LEGAL

Privacy Policy.

Wibx General Privacy and Data Protection Policy, valid for the https://wibx.io/ website, the Wibx Platform and the other apps of the Wibx Hub ecosystem.

Controller: STAMPS Soluções Tecnológicas Aplicáveis a Mídias e Produtos Sociais (WibxCo) · CNPJ/MF 35.638.508/0001-02.

WIBX · Privacy · Data Protection

Introduction

At Wibx, we are committed to protecting the personal data used in our activities. The data controller is STAMPS Soluções Tecnológicas Aplicáveis a Mídias e Produtos Sociais (WibxCo), CNPJ/MF 35.638.508/0001-02.

This Policy explains practices for collecting, using, processing, storing, protecting and transferring personal data, as well as your rights. It applies to the website, the Wibx Platform and the other apps of the Wibx Hub ecosystem, and must be read together with chapter 12 of the Terms of Use, which details each piece of data, its purpose and legal basis.

Definitions

Personal data: information relating to an identified or identifiable person.
Sensitive data: racial or ethnic origin, religious belief, political opinion, biometric data, etc.
Data subject: natural person to whom the personal data refers.
Processing: any operation performed with personal data.
Controller: the party that decides on processing.
Processor: the party that performs processing on behalf of the controller.
Data Protection Officer (DPO): responsible for communication with the ANPD and data subjects.
Cookies: small files stored in the user’s browser.

Sources of personal data

Chat.
Service channel.
Newsletter.
User registration.
Company/merchant registration.
Identity verification (KYC).
Use of the apps and the device.
Third-party accounts you connect, with your authorization.
Identified purchases at integrated stores and establishments, with your authorization.
Social networks.
Blog.
DPO channel.
Cookies and technical data.

What data we collect and how

Registration: name, CPF or CNPJ, e-mail, phone, date of birth, address, profile photo and access credentials; for legal entities, the documents of the company and of its legal representative.
Identity verification (KYC): identity document, facial image and liveness check, under the Biometrics and KYC Policy.
Wibx Account and movements: balance, statement, exchanges, redemptions, gifts, completed actions and rewards credited.
Access and device logs: IP address, date and time of access, model, operating system, app version and device identifiers.
Use inside the apps of the Wibx Hub ecosystem and interest inferences made only with that data.
Location: approximate, by IP address; precise (GPS) only with your consent, while the app is in use and with no movement history.
Messages in support and contact channels.
Sensitive data only in the cases of art. 11 of the LGPD: facial image for identity verification and, with specific consent, survey answers involving sensitive data.

Processing and uses

What Wibx does not do: it does not track what you do on third-party sites and apps; it does not buy your data from data brokers; it does not keep movement history; it does not read your private messages to build a profile; it does not use your content to train artificial intelligence without a declared purpose and an option to refuse; it does not recognize visitors without an account by device fingerprinting; it does not sell personal data.

Service provision and support.
Registration, identity verification and account management.
Fraud prevention and platform security.
Personalization of campaigns, stores and content inside the Wibx Hub ecosystem.
Campaign measurement for advertisers, in aggregated or anonymized reports.
Communications and newsletter delivery.
Compliance with legal and regulatory obligations.
Automated decisions (confirmation of actions, crediting of rewards and fraud detection), with the right to request review.

Our reasons for processing

Performance of contract (art. 7, V): what is needed for the platform to work.
Legitimate interest (art. 7, IX): improvement, personalization and security inside the Wibx Hub ecosystem, with a documented assessment and the right to object in the privacy panel.
Consent (art. 7, I): in a separate, unticked and revocable option, requested when the feature is used.
Compliance with a legal or regulatory obligation (art. 7, II).
Regular exercise of rights (art. 7, VI).
Sensitive data (art. 11): facial image processed under art. 11, II, "g" (fraud prevention and security of the data subject in identification and authentication of registration).

Who we may share data with

Wibx does not sell personal data.

Advertisers: only with your consent, for the purpose you accepted; without it, they receive only aggregated numbers.
Other apps of the Wibx Hub ecosystem, where the same login, balance and history are valid.
Cloud, IT, identity verification and anti-fraud providers, acting as processors.
Regulatory and legal authorities when required.

Storage, security and transfers

Data may be stored in secure infrastructure, including internationally, with access controls and technical safeguards.

Retention and end of processing

Each data category has its own retention period, set by the law that requires it. Once the period ends, the data is deleted or anonymized, unless an authority order or ongoing proceeding requires longer retention.

Registration: while the account is active and for 5 years after closure (limitation period of the Brazilian Consumer Protection Code, art. 27, for the regular exercise of rights).
Identity verification (KYC), including facial image and authentication video: 5 years after account closure (Law 9,613/1998, art. 10).
Wibx Account and movements: 5 years after account closure or completion of the movement, whichever is later (Law 9,613/1998, art. 10).
Tax documents: 5 years (Brazilian National Tax Code, art. 173 and art. 195, sole paragraph).
Access logs: 6 months (Brazilian Internet Civil Framework, art. 15), extendable at an authority’s request or when linked to a fraud investigation or proceeding.
Support: 5 years after the ticket is closed (Brazilian Consumer Protection Code, art. 27).
Consent and revocation records: while the consent is valid and for 5 years afterwards, as evidence (LGPD, art. 8, § 2).
App usage and interest inferences: while the account is active; deleted or anonymized after closure.
Promotional communications: until you revoke your consent.

Children's and adolescents' data

The Wibx Platform accepts registration from age 14. Between 14 and 18, registration is assisted by the legal guardian and requires their consent (art. 14 of the LGPD). Minors’ data is not used for interest inference or partner brand offers, and a minor’s location is only processed during an active session, with no history. We do not accept registration below age 14.

Cookies

We use cookies to improve user experience, personalize content and support platform functionality.

Your rights

Confirmation of the existence of processing.
Access to data.
Correction of incomplete or outdated data.
Anonymization, blocking or deletion when applicable.
Data portability, when possible.
Information about who the data was shared with.
Withdrawal of consent, without losing use of the platform.
Objection to processing based on legitimate interest, through the privacy panel.
Review of an automated decision that affects your interests (art. 20 of the LGPD).

Changes to this policy

This Policy may be updated. Every relevant change will be communicated in advance, through a prominent notice on the website and in the apps, before it takes effect.

DPO contact

Email: encarregadodedados@wibx.io.
DPO: Vagner Sobrinho.
Support center: atendimento@wibx.io.

Applicable law and forum

This Policy follows Brazilian data-protection law. Elected forum: District Court of São José dos Campos/SP, without prejudice to the venue of the consumer data subject’s domicile.

Version: September 2026.
Language: English.
Application: Wibx website, Wibx Platform and apps of the Wibx Hub ecosystem.