Privacy policy
Updated on September 24, 2026
This policy explains which data Experto processes, why, with whom it is shared and how you exercise your rights, under Brazil's General Data Protection Law (Law 13,709/2018). The Portuguese version prevails.
1. Who is responsible
Experto is a digital solution developed by MTOOLS AGÊNCIA DIGITAL LTDA., CNPJ 03.711.905/0001-68, Rodovia SC 401, 4100, Km 4, Saco Grande, Florianópolis, SC, 88032-005, which is the data controller. For privacy and personal data matters, contact our data protection officer. Responsible contact: Eduardo Agustin Velardez (dpo@mtools.digital). For questions about using Experto, customer support is contato@getexperto.com.
2. What data we process
- Sign-up: name, email, photo (if you upload one), language, time zone and preferences.
- Content: lists, items, notes, attachments, messages and notifications you create or receive.
- Usage and device: last access, whether you are online, device type and app version, and account activity logs.
- Billing: name or company name, tax ID, email, phone and address of whoever pays, and the charge history. The card number stays with Asaas.
- Referrals: the email of whoever signed up through your link and whether the referral was approved.
- Site browsing, only if you accept in the cookie notice: where your visit came from (UTMs and referring site), the pages you view, your device type and browser, and the identifiers of measurement and advertising cookies.
3. Why we use it
We do not sell data and we do not use your content for advertising.
- To provide the service: store and show your content, sync your devices, send invitations and notices (performance of contract).
- To charge paid seats and meet tax obligations (performance of contract and legal obligation).
- To keep the service secure, prevent abuse and fix problems (legitimate interest).
- Communication and marketing: to measure which campaigns and ads bring people to Experto and plan the next ones (consent, which you can withdraw).
4. Who we share it with
- Supabase: database, sign-in and file storage.
- Lovable and Cloudflare: hosting and delivery of the site and the web app.
- Asaas: payments and billing.
- GitHub: distribution of the app installers and updates.
- The AI apps and automations you connect yourself.
- Third-party measurement and advertising tools, such as those from Google and social networks: they receive your browsing data on the site, only if you accept in the cookie notice.
- Within an account, administrators see the people, the account lists and the activity; never private lists and notes.
- Authorities, when required by law.
5. International transfer
Some of these providers store data outside Brazil. In those cases, we use providers with contractual protection guarantees compatible with the LGPD.
6. How long we keep it
- While your account exists. When you delete it, we erase your data, except what the law requires us to keep.
- Deleted items, notes and lists: 30 days. Notifications: 7 days. Automation logs: 7 days. Activity logs: 12 months.
- Billing data: for the period required by tax law (usually 5 years).
7. Your rights
You can request confirmation that we process your data, access, correction, anonymization, portability, deletion, information about sharing and withdrawal of consent. Much of this you can do in the app itself (profile, settings and account deletion); for the rest, write to dpo@mtools.digital. You can also file a complaint with Brazil's National Data Protection Authority (ANPD).
9. Security
We use encrypted connections, per-account and per-person access control in the database and restricted team access. If an incident poses a risk to you, we will notify you and the ANPD.
10. Changes to this policy
When this policy changes in an important way, we will let you know in the app or by email. The date of the last update is at the top of this page.