Legal

Privacy Policy

How Shibui collects, uses, shares and protects your personal data, and how you can exercise your rights.

Last updated: October 18, 2026.

This Policy explains how SUMIOSHI LABS, Brazilian company registration (CNPJ) 63.515.130/0001-87 ("Shibui", "we"), processes the personal data of people who visit shibui.build, create an account, buy a template or use the site editor. It follows Brazil's General Data Protection Law (Law No. 13,709/2018, "LGPD") and, where applicable, other privacy laws such as the GDPR.

SUMIOSHI LABS is the controller of the data processed by Shibui. For any privacy matter, contact our data protection officer through the form at shibui.build/contact, choosing the subject "Privacy".

1. Data we collect

Data you give us

  • Account: name, email and password (stored only in hashed form). If you sign in with Google, we receive your name, email and profile picture.
  • Purchases: name, email and, when the payment method requires it, your tax ID. Card details are entered directly on the payment processor's page; Shibui never receives or stores your card number.
  • Project content: the prompts you write for the AI, the images you upload and the content of the sites you create and publish.
  • Contact: what you write when you reach us through the form or by email.

Data collected automatically

  • Usage: pages visited, clicks, templates opened, purchase and sign-up events, date and time of access.
  • Technical data: IP address, browser and device type, operating system, language and referring pages.
  • Cookies and similar technologies: described in the Cookie Policy.

We do not intentionally collect sensitive personal data (such as health, religion or biometrics). Shibui is not intended for people under 18.

2. Why we use data and on which legal basis

  • Create and maintain your account; generate, edit and publish your sites: Performance of a contract.
  • Process payments, deliver purchased templates and grant credits: Performance of a contract.
  • Send service emails (account confirmation, purchase access, receipts, billing notices): Performance of a contract.
  • Issue tax documents and meet legal and regulatory obligations: Legal obligation.
  • Prevent fraud, abuse and misuse; keep the platform secure: Legitimate interest.
  • Measure site usage and improve the product: Legitimate interest (or consent, where local law requires it).
  • Measure and optimize ads (Meta and Google): Legitimate interest, with the right to object (or consent, where local law requires it).
  • Answer your messages: Performance of a contract or legitimate interest.
  • Exercise rights in legal or administrative proceedings: Regular exercise of rights.

3. Artificial intelligence

To generate and edit sites, we send your prompt, the project content and attached images to AI model providers (through OpenRouter and providers such as OpenAI, Anthropic and Google). These providers process the data to return a response. Do not use the editor to send personal data of third parties that you are not authorized to share.

4. Who we share data with

We do not sell personal data. We share only what is needed with providers that operate the service on our behalf (processors):

  • Hosting and infrastructure: Vercel (application), Hetzner (servers and database), Cloudflare (CDN, file storage and published sites) and Daytona (preview environments).
  • Payments: Dodo Payments and Asaas, which process the charge and may act as the party responsible for the transaction towards the buyer.
  • Email: Resend, for service emails.
  • AI: OpenRouter and the model providers listed in section 3.
  • Analytics and monitoring: PostHog (usage analytics) and Sentry (error logging).
  • Advertising and measurement: Meta (Pixel and Conversions API) and Google (Google Ads, Tag Manager and Sign in with Google). For purchase events, we may send Meta and Google hashed identifiers (such as email) to measure whether an ad led to the sale. You can object to this use as described in the Cookie Policy.

We may also share data with public authorities when required by law or court order, or in a merger, acquisition or asset sale, keeping the safeguards of this Policy.

5. International transfers

Some of these providers store or process data outside Brazil, mainly in the United States and the European Union. These transfers rely on the grounds of article 33 of the LGPD, such as contractual clauses with providers and the need to perform our contract with you.

6. How long we keep data

  • Account and projects: while your account is active. When you delete a project, the published site goes offline and its files are removed.
  • Purchase and tax data: for the period required by tax and accounting law (generally 5 years).
  • Usage and analytics data: for up to 24 months, or less, depending on each tool's settings.
  • Access logs: for at least 6 months, as required by the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014).

After these periods, data is deleted or anonymized, unless the law allows us to keep it longer.

7. Your rights

You may ask at any time for:

  • confirmation that we process your data and access to it;
  • correction of incomplete, inaccurate or outdated data;
  • anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
  • portability of your data to another provider;
  • deletion of data processed based on your consent;
  • information about who we share your data with;
  • withdrawal of consent and objection to processing based on legitimate interest, including measurement and advertising.

To exercise these rights, use the form at shibui.build/contact. We may ask you to confirm your identity first. We answer within 15 days. You may also file a complaint with Brazil's National Data Protection Authority (ANPD) or with your local data protection authority.

8. Security

We use encrypted connections (HTTPS), hashed passwords, access controls and encrypted backups. No system is fully immune to incidents; if an incident poses a relevant risk to you, we will notify you and the ANPD as required by law.

9. Sites published by users

The sites you create and publish with Shibui (for example, at your-name.shibui.build) are your responsibility. If your site collects visitor data, such as through contact forms, you are the controller of that data and must inform your visitors; Shibui acts only as a processor, storing and delivering the messages to you.

10. Changes

We may update this Policy. The date at the top shows the version in force. When a change is relevant, we will notify you by email or with a notice on the site.

The Portuguese version of this Policy prevails in case of divergence.