Privacy Policy

Introduction

This Privacy Policy describes how DIMBER collects, uses, shares and protects the personal data of those who use its platform. It applies to both Users and Creators and forms part of the Terms and Conditions of Use, the Terms and Conditions for Creators and the Services Agreement.

Using the platform means understanding, accepting and being bound by this Privacy Policy and by the applicable Terms. Anyone who disagrees with or refuses any of the conditions set out here must stop using the platform.

Clause 1. Application

This Policy applies to the data provided by data subjects and collected by DIMBER when the platform is accessed or when any information is entered into it, whether on creating an account, publishing content, exchanging messages, browsing or through any other form of interaction.

DIMBER is DIMBER BRASIL LTDA., a limited liability company registered with the Brazilian corporate taxpayer registry (CNPJ) under no. 61.068.923/0001-70, with its registered office at Avenida Paulista, no. 1,471, suite 511, Bela Vista, São Paulo, State of São Paulo, postcode 01311-927, acting as the controller of the personal data processed within the platform.

In all these cases, DIMBER will observe the applicable data protection legislation, in particular Brazilian Law no. 13,709/2018 (LGPD).

Third-party websites outside DIMBER's hosting environment, even where made available or accessed from the platform, are outside its direct control. Data subjects are advised not to open third-party links from the platform.

Clause 2. The data subject's agreement to the use of their data

By using the DIMBER platform, the data subject consents to the collection, storage and use of the information provided, whether personal or not, its updates, traffic data, internet protocol addresses, among others. DIMBER may transmit such information to its commercial partners and affiliates.

The data subject also consents that DIMBER may retain their personal data for the period it deems necessary, subject to legal restrictions and to clause 11 of this Policy.

The data subject consents to receiving notifications, notices and electronic messages about announcements, promotions and special content from DIMBER, from its platform or from partner companies. Should they wish, the data subject may opt out of such messages, in which case DIMBER reserves the right to cancel the account.

Clause 3. Disclaimer

The data subject declares that they are aware that DIMBER assumes no liability in the event of theft, loss, alteration or misuse of their personal information and of the content made available on the platform.

Published content carries simplified information about whoever created it. By publishing content, the data subject declares that they are aware that their information may be available on the platform and, consequently, on the world wide web.

Clause 4. Information collected, received and stored

DIMBER collects, receives and stores the following information, with the aim of improving the services provided:

account information, such as email address, telephone, home address, password, documents, Brazilian individual taxpayer number (CPF), biography, date of birth, photographs and city, state and country of origin;

information from third-party authentication services, when used by the data subject, in which case DIMBER may receive and store additional profile information or other information authorised by the service provider;

identity verification information, such as identity documents, facial image, facial biometric data, tax records and proof of address;

payment data, card tokens, instant transfer keys, banking details and anti-fraud analysis results;

internet protocol address, identifiers, access logs and application usage data, such as clicks, response time, messages read and received, display time, device model, operating system, language and time zone;

message metadata, such as dates, times and read status, as well as reports and interactions with support;

information from cookies, local storage and advertising identifiers;

personal information necessary for support, when the data subject contacts support, used to answer the request and to contact them.

Message content is stored on DIMBER's servers to enable delivery, the conversation history and the technical audit of operations, as set out in clause 7 of this Policy.

DIMBER may also store and transmit such information to its commercial partners and affiliates, including personal and contact information.

Clause 5. Reasons for collecting and using the information

Information is collected in order to provide the service in the most appropriate way possible. Only from it is it possible to resolve technical difficulties, enable or disable features, personalise experiences, provide security to data subjects, carry out research and analysis aimed at improving the platform, contact data subjects and meet the needs of all of its users.

The data is also used to perform the contracts entered into with the data subject, for identification and authentication, for fraud prevention, for payment processing, to comply with legal and regulatory obligations, for support and for the regular exercise of rights.

Clause 6. Legal bases for processing

DIMBER processes personal data on the legal bases of article 7 and, as regards sensitive personal data, of article 11 of Brazilian Law no. 13,709/2018.

Performance of a contract: creating and maintaining the account, sending and receiving messages, granting reply allowances, processing payments and transferring funds.

Compliance with a legal or regulatory obligation: keeping the access records of internet applications under article 15 of Brazilian Law no. 12,965/2014, tax and accounting obligations, and responding to requests from the competent authority.

Legitimate interests: the security of the platform, the prevention and investigation of fraud, the identification of operational risks and the improvement of the services, whenever that purpose does not override the fundamental rights and freedoms of the data subject.

Regular exercise of rights: defence in judicial, administrative or arbitration proceedings.

Consent: the processing of facial biometric data, where the law requires it, and the sending of promotional communications. Consent is requested separately and prominently.

Consent may be withdrawn at any time through the channels indicated in this Policy; withdrawal does not affect processing based on another legal basis, nor processing already carried out while the consent was in force.

Clause 7. Confidentiality of communications and absence of monitoring

The messages exchanged between User and Creator are private and are protected by end-to-end encryption.

The keys remain with the participants in the conversation. DIMBER does not hold them and therefore has no access to the content of the messages: what is stored on its servers is the encrypted content.

DIMBER does not monitor, read or analyse the content of messages. The automated systems used by DIMBER are intended for security, fraud prevention, identification of operational risks and the technical functioning of the platform; they operate on metadata and access logs and do not read the content of communications.

When complying with a court order, under article 7, III, of Brazilian Law no. 12,965/2014, DIMBER provides the requesting authority with the data it has access to — access records, metadata and the encrypted content of the conversations named in the order, to the extent and for the period it sets. As it does not hold the keys, DIMBER has no way of handing over the content of the messages in readable form.

Complying with a court order does not amount to monitoring and does not entitle DIMBER to examine communications outside the subject of the order.

Content submitted by one of the participants in a conversation to the reporting channels may be examined by DIMBER in order to investigate the report, in which case the analysis arises from the voluntary referral by the participant themselves.

DIMBER keeps internet application access logs in accordance with article 15 of Brazilian Law no. 12,965/2014 and will provide them when requested under the law.

Clause 8. Facial biometrics

DIMBER may use a specialised supplier for facial image verification and liveness detection.

This data is used exclusively for authentication, fraud prevention and regulatory compliance. Where the law requires it, specific consent will be requested.

Facial biometric data is stored for as long as the data subject keeps an active account on the platform and is deleted immediately upon deletion of the account, except where retention arises from an express legal or regulatory obligation.

Biometric data is not used for advertising, for content personalisation, for enriching third-party databases or for any purpose unrelated to authentication and fraud prevention.

Clause 9. Sharing of information

Data may be shared with payment processors, infrastructure providers such as hosting, content delivery network, email, messaging and usage analytics, identity verification and biometrics partners, support and moderation providers, authorities where required and, further, in corporate reorganisation scenarios such as a merger or acquisition.

The content of the messages is not shared. It is protected by end-to-end encryption and DIMBER does not hold the keys.

All sharing observes appropriate contracts and security measures.

Clause 10. International transfer

Data may be processed outside Brazil.

DIMBER adopts contractual clauses, processing agreements and risk assessments to ensure adequate protection, under articles 33 to 36 of Brazilian Law no. 13,709/2018.

Clause 11. Data retention and deletion

Personal data is kept for as long as the data subject remains active on the platform and is deleted immediately upon deletion of the account.

Excepted from the rule in the previous item is data whose retention arises from a legal or regulatory obligation, the access logs kept under article 15 of Brazilian Law no. 12,965/2014 and data necessary for the regular exercise of rights in judicial, administrative or arbitration proceedings, which will be kept for the legal period and then deleted.

The data subject may correct or delete the information provided when creating an account or publishing content through the platform itself. Should the deletion of information make it impossible to maintain the registration, DIMBER may, at its discretion, delete the data subject's registration.

The data subject may also disable cookies in their browser, in which case some tools may work less well.

Clause 12. Rights of the data subject

Under article 18 of Brazilian Law no. 13,709/2018, the data subject has the right to obtain from DIMBER, at any time and upon request:

confirmation that processing exists;

access to the data;

correction of incomplete, inaccurate or out-of-date data;

anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the law;

portability of the data to another service or product provider, upon express request, observing commercial and industrial secrecy;

deletion of personal data processed with the data subject's consent, save for the retention cases provided for by law;

information about the public and private entities with which DIMBER has shared data;

information about the possibility of not giving consent and about the consequences of refusing;

withdrawal of consent, under article 8, paragraph 5, of Brazilian Law no. 13,709/2018.

Requests must be sent to the email address legal@dimber.io, together with the elements necessary to identify the data subject.

DIMBER will answer requests within 30 (thirty) days, counted from receipt of the duly documented request.

Where the request cannot be met immediately, DIMBER will send a reasoned reply, within the same period, stating the reasons of fact or of law that prevent it from being met, or stating that it is not the processing agent for the data and indicating, where possible, who is.

Clause 13. Responsibilities of data subjects

Any information the data subject shares on their profile, in their posts or anywhere else on the platform is their own responsibility.

Data subjects must act with care and responsibility regarding the information they enter on the platform, especially regarding their own personal data or that of third parties.

The Creator may not use the personal data to which they gain access through the platform for any purpose unrelated to the contracted interaction, nor transfer it to third parties, nor use it for contact outside the platform without their own legal basis.

Clause 14. Security

DIMBER applies technical and organisational measures to protect the data, among them encryption in transit and at rest where applicable, environment segregation, access control and infrastructure security monitoring.

No system is entirely secure. Should a relevant incident occur, DIMBER will make the notifications provided for in Brazilian Law no. 13,709/2018 to the affected data subjects and to the National Data Protection Authority.

Clause 15. Children and adolescents

The platform is not intended for anyone under 16 (sixteen) years of age. A Creator account, which involves receiving payments, is restricted to those over 18 (eighteen) years of age.

Where access takes place through an app obtained from an app store, age is verified by the age verification and parental supervision mechanisms made available by that store and by the device's operating system, which DIMBER adheres to and whose age rating it observes. In other forms of access, DIMBER will adopt its own age verification mechanism.

Data collected exclusively for age verification is not used for advertising, for content personalisation or for any purpose unrelated to that control.

Accounts identified as belonging to anyone under 16 years of age are restricted or closed, with the deletion of the respective data. The same applies to a Creator account belonging to anyone under 18 years of age.

Clause 16. Cookies and usage analytics

DIMBER uses essential cookies, aimed at login and security, functional cookies, aimed at the data subject's preferences, and performance and usage analytics cookies.

Where necessary, a consent notice will be shown for managing the optional cookies.

Clause 17. Changes to this Policy

This Policy may be updated as a result of legislative, regulatory, technological, operational or security change. Every change is published as a numbered version, with an effective date, and earlier versions remain available for consultation.

A material change, understood as one that alters the purposes of processing, the sharing scenarios or the rights of data subjects, will be communicated at least 30 (thirty) days before it takes effect, by electronic message or by notice on the platform. During that period, the previous version remains applicable.

An editorial adjustment, with no effect on purposes, sharing or rights, takes effect upon publication.

Clause 18. Contact and complaints

Questions, requests and complaints concerning privacy and data protection must be sent to legal@dimber.io.

Data protection officer: Gabriel Coppi — telephone +55 19 3254 5640.

General support: support@dimber.io, through the Help area of the app or the form at dimber.io.

The data subject may also file a complaint with the Brazilian National Data Protection Authority (ANPD) or with the consumer protection bodies.

DIMBER BRASIL LTDA.

Version 6, in force since 9/24/2026