Privacy notice for Brazil

Effective 24 October 2026

1. The controller

The controller (controlador) is Wild Cats Media, SCO-47, Second Floor, World Street, Sector-79, Faridabad, Haryana, India – 121014, trading as AcrossView ("we", "us"). We have no office, branch or server in Brazil. The LGPD applies to us under its Article 3 when we process data of people in Brazil to offer them a service, and this notice is written on that footing. Where this notice and the main policy differ, the one that protects you more applies.

2. Encarregado

Our person in charge of personal data (encarregado pelo tratamento de dados pessoais, Article 41) is Amit Goyal, Wild Cats Media, at the address above. Contact him through the contact form, choosing "Privacy request or grievance", or at support@acrossview.com. He receives complaints and communications from data subjects and from the ANPD, explains and acts on them, and guides our staff on data protection.

The ANPD's rules for small-scale processing agents (Resolution CD/ANPD No. 2 of 27 January 2023) would allow a business of our size not to name an encarregado as long as a contact channel is published. We have named one anyway, because the questions people send us about privacy deserve a named person.

3. What this notice adds

The main policy, written for India's Digital Personal Data Protection Act, 2023, is the single description of what we collect, how long we keep it, who processes it with us (Hostinger in Mumbai; Google's Gemini API for recording transcripts; the sign-in and calendar providers you choose to connect; WhatsApp if you message us there), what we never see, and how we secure it. It applies to you in full. This notice adds the LGPD's legal bases, the full list of Article 18 rights with our response times, the position on international transfer, children's data, incident reporting and the ANPD. AcrossView makes no decisions about you solely by automated means that affect your interests (Article 20); session time limits follow your plan, not a profile of you.

4. Legal bases under Article 7

Each row of the data table in section 3 of the main policy rests on one of these bases:

• Performance of a contract, Article 7, V: your account and sign-in, meetings, support sessions, device registration, teams, chat, boards, bookings, webinars, the calendar, the API, and the recordings and clips you choose to make. The guest name you type to join a session is processed on the same basis.
• Consent, Article 7, I: the AI transcript and summary of a recording, for which the audio is sent to Google's Gemini API. You give it when you turn recording on and are told that a transcript will be made, and you withdraw it (Article 8, §5) by deleting the recording, which deletes the transcript and summary with it. Consent is also the basis for connecting a Google or Microsoft calendar, and for messaging us on WhatsApp. We send no newsletters or marketing.
• Legitimate interest, Article 7, IX, and Article 10: the security log, the mail log, the short list of product-use events, website server logs, clip view counts and comments, and answering your contact-form messages. For each we have checked that the interest is legitimate, that you could reasonably expect the processing, and that only the data needed is used. You can object (section 5).
• Legal obligation, Article 7, II, together with legitimate interest, Article 7, IX: connection records (IP addresses, device IDs, session times, relay volumes) kept for 180 days. The obligation is India's CERT-In Directions of 28 April 2022, the law of the country we operate from; we also need these records to prevent abuse and investigate scams. Valid requests from authorities are answered on the same bases.

We do not process sensitive personal data (Article 11) on purpose. A recording may contain whatever its participants chose to say; the host is responsible for telling participants that a meeting is recorded, and the app shows everyone when it is.

5. Your rights under Article 18

You can ask us, at any time and free of charge, for:

1. Confirmation that we process your personal data (Article 18, I).
2. Access to that data (II). We answer in a simplified form at once where we can, and in full within 15 days (Article 19).
3. Correction of incomplete, inaccurate or out-of-date data (III). Your name and email you can change yourself in your account.
4. Anonymisation, blocking or deletion of data that is unnecessary, excessive or processed unlawfully (IV).
5. Portability of your data to another provider (V), which we supply as JSON, with recordings and clips as the video files.
6. Deletion of data processed with your consent (VI). For the AI transcript, delete the recording.
7. Information on sharing: the public and private bodies with which we have shared your data (VII). The list is in section 6 of the main policy; we will tell you which of them received your data in particular.
8. Information on refusing consent and what happens if you do (VIII). You can use AcrossView without the AI transcript, without a connected calendar and without WhatsApp; refusing changes nothing else.
9. Revocation of consent (IX), with effect for the future.

You can also object to processing based on legitimate interest (Article 18, §2) and ask for a review of any automated decision (Article 20), though we make none. Send requests through the contact form or to support@acrossview.com from the address on your account; a legally appointed representative may ask on your behalf. We may ask you to prove who you are before we release anything. Connection records are kept for their 180 days and the security log for as long as security requires, as Article 16 allows for legal obligations and for our own regular use within the law.

6. International transfer

Where your data goes. Because we are in India, your data leaves Brazil the moment you use AcrossView: your browser or the Windows app sends it directly to our servers in Mumbai, rented from Hostinger International Ltd. The audio of a recording is then sent to Google's Gemini API for its transcript and summary, and Google may process it outside India, including in the United States. Nothing else is transferred onward, except what a sign-in or calendar provider you connect exchanges with us, and WhatsApp if you message us there.

The legal route. Article 33 of the LGPD and the ANPD's International Data Transfer Regulation (Resolution CD/ANPD No. 19 of 23 August 2024) allow a transfer to a country the ANPD has recognised as adequate, under safeguards such as the ANPD's standard contractual clauses, or with the data subject's specific and highlighted consent after being told the transfer is international. The ANPD has not recognised India as adequate, and we do not claim it has. We rely on two things: your consent at the point of use, given with this notice in front of you (Article 33, VIII), and contractual clauses with our processors: Hostinger processes under its hosting and data processing terms, and Google under its data processing terms for the Gemini API, which include contractual clauses for international transfers. We have not yet adopted the ANPD's own standard contractual clauses in our contracts; we will do so, and say so here, before promoting AcrossView in Brazil.

Safeguards in practice. Support sessions are end-to-end encrypted on the two devices and are never readable on our servers in any country. All other connections use TLS, passwords and API keys are stored only in hashed form, and access to our servers is restricted and logged. See Security. If you do not want audio sent to Google, do not record, or delete a recording as soon as it is made.

7. Children and adolescents

Article 14 of the LGPD requires that children's and adolescents' data be processed in their best interest, and that a child's data (under 12 under the Child and Adolescent Statute) be processed only with the specific and highlighted consent of at least one parent or legal guardian. AcrossView is not meant for anyone under 18 to use on their own: our terms require a parent or guardian to set it up and stay present, we do not knowingly create accounts for children, and we never ask a child for more data than the activity needs. If you believe a child has given us personal data without a parent's involvement, tell us through the contact form and we will delete it.

8. Security incidents

If a security incident may cause you relevant risk or damage, we will notify the ANPD and you (Article 48) within three business days of learning of it, the period set by ANPD Resolution CD/ANPD No. 15 of 24 April 2024, describing what happened, which data was involved, the risks, what we have done and what you can do. The content of support sessions cannot be exposed by a breach of our servers, because it is end-to-end encrypted and never stored.

9. Complaints to the ANPD

Please write to us first: a privacy request or grievance is acknowledged within 24 hours and answered within 15 days. If you are not satisfied, you may petition the Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd (Article 18, §1), and you may also complain to consumer protection bodies such as your state Procon, since AcrossView is a consumer service. Nothing here limits your right to go to court.

A Portuguese version of this notice is being prepared and will be published at this address. If we change this notice we will update the date at the top; significant changes will be announced on this website before they take effect. Other countries' notices are on Privacy notices by country.