Privacy & Security

Privacy Policy

Version 1.1.0 — Effective August 18, 2026

What LitX may collect when you create an account or use the platform, the providers involved, and how to exercise your LGPD/GDPR rights.

Policy snapshot

Controller

LIT PAYMENTS SOLUTION LTDA

CNPJ 59.601.133/0001-66. DPO: dpo@litxclusive.com

Your rights

LGPD / GDPR

Requests are made at /legal/data-request and are subject to applicable law and verification requirements.

Not published here

Complete processing inventory

Providers are listed in section 9. A complete inventory of the data each one receives is not published on this page.

1. Data Collection

This page describes categories of information that may be involved when you create an account or interact with the platform. Purchase processing remains unavailable until Payment Provider activation.
This page does not publish a complete processing inventory or a payment-data flow before Payment Provider checkout is activated.
Cookie and analytics behavior is described only where it is available in the product.

Information may be processed for available platform functions and applicable legal requirements.
Provider payment processing remains unavailable until Payment Provider activation.
This page does not state a communications-delivery, personalization, legal-compliance, or security outcome.

This page does not publish a verified data-sale determination or a complete list of third-party data flows.
Payment Provider payment-data sharing does not begin before provider activation.
This page does not state a creator, employee, provider, or other role-access outcome.

This page does not state a complete access-control or security-assurance outcome.
Production web traffic uses HTTPS; we do not claim end-to-end encryption for every data flow.
Current operational evidence is published on the status page; no continuous-monitoring claim is made here.
Access-control details require evidence from the applicable backend and operational systems.

You have the right to access the personal data we hold about you.
You have the right to rectification of inaccurate or incomplete personal data.
You have the right to deletion of your personal data, subject to applicable legal retention requirements.
You have the right to portability of the personal data you provided to us.
You have the right to object to certain processing of your personal data, and a related right to restriction of processing where applicable.
Request handling depends on applicable law and verification requirements.
This page does not state that a request will be fulfilled, completed within a particular time, or produce a particular data outcome.

Cookie choices, if presented in the product, are stored on the device that makes the choice.
This page does not state a complete cookie-category, first-visit, analytics, or feature-availability outcome.

Data Controller: LIT PAYMENTS SOLUTION LTDA (CNPJ: 59.601.133/0001-66), Brazil.
Data Protection Officer (DPO): For inquiries regarding personal data processing, LGPD/GDPR rights exercise, or privacy matters, contact our DPO at dpo@litxclusive.com.
Jurisdiction: This Privacy Policy and any disputes arising from data processing are subject to the laws of the Federative Republic of Brazil (including Lei nº 13.709/2018 - LGPD) and the exclusive jurisdiction of the Central Judicial District of São Paulo, SP, Brazil.

LitX uses Google OAuth solely to authenticate users (email and basic profile).
We do not transfer, disclose, or sell Google user data.
Tokens for connected third-party accounts that LitX stores are encrypted at rest with AES-256-GCM.
Users can revoke LitX access at any time via their Google Account security settings.

Supabase: database, authentication and file storage.
Vercel: website hosting and server functions.
Resend: transactional e-mail delivery.
Twilio: SMS delivery, when you choose a phone-based feature.
Veriff: identity and age verification of creators and performers.
LiveKit: live streaming and video calls.
Upstash: rate limiting (IP address and request counters).
Sentry: error monitoring, only after you accept analytics cookies.
PostHog: product analytics, only after you accept analytics cookies.
Google: sign-in with Google and, only after you accept the corresponding cookies, Google Tag Manager / Analytics.
Intercom: support chat, only after you accept the corresponding cookies.
Payment provider: payment processing, which is not active until the provider is activated; it will be named here before any payment is processed.
International transfers: several of these providers process data outside Brazil (mainly in the United States and the European Union). Such transfers rely on the mechanisms of LGPD art. 33 (including standard contractual clauses) and, for EU/UK users, on the GDPR transfer mechanisms offered by each provider.

Requests made at /legal/data-request are handled within the response periods set by applicable law, including LGPD art. 19.
If this policy is shown in a language other than English, the English version prevails in case of conflict.