MasterFinder Privacy Policy

Version: 3.2 Effective date: October 14, 2026 Translation: the Brazilian Portuguese policy is the reference version

1. Controller and contact

MasterFinder is provided by Caetano Hillesheim Sadosiuk, an individual located in Porto Alegre, Rio Grande do Sul, Brazil. For privacy or support matters, contact suporte@masterfindertool.com.

2. Scope

This policy explains how the MasterFinder Chrome extension processes data when a user signs in, checks an access decision, analyzes product pages, searches MasterShop candidates and suppliers, finds ads from a product, or organizes ads from the Meta Ads Library. Registration, email confirmation, password recovery, checkout, and subscription management take place only on the MasterFinder website and are also described in the website privacy policy.

3. Data processed

The extension may process:

• URLs, titles, descriptions, prices, images, variants, and other visible content from product pages chosen by the user;
• ads, text, creatives, destination URLs, identifiers, and responses shown or received by the Meta Ads Library;
• products, candidates, suppliers, profiles, and statistics returned by MasterShop;
• email, authentication tokens, and business context found in known fields of the active MasterShop session, only while necessary calls are made;
• MasterFinder account email, user identifier, and authentication session managed by Supabase, together with the access decision, renewal state, and the effective access deadline during payment recovery;
• sanitized title, description, category, and brand; normalized candidates; and normalized ad snapshots sent to the protected backend, including only an allowlisted CTA and a destination-derived category. An HTTP URL may be read transiently only to derive that category and is never stored, opened, or transmitted; MasterShop/Meta cookies, tokens, email, and business context remain excluded;
• at most two public HTTPS URLs (the product page and, when available, the Meta ad) sent by the backend to Google Gemini to generate terms and select MasterShop categories; if the product page cannot be read, an extracted and sanitized context of up to 6,000 characters may be sent in one final attempt;
• when the user pastes a direct MasterShop product link to prepare ad searches, the extension looks up its ID in the protected MasterFinder catalog using account authentication, receives matching products, and lets the user choose a country when there is more than one. Only the catalog product name and search language are sent by the backend to Google Gemini to generate a sequence of up to three directed queries. The MasterShop URL is sent separately to the MasterFinder backend for a permanent global mining count without an account link, but is not included in the Gemini payload; image, description, category, price, stock, supplier, cookies, and tokens are also not sent to Gemini in this flow;
• normalized HTTPS URLs used as the primary mining source (a product page or Meta ad), Meta ad contexts associated with products, direct MasterShop product URLs used in the Meta flow, and aggregate mining counts, without an account identifier or individual mining event;
• terms, categories, and filters actually used; unique or removed candidate counts; and, only when an enabled user chooses to submit feedback, the partial ratings selected by that user;
• extension preferences, consent, tab context, terms, results, audits, and workflow state;
• local transport and recovery checkpoints, including up to 15,000 ad IDs, hashes, or projections per explorer, temporary staged pages, and pending supplier tasks, without cookies, tokens, or headers;
• when a user chooses to save an ad group: sanitized ad projections, grouping-identity hashes, cumulative HTTPS creative-reference history, save and passive-match timestamps, and technical counts. Raw GraphQL/DOM payloads, search terms, cookies, tokens, headers, and media files are not stored;
• a sanitized technical diagnostic generated locally only when requested by the user;
• messages voluntarily sent to support.

The extension does not collect a name, phone number, Brazilian tax ID (CPF), address, card number, or CVC. When the user chooses to register, verify a mobile number, recover a password, view plans, or manage a subscription, the extension only opens a MasterFinder HTTPS page. During registration or a number change, the website sends the phone number to Twilio Verify and SMS/RCS delivery providers to prove possession; a protected HMAC of the number remains a hard trial key. While verification is pending, the website requires completion and the extension does not retain an operational session. CPF, address, and card details are processed in the web flow with Stripe; MasterFinder does not store raw CPF, PAN, CVC, or raw financial payloads.

WhatsApp is disabled and reserved for a future rollout disclosed before sending. A channel change does not require re-verifying an approved phone or unlock another trial. Only the requested channel is recorded; an SMS request may use RCS, without assuming the actual transport.

4. Purposes

The account data is used to authenticate the user, enforce the authoritative account_access decision, and disclose a payment-recovery deadline when applicable.

Data is used to perform user-requested actions: extract a product, generate semantic terms, select categories, and create directed ad searches with AI, search and rank candidates, retrieve supplier information, group ads, maintain a library synchronized across devices on the same account, hand a product between Meta and MasterShop workflows, restore tab state, and retain preferences. A saved ad is updated passively when a future collection by the same account encounters the same identifier or a compatible identity; this causes no additional navigation or Meta request. The backend validates accounts, access decisions, limits, minimum extension version, and the model's structured response, and performs deduplication, merging, ranking, and audit. Optional feedback is stored passively to guide future improvements; it never blocks terms, changes searches, trains agents, or modifies prompts automatically. MasterShop/Meta authentication data is used only for direct browser calls and is never sent to the MasterFinder backend or Google. The MasterFinder session authenticates only the protected API.

5. Consent and user control

On first use, the extension displays a disclosure and blocks extraction, search, enrichment, and collection until the current policy is accepted. The record contains the policy version and acceptance date. A later version may require renewed consent. Choosing “Not now” keeps those features blocked.

6. Storage and retention

Operational data may be held temporarily in memory, chrome.storage.session, and IndexedDB. If chrome.storage.session is unavailable, session contexts may fall back to chrome.storage.local. IndexedDB stores the tab's completed result, minimum recovery checkpoints, temporary staged pages, and supplier tasks that are still pending. Each Meta explorer keeps at most 15,000 confirmed IDs, hashes, or projections. Local contexts and payloads are deleted when the tab closes, leaves a supported URL, signs out, loses access, or its single active session is replaced. The extension creates no automatic local history; only groups selected by the user are published to the account library. Preferences and consent remain in chrome.storage.local. By default, the Supabase session stays in chrome.storage.session and ends when Chrome closes; if the user selects “Remember me,” it stays in chrome.storage.local until logout, replacement, reset, manual deletion, or uninstall. The password is never stored.

The library initially permits up to 50 groups, 32 logical MiB per account, and 8 MiB per group. When a limit is reached, existing content is preserved and new incorporation is suspended until items are removed. Each saved item and its history remain until explicit removal; removal immediately deletes its contributions, protected identities, and creative references. Hard account deletion cascades through the entire library. References point to external Meta media and may stop working if Meta removes, restricts, or changes the resource; MasterFinder keeps only the remaining metadata and does not retain a copy of the file.

MasterShop jobs collect for 5 minutes, drain for another 30 seconds, and allow finalization to begin until 10 minutes after creation; accepted computation may continue for up to 5 minutes, and all temporary result pages remain for up to 10 minutes after finalization. Meta segments last 5, 10, 15, 20, or 30 minutes as configured, drain for another 2 minutes, and allow finalization to begin until 10 minutes after collection; final snapshot pages remain for up to another 10 minutes. Sanitized products, candidates, occurrences, ads, and temporary backend projections are deleted after confirmed local persistence through DELETE, cancellation, or expiry. Technical failure tombstones may remain for 15 minutes without product or ad content. Term, category, and directed-search-plan responses may remain in a pseudonymized cache for up to 7 days. Technical AI generation audits, without raw product or query text, remain for up to 30 days, and daily usage counters for up to 35 days. The normalized primary-source URL — product page or Meta ad —, Meta ad contexts associated with products, direct MasterShop product URLs used in the Meta flow, their aggregate mining counts, and optional feedback are retained indefinitely to produce statistics and guide improvements. The two flows keep separate counters. These mining statistics never carry an account link or individual history. Upon hard account deletion, feedback loses the user, client IDs, and correlatable hashes, receives a new ID, and has its timestamp reduced to the UTC day; its URL, terms, categories, filters, and ratings remain anonymously. Identity, account, access decision, permissions, structured administrative events, and the minimal deletion ledger persist as needed to provide, protect, and control MasterFinder. Technical logs and metrics without payloads or content may retain request ID, pseudonymous identifier, endpoint, status, counts, bytes, and latency for up to 30 days.

Support diagnostic version 1.2 is generated only by user action, remains local until copied or downloaded, and is never transmitted automatically. It contains only version/environment, generic technical state, aggregate counts/bytes, up to 20 technical events, and up to ten sanitized flow incidents; it excludes identity, URLs, terms, products, ads, cookies, tokens, headers, and payloads. Support receives it only if the user chooses to share it. Voluntary support email and diagnostics may be retained for up to 90 days after resolution and then deleted unless retention is legally required.

For account and subscription flows, abandoned financial attempts are kept for up to 24 hours, raw local verification destinations are removed within 24 hours, and the profile and sessions are deleted upon the user's request. A minimal pseudonymous financial ledger may remain for 5 years; pseudonymous account, phone, CPF, and card trial claims remain for the duration of the trial program and are unlinked from account identity after deletion without making another trial available. Stripe, Twilio, and delivery providers also apply their own technical and required retention.

7. Sharing and transfers

On the website, Stripe processes payments and subscriptions, Twilio Verify with SMS/RCS delivery processes phone confirmation when it is active, Resend sends transactional email, and Cloudflare Turnstile protects registration and recovery flows.

The browser calls MasterShop, Meta/Facebook, and the user-authorized page directly. For protected access, we use Supabase for authentication and database services, Render to host the API, and the Google Gemini API as the processor that generates search terms, selects categories, and creates directed searches. Google receives only the public URLs and, when needed, the sanitized context or limited textual product fields described above, under the configured service and applicable terms. These providers may operate infrastructure in other countries under their terms and safeguards. We do not transmit data for analytics, advertising, sale, or unrelated purposes.

8. Practices we do not perform

MasterFinder does not sell personal data, use data for personalized advertising, run automated analytics or telemetry, contain ads, or load remote code. The API returns JSON data only, never JavaScript, DSLs, or executable commands. The hosted policy uses no cookies, trackers, scripts, fonts, or external resources.

9. Chrome permissions

Permissions are used only to copy requested content, inject packaged local scripts where needed, display the side panel, keep preferences and state, identify the correct tab, and access supported hosts or an HTTPS origin granted by the user. Optional access is requested only after a user action.

If Meta responds with rate limit 1675004, the extension uses the required cookies permission to automatically and locally remove only the first-party datr, dpr, ps_l, and ps_n cookies for the Facebook origin and cookie store associated with the affected tab. The extension does not query, copy, log, persist, or transmit those cookie values; it does not remove known authentication cookies, run “Clear site data,” or reload tabs. Removal starts together with a mandatory 15-minute cooldown, may affect other Facebook tabs in the same profile, and never runs preventively: only after response 1675004.

10. Security

We use message and data validation, tab/session/generation/job isolation, HTTPS-only stored, opened, or transmitted URLs, short-lived renewable Bearer tokens, access-decision checks on each operation, payload limits, automatic expiry, limited hosts and resources, and packaging without remote code. Supabase handles passwords, which we do not log. No system is completely infallible; report suspected incidents to the contact address.

11. Data subject rights

Users may request information, correction, or deletion, including their identity, account, access, and saved-ad library, as provided by applicable law. Each saved ad can be removed directly from the library; hard account deletion removes every saved item. Local data can be removed by signing out, resetting or uninstalling the extension, or clearing its data in Chrome. Requests may be sent to suporte@masterfindertool.com; minimal information may be requested to confirm and locate the request.

12. Changes

This policy may change to reflect product, legal, or security developments. The version and effective date will be updated. Material changes may require renewed acknowledgement inside the extension.