Terms of Use and Data Policy

1. The service

Viidoo is an audiovisual production management platform: publishing video and photo deliveries, client review and approval, a library of approved material, albums and the studios' public portfolios. The service is provided as is and may evolve continuously.

2. Accounts and responsibilities

• Accounts are personal and non-transferable. You are responsible for keeping your credentials confidential and for all activity performed with them.
• Studios (companies) are responsible for the content they publish and for obtaining the necessary authorizations from the people who appear in the material.
• Using the platform for unlawful or offensive content, or content that violates third-party rights, is prohibited. Accounts in violation may be suspended.

3. Content and intellectual property

The videos, photos and other material uploaded belong to the studios and their clients, as set out in the agreements between them. By using Viidoo, the company grants the platform a limited license, solely to operate the service: storing, streaming, generating thumbnails and previews, and displaying the content to authorized people.

4. Personal data we process

Account data

• Name and email — to create the account, authenticate and send notifications.
• Preferred language and linked company.

Operational data

• Approval records: when approving or requesting changes to a delivery, we record the name provided, date and time, IP address and browser identification. This trail exists as proof of the decision — it protects both the studio and the client.
• Comments, annotations, audio clips and images attached to reviews.
• Usage events of shared links (opens and downloads).
• Cookies strictly necessary for the authenticated session.

5. Purposes and legal bases (LGPD)

• Performance of a contract (art. 7, V): operating accounts, deliveries, reviews, the library and notifications.
• Legitimate interest (art. 7, IX): the approval audit trail, fraud prevention and platform security.
• Consent (art. 7, I): public display of material in the studio's portfolio — always preceded by the client's express authorization, revocable at any time.
• Compliance with a legal obligation (art. 7, II): keeping records when required by law.

6. Sharing with processors

We do not sell personal data. We share the minimum necessary with processors that sustain the service: hosting and database providers, file storage providers (including, depending on the company's configuration, the studio's own Google Drive, OneDrive or S3 bucket) and the email delivery service. Each processor handles data under contractual instructions and only for the contracted purpose.

7. Retention and deletion

• Items deleted from the Library go through a trash bin with a 5-day retention period before the files are permanently removed.
• Files in the company's own archive, linked by reference, are never deleted by the platform.
• Approval records are kept for the duration of the contractual relationship and for the applicable legal periods.
• When the account is closed, data is deleted or anonymized.

8. Your rights (LGPD, art. 18)

You may request, at any time: confirmation that processing exists; access to the data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary data; portability; information about sharing; and withdrawal of consent — including consent to portfolio display, which takes the material offline.

9. Public portfolio and consent

Photos and videos are displayed in a studio's public portfolio only after the client's express release, given inside the platform itself. By releasing, the client understands that the material may be seen by anyone on the internet, as promotion of the studio's work. The release can be undone at any time, and the material leaves the portfolio immediately.

10. Security

We apply technical measures consistent with the state of the art: encryption in transit (HTTPS), cloud credentials encrypted at rest, role-based access control, signed links with expiration and audit trails. No system is infallible; relevant incidents will be communicated as required by the LGPD.

11. Changes to these terms

This document may be updated. Relevant changes will be communicated on the platform and, when required, new consent will be requested.

12. Contact

To exercise your rights or ask questions about personal data, contact the controller at contato@viidoo.io. We will respond within the timeframes set by the LGPD.