Cookie and Tracking Policy

Version 2.0 | Published on September 4, 2026 | Effective from September 4, 2026

This Cookie and Tracking Policy explains how VISU Network Ltda (CNPJ 54.954.885/0001-97), R 1500, no. 820, Sala 2003 F55, Edif Sky Business Center, Centro, Balneário Camboriú/SC, Brazil, ZIP 88.330-526 ("VISU", "we") uses cookies, local storage, device identifiers, SDKs, pixels, tags and similar technologies.

This Policy works together with our Privacy Policy and our Terms of Use. The Privacy Policy explains more broadly how we handle personal data. Where these documents overlap, they should be read together.

This is version 2.0. It replaces the previous version, of 15 June 2026, and brings a material change: it corrects the description of when analytics loads, names the two analytics properties in use, names the advertising mediation partners and other providers that were previously missing, and updates the mobile apps section, where native consent controls are now live. This version also unifies the scope of the Policy, which now covers the visu.network website. Because this is a material change, we ask you to review your choices.

Scope of This Policy

This Policy describes the consent mechanism of the Service across all of its surfaces: the app pages at visu.to, the visu.network website, VisuLink pages, public clip links and the VISU mobile apps.

On visu.network, consent signals start denied for all visitors and are only released for opt-out regions after the country is identified; on that site there is still no panel to grant analytics or advertising, so those technologies remain disabled for visitors from prior-consent regions.

1. What these technologies are

Cookies are small text files stored in your browser.

Local storage and session storage are browser storage technologies used to save small pieces of information, such as your consent choice. VISU stores your web consent choice in the browser's local storage.

Device and app identifiers are values used by mobile apps, operating systems, SDKs and, where applicable, advertising or fraud prevention systems.

Pixels, tags and SDKs are scripts or libraries used to operate features, measure use, prevent fraud or support advertising and rewards.

In this Policy we call all of these technologies "cookies and similar technologies".

2. Categories we use

Essential technologies. Essential technologies are always on because they are necessary for VISU to work, stay secure and provide core features. They cannot be turned off through the cookie banner.

They may include technologies for login sessions, authentication tokens, account security, load balancing, language and preference storage, CSRF protection, fraud prevention, rewards integrity, abuse detection and legal compliance.

Essential technologies also include security and anti-fraud signals, including device or usage signals sometimes described as "device fingerprinting". These signals are used to detect abuse, multiple accounts, automation, spoofing and rewards fraud. They are a security function and are not advertising consent.

Functional and referral attribution technologies. These technologies support core VISU features such as referral links, invite flows, QR flows, campaign attribution, linking of pending rewards and first-party attribution parameters such as campaign source parameters and referral codes.

These functional and attribution technologies are treated as essential in the consent banner and have no separate toggle, because they operate the Service and the rewards system. VISU does not send first-party referral attribution to third-party advertising networks for advertising purposes without advertising consent or an applicable legal basis.

Analytics technologies. Analytics technologies help us understand how the Service is used and improve performance, reliability, product design and user experience. Analytics is intended for aggregated or pseudonymized use and is not intended to directly identify individual visitors.

Advertising technologies. Advertising technologies are used to measure, cap, personalize or support advertising and ad-funded reward flows. In the mobile apps this includes Google AdMob and its mediation partners.

If you do not consent to advertising, or if a standing privacy signal requires advertising to be turned off, VISU will not use advertising technologies for personalized advertising. Ads, where shown, may be contextual, limited, non-personalized or unavailable depending on region, app surface, campaign and provider settings.

VISU does not use Google Ad Manager or Google AdSense. There is no integration of those products in the Service. If that changes, we will update this Policy.

The consent banner presents three controls: essential (always on), analytics and advertising.

3. Analytics and Google Tag Manager: what actually loads

We want to be precise here, because the previous version of this Policy was ambiguous in saying these technologies were used "where applicable".

The Google Tag Manager container loads on every visit; before it, VISU emits the Consent Mode v2 signals matching your region and your choices, and enables ad data redaction. The resulting behavior depends on your region, as described in section 4.

One Google Analytics property is governed by those signals: where analytics is denied, collection is cookieless, restricted, or does not occur. A second property, used by the web app, is only loaded after analytics consent is granted; without consent, it does not load.

Changes to the container go through internal review. The list of technical identifiers is in the Tracking technologies inventory, in the help center.

The Service's web pages also load, in order to operate features, MapTiler (local discovery maps), Google Sign-In and Apple Sign-In (on the authentication screen) and Google Fonts. VISU does not load Meta Pixel, TikTok Pixel, Hotjar, Clarity or equivalent social network trackers.

4. How consent works by region

VISU applies a region-sensitive consent model. Your region may be determined by IP, request headers, network signals, account settings, language and locale, device settings or other reasonable signals. Browser privacy signals may further restrict how technologies are used.

The defaults applied today, before any choice by you, are these:

European Economic Area, United Kingdom and Switzerland. Non-essential analytics and advertising technologies require prior consent. Signals arrive denied by default and nothing is written to your device for those purposes until you actively accept. The banner remains available until you make a choice.

Brazil. In Brazil, non-essential analytics and advertising technologies require your prior consent. They start off and nothing is written to your device for those purposes until you actively accept. The banner offers accept, reject and manage-by-purpose options with equal prominence, and stays available until you make a choice. Refusing is as easy as accepting, and we do not treat silence, scrolling or continued browsing as consent. Strictly necessary cookies remain on because the service does not work without them. Your choice and the version of this Policy in force at the time are recorded, and you can change it at any time through the management panel or the "Your Privacy Choices" link.

Other regions. In the regions not listed above, analytics and advertising technologies start on with notice, and you can turn them off at any time through the banner, the management panel or the "Your Privacy Choices" link. Advertising is turned off whenever your browser sends a standing privacy signal, as described in section 5. Your choice, once made, is recorded and honored on later visits.

California and other opt-out regimes. Where opt-out regimes apply, including California privacy laws where applicable, VISU honors applicable opt-out rights. If your browser sends Global Privacy Control, VISU treats it as an opt-out of sale, sharing or similar advertising processing where required.

Cross-region rules. A rejection of non-essential technologies is honored across your devices where we can associate the choice with your account. A permissive choice made in an opt-out region does not unlock analytics or advertising in a prior-consent region. If you move to or access VISU from a region that requires prior consent, we may ask you to choose again.

5. Standing privacy signals: GPC and DNT

If your browser or device sends Global Privacy Control or Do Not Track, VISU treats that signal as a standing privacy signal where detected.

While that signal is active, advertising remains denied in all regions, even if the advertising toggle appears available or was previously enabled, and even if you chose Accept all. The management panel shows advertising as blocked while the signal is active, and the corresponding control is disabled.

These signals are also read server-side when you are logged in, so the decision does not depend on the browser alone.

6. Google Consent Mode v2

Where Google services are used, VISU sends Google Consent Mode v2 signals reflecting your current choice, region and applicable privacy signals. These signals are emitted before the Google Tag Manager container loads.

The signals cover analytics storage, advertising storage, use of ad data and ad personalization. VISU also enables ad data redaction before any transmission.

Where analytics or advertising are denied, VISU configures Google services accordingly. Essential, functional, security and anti-fraud technologies may continue to operate because they are necessary for the Service, security, login, rewards integrity and legal compliance.

7. Mobile apps: iOS and Android

In the VISU mobile apps, the web cookie banner is not shown inside the native WebView. Mobile consent is collected through native controls.

In the mobile apps, VISU uses Google's User Messaging Platform (UMP) to collect and renew the advertising consent required in your region. The form is presented at app launch where needed, and you can reopen your privacy options from the app settings where your region requires that control.

On iOS, the system presents the App Tracking Transparency (ATT) prompt. If you do not allow it, the device advertising identifier is not used for personalized advertising, and the ads shown may be contextual or non-personalized.

On Android, the app declares the advertising identifier permission so the ads system can operate according to your choices and your system settings. You can reset or limit that identifier in your Android settings.

You can also control advertising identifiers and privacy settings through iOS or Android settings. VISU honors platform controls and applicable privacy signals.

8. Third-party providers

A limited set of third-party providers may set, read or receive information through cookies and similar technologies where necessary and permitted.

Google, analytics and tags. Google Analytics 4, in two properties under different regimes, Google Tag Manager and Google Consent Mode v2, as described in section 3. The list of technical identifiers is in the Tracking technologies inventory, in the help center.

Google AdMob. Advertising in the mobile apps, including ad-funded reward flows.

Advertising mediation partners. To fill ad slots in the app, Google AdMob may call mediation partners. The partners currently integrated are Unity Ads and Liftoff Monetize, also known as Vungle. They may process device and advertising identifiers under their own policies and according to your consent state.

MapTiler. Used to display maps in local discovery. When you open a map or search for a place, MapTiler receives the map requests needed, which may include approximate coordinates and the search term.

Firebase Cloud Messaging. Used to deliver push notifications when you allow notifications. This involves a device push token.

IP geolocation provider. Used only to enrich security and anti-fraud signals with approximate country, region and city from the IP address. We currently use ip-api.com. City, region and coordinates derived this way are anonymized after 90 days.

Google and Apple Sign-In. Loaded or used when you choose to sign in with Google or Apple.

Payment, wallet, KYC and fraud providers. Used where payments, withdrawals, wallet verification, identity verification, sanctions screening or fraud prevention are necessary.

Infrastructure and security providers. Hosting, edge, cloud, logs, error monitoring, security and performance, including AWS and Cloudflare, the latter also as CDN and as storage for VISU Replay recordings.

Campaign, merchant, advertiser, referral and offerwall partners. Where necessary to operate campaigns, attribute referrals, validate rewards or prevent abuse.

VISU does not currently load social network advertising trackers such as Meta Pixel or TikTok Pixel. If that changes, we will update this Policy and, where required, ask for consent before activation.

The named and current list of sub-processors, with country of processing, is maintained in the Privacy Policy and in the international transfer materials referenced there.

9. Your choices and how to change them

You can manage cookie and tracking choices in several ways.

Consent banner. Where shown, the banner allows Accept all, Reject non-essential or Manage choices by category.

Management panel. The panel allows you to enable or disable Analytics and Advertising. Advertising remains disabled while a GPC or DNT signal is active.

Your Privacy Choices. The "Your Privacy Choices" link reopens the management panel and lets you update your choices at any time, including in the opt-out regimes where analytics and advertising start on.

Browser controls. You can block cookies, clear local storage, enable GPC, send DNT or use other browser privacy controls. Blocking some technologies may affect login, security, rewards, referrals or other features of the Service.

Mobile system controls. On iOS and Android, you can reset or limit advertising identifiers and adjust privacy settings in the operating system.

Closing or dismissing the cookie banner is treated as a rejection of non-essential technologies. It is never treated as silent acceptance of analytics or advertising.

10. Records of your consent

When you are logged in, VISU keeps a timestamped server-side record of your cookie and tracking choices. This may include selected categories, region, country, GPC and DNT state, policy version, schema version, source of the choice, IP address, user agent and the client choice time and server write time.

These records are append-only and used as evidence of consent, compliance, security and support. You may request information about your consent records at [email protected].

If you made a choice before server-side consent records were introduced, your choice may exist only in your browser or device until it is synced by a compatible login or a future consent action.

11. Retention and updating of your choices

Validity of the choice: 365 days. A consent record is treated as valid for 365 days. After that period, the choice is treated as unanswered and we ask you to choose again. That period is the validity of the choice, not the deletion of the record: the record itself is retained as evidence.

Consent records and related technical signals are kept for as long as reasonably necessary to evidence your choices, operate the Service, comply with legal obligations, prevent fraud and resolve disputes. We may shorten, truncate, anonymize or aggregate some technical signals, such as IP address or user agent, where appropriate.

We ask you to choose again when the record reaches 365 days. Material changes to this Policy are announced in the banner and in the Service.

12. Children and minors

VISU is intended for users aged 18 or over. We do not intentionally use cookies or tracking technologies to track minors. If you believe a minor created an account, or that we are processing cookie or tracking data belonging to a minor, contact [email protected] and we will take appropriate steps.

13. Changes to this Policy

We may update this Policy from time to time. Minor changes take effect when published.

For material changes to purposes, categories, providers or the way consent works, we will present a new notice and, where required, ask you to choose again.

Each version is dated and versioned. The active version is available on this page.

14. Contact

Questions about cookies, tracking or your choices: [email protected]

VISU Network Ltda. CNPJ 54.954.885/0001-97. Balneário Camboriú/SC, Brazil.

Version 2.0 · Effective September 4, 2026