Skip to content
Evo Play

Privacy policy

Last updated on 10/31/2026

This Policy explains how MM SOLUCOES ("we"), as data controller, processes personal data in the Evo Play application (also published as MMTV Plus, including the Roku channel) and on the website https://evoplay.tv, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD").

1. Controller and data protection officer

  • Controller: MM SOLUCOES, CNPJ 32.063.629/0001-77, [PREENCHER].
  • Data protection officer (DPO): [email protected].

2. Data we process

Device (application)

  • The MAC address generated by the application and a code derived from the TV identifier (we only keep a hash, not the identifier itself).
  • Platform, model, system version and application version.
  • IP address and date of last access.
  • Device key (stored encrypted) and an access token (we only keep a hash).
  • On iPhone and iPad: the MAC is generated from an app identifier on the device (we only keep a hash of it), and the app shows a device code (pairing code, stored encrypted) instead of the MAC and key. iOS crash reports reach us only through Apple, if you choose to share them with developers.
  • Chromecast on iPhone and iPad: this feature uses Google's Google Cast SDK, which collects a device identifier, diagnostic data and interaction data to work and for Google's statistics. This data does not reach us and is covered by Google's privacy policy.
  • On Roku (MMTV Plus channel): the MAC is generated from the channel identifier that Roku provides to the device (we only keep a hash of it). The channel does not use the Roku advertising identifier and does not send error reports.
  • Network Diagnostics (in Settings, in all apps): it only runs when you ask for it. The device connects directly to your playlist server, the last watched channel's server, MMTV servers and the servers of the speed test files (one from MMTV and one from Akamai, in Miami). All of them receive the device IP address. The result stays on the device: it is not sent to MMTV.
  • Error reports from the Android application, sent when the app closes unexpectedly: brand, model, system and application version, device memory and the technical log of the error. They do not include what you watch or your playlist credentials.
  • Diagnostic reports from the Android TV application, only if you turn on Diagnostic mode in Settings (it turns itself off after 24 hours): the network type, the name of the channel, movie or episode that did not open, the playlist server address (without username and password), that server's responses, the player error codes and a connection test run by the device. They are used only by support to find out why the video does not open.

Playlists

  • Playlist name, addresses (server, M3U, EPG or video links), Xtream username and password, and uploaded M3U files. Addresses, usernames and passwords are stored encrypted.
  • Playlist PIN, when you set one (we only keep a hash).
  • We do not access the content of the lists and we do not record what you watch.

Website

  • Contact form: name, email, subject, message and IP.
  • Security records: IP, browser, date and result of access attempts with MAC and key.
  • Payments: email, plan, amount and payment status. Card details are handled only by the payment provider.
  • Resellers: name, email, phone, company and tax ID (CPF/CNPJ).

3. Purposes and legal bases

  • Providing the Service (registering the TV, delivering your playlists, managing trial and activation). Legal basis: performance of a contract (art. 7, V).
  • Security and fraud prevention (attempt limits, audit logs, captcha). Legal basis: legitimate interest (art. 7, IX) and credit protection (art. 7, X).
  • Legal obligations (keeping access records for 6 months under the Brazilian Internet Civil Framework, and tax records). Legal basis: compliance with a legal obligation (art. 7, II).
  • Support (answering your messages). Legal basis: legitimate interest and performance of a contract.
  • Fixing application failures (error reports). Legal basis: legitimate interest (art. 7, IX).
  • Technical support (diagnostic reports). Legal basis: consent (art. 7, I), given when you turn on Diagnostic mode; turning the mode off stops the reports.
  • Optional cookies, if any are ever used. Legal basis: consent (art. 7, I).

4. Who we share data with

We do not sell personal data. We only share what is necessary with processors that help us provide the Service:

  • Hosting and infrastructure.
  • Google: Google Cast SDK (Chromecast), only in the iPhone and iPad app.
  • Cloudflare: security and captcha (Turnstile).
  • Mercado Pago: payment processing.
  • Email provider.
  • Public authorities, when legally required.

Some of these processors may handle data outside Brazil. In those cases, we adopt the safeguards of article 33 of the LGPD.

5. How long we keep data

  • Device data and playlists: while the device is in use. A deleted playlist is erased immediately, together with the uploaded file.
  • Access and security records: 6 months.
  • Payments: 5 years (tax obligations).
  • Contact messages: up to 2 years.
  • Application error reports: 90 days.
  • Diagnostic reports: 30 days.

6. Security

We use HTTPS, encryption of playlist credentials, hashing of keys, tokens and PINs, attempt limits, access control and audit logs. No measure is infallible. If a relevant incident occurs, we will notify you and the Brazilian data protection authority (ANPD), as required by law.

7. Your rights

At any time, you may request:

  • confirmation of and access to your data;
  • correction;
  • anonymization, blocking or deletion;
  • portability;
  • information about sharing;
  • withdrawal of consent.

These rights are set out in article 18 of the LGPD. Write to [email protected]. To confirm the device is yours, we may ask for its MAC and key (on iPhone and iPad, the device code in Settings > Device). You can delete your playlists at any time in the app or on the website; to also delete the device record, write to the same address. We reply within 15 days. You may also file a complaint with the ANPD.

8. Children and teenagers

The Service is not directed at people under 18. The application has PIN-based parental control for family use.

9. Changes

This Policy may be updated. The current version is always on this page, with the date of the last update.