational diagnostics with URL and sensitive-field protection; account identifiers and technical records may remain. These records are pseudonymised, not necessarily anonymous, and are not used to create advertising profiles.
Institutional information — June 2026
We do not sell, rent or monetize your personal data. We share it only with the following partners, strictly necessary to operate the service:
| Partner / category | Role | Location | Legal safeguard |
|---|---|---|---|
| Vercel | Platform hosting and delivery | USA | SCCs + contractual compliance |
| Google Cloud | Processing and storage infrastructure | USA / global | SCCs + ISO 27001 |
| Supabase | Database and authentication | USA | SCCs + contractual compliance |
| Resend | Sending transactional emails | USA | Contractual compliance and confidentiality |
| AI providers (Google, OpenAI and others) | Processing queries and generating outputs | USA / global | Commercial APIs with audited privacy terms |
| Cloudflare | WAF/DDoS/CDN protection | USA / global | SCCs + international certifications |
International transfers (Arts. 33–36 of the LGPD): Some of the providers above process data outside Brazil. We adopt the following compliance mechanisms: (a) standard contractual clauses (SCCs) equivalent to those of the European Union, and (b) a requirement that providers meet recognized international security standards.
We do not share data with governments, advertisers or third parties not listed above, except pursuant to a court order or a request from a competent authority under the law.