Privacy Policy - VentasxMayor

Privacy Policy

Last updated: September 16, 2026

This Privacy Policy describes how Nebulosa Inc. ("Nebulosa", "we", "us"), a corporation organized in Nevada, United States, with offices at 848 N. Rainbow Blvd, Unit #8142, Las Vegas, NV 89107, USA, collects, uses, shares and protects personal information in connection with the VentasxMayor platform (VendasxAtacado in Brazil), its websites, applications, API and related services (the "Service").

This Policy forms part of our Terms of Service. It is written to comply with the data protection laws of the countries where we operate, including Argentina's Law 25.326, Brazil's Lei Geral de Proteção de Dados (LGPD), Chile's Law 19.628, Colombia's Law 1581, Mexico's LFPDPPP, Peru's Law 29733, Paraguay's Law 6534, Uruguay's Law 18.331 and, where applicable, the EU GDPR and the California CCPA.

1. Who this applies to

We process information about the following people:

  • Merchants: the companies that contract the Service and the people who represent them or use the Account (owners, administrators, sales reps).
  • Buyers: our Merchants' customers who access their B2B store to browse catalogs and place orders.
  • Visitors: people who browse our websites, subscribe to our newsletter, request a demo or contact us.

Our role varies by person. For Merchants and Visitors, Nebulosa is the controller. For the data of Buyers that a Merchant uploads or collects through its store, the Merchant is the controller and Nebulosa acts as processor, handling the data on the Merchant's instructions. If you are a Buyer, the privacy policy of the Merchant whose store you buy from governs the use of your data; you can exercise your rights directly with them, and we will support them.

2. Information we collect

  • Account and contact data: name, legal name, tax ID, job title, email, phone, address, country, language.
  • Billing data: payment history, amount, currency and reference of each transaction. Payments are processed by Stripe; we do not store full card numbers.
  • Merchant data in the Service: catalog, price lists, customers, orders, images, settings and integrations the Merchant uploads to its Account.
  • Usage and technical data: IP address, device and browser type, operating system, pages visited, actions performed in the panel, access and error logs, date and time.
  • Communications: the content of emails, chats, WhatsApp messages and calls you have with our sales or support team.
  • Cookies and similar technologies: see section 8.

We do not deliberately collect special categories of data (health, ethnic origin, political opinions, etc.) and ask you not to upload them to the Service.

3. Where we get information from

  • Directly from you, when you create an account, fill in a form, contract the Service or contact us.
  • From Merchants, when they upload data about their Buyers or Users to the Service.
  • Automatically, from your use of the Service and our websites.
  • From third parties, such as Stripe (payment status), integration providers authorized by the Merchant (for example, its ERP) and advertising platforms where you interacted with our ads.

4. Why we use information and on what legal basis

  • Providing the Service (creating and managing the account, hosting the store, processing orders, providing support, billing). Basis: performance of the contract.
  • Billing and collection through Stripe, and compliance with accounting and tax obligations. Basis: performance of the contract and legal obligation.
  • Security: preventing fraud, abuse and unauthorized access; keeping audit logs. Basis: legitimate interest and legal obligation.
  • Improving the Service: analyzing usage, measuring performance, fixing bugs, developing new features. Basis: legitimate interest.
  • Operational communications: notices about changes to the Service, prices, these documents or incidents. Basis: performance of the contract.
  • Marketing: sending newsletters and updates, and measuring advertising campaigns. Basis: consent or legitimate interest, depending on the country; you can unsubscribe at any time via the link in each email.
  • Legal compliance and defense of our rights. Basis: legal obligation and legitimate interest.

5. Who we share information with

We do not sell personal information. We share it only with:

  • Providers (sub-processors) that help us operate the Service and process data on our instructions under contract: cloud hosting and infrastructure, payment processing (Stripe), email and newsletter delivery, messaging (WhatsApp Business), customer support, analytics and advertising (Google Analytics, Google Ads, Meta, PostHog) and internal work tools.
  • Integrations chosen by the Merchant, such as its ERP or payment gateway, to the extent the Merchant configures them.
  • Authorities, where required by law or necessary to respond to a valid request, protect our rights or the safety of people.
  • Successors, in a merger, acquisition or sale of assets, with prior notice if the controller changes.

We can provide the current list of relevant sub-processors at the Merchant's request.

6. International transfers

Nebulosa is a United States company and the Service is hosted on cloud infrastructure located mainly in the United States. Information is therefore transferred to and processed outside your country. We adopt appropriate safeguards for these transfers, such as contractual clauses with our providers, technical and organizational security measures and compliance with the requirements each local law sets for international transfers. By using the Service, the Merchant authorizes these transfers and represents that it has the necessary legal basis regarding its Buyers' data.

7. Retention

We keep personal information while the Account is active and for as long as necessary for the purposes described. After an Account is terminated, Merchant data is kept for 30 days to allow export and then deleted or anonymized, except for backups, which are deleted in their normal cycles, and data we must keep for legal, accounting or tax obligations, which is kept for the applicable statutory period. Technical logs are kept for limited periods for security purposes.

8. Cookies and analytics

Our websites use cookies and similar technologies to: make the site work (necessary cookies), remember preferences, measure audience and performance (Google Analytics, PostHog) and measure the effectiveness of our advertising (Google Ads, Meta Pixel). Merchants' stores use only the cookies necessary for the store to work and for the Buyer's session.

You can block or delete cookies in your browser settings; some features may stop working. You can also opt out of Google measurement using the Google Analytics opt-out add-on and manage personalized advertising in your Google and Meta settings.

9. Security

We apply reasonable technical and organizational measures to protect information: encryption in transit (TLS), role-based access control, user authentication, backups, access logging, environment segregation and review of our providers. No system is completely secure; if we detect a security incident affecting personal data, we will notify affected Merchants and, where required, the authorities, within the timeframes required by applicable law.

10. Your rights

Depending on the law of your country, you may have the right to: access your personal information; rectify or update it; request its deletion or anonymization; object to or restrict certain processing; request its portability; withdraw consent; know with whom we have shared it; and lodge a complaint with your country's data protection authority.

To exercise these rights, write to privacy@ventasxmayor.com stating your name, the right you wish to exercise and details that allow us to identify you. We will respond within the applicable statutory timeframes (generally 10 business days, or 15 days in Brazil). If you are a Buyer of a store run on our Service, we recommend contacting the Merchant first; if you contact us, we will forward your request and support them.

Data subjects in Argentina: the Agencia de Acceso a la Información Pública, the supervisory body under Law 25.326, is empowered to handle complaints regarding breaches of personal data protection rules.

11. Minors

The Service is intended for businesses. We do not knowingly collect information from persons under 18. If you believe a minor has provided us with personal information, contact us so we can delete it.

12. Changes to this Policy

We may update this Policy to reflect changes in the Service, the law or our practices. The current version is the one published on this website, with its update date. If the change is material, we will notify Merchants at the registered email address at least 30 days in advance.

13. Contact

For privacy questions, requests or complaints, you can write to our data protection officer at privacy@ventasxmayor.com or by post to Nebulosa Inc., 848 N. Rainbow Blvd, Unit #8142, Las Vegas, NV 89107, USA.

VentasxMayor - a product of Nebulosa Inc.
848 N. Rainbow Blvd, Unit #8142
Las Vegas, NV 89107, USA
us@nebulosa.com
+1 (702) 748-9859