Privacy Policy
1. Who processes your data
Lucrazo Company, CNPJ 61.928.317/0001-87, headquartered in Rio de Janeiro/RJ, Brazil, is the controller of personal data processed on this platform, under the General Data Protection Law (Law 13,709/2018 — LGPD). Contact for privacy matters: [email protected].
2. What data we collect
| Data | When | Purpose |
|---|---|---|
| Name, email, password (hash) | Account signup | Authentication and identification |
| Name, email, CPF/CNPJ | Checkout (even without an account) | Charge issuance and invoicing |
| Shipping address | Physical product purchase | Product shipping |
| Pix key | Creator/affiliate sets up receiving | Commission and sales payouts |
| IP address and user agent | Every browsing session/purchase | Fraud prevention, session security |
| UTM/traffic source | Traffic from a campaign | Understanding where sales came from |
| IP hasheado e localização aproximada (país/estado/cidade) | Toda visita à vitrine, página de produto ou busca | Medir número de acessos e sua distribuição geográfica, sem identificar o visitante |
| google_id | Login with Google | Alternative authentication (no password of your own) |
| Messages typed in chat | Use of AI support | Answering questions about orders/products |
We do not collect credit card data (the platform currently operates with Pix only) or sensitive data (health, biometrics, orientation, etc.), unless you freely type it yourself in open text fields, such as the support chat — in that case, avoid sharing unnecessary sensitive information.
3. Legal grounds for processing
- Contract performance (art. 7, V): checkout data, access delivery, commission payout.
- Compliance with legal/tax obligations (art. 7, II): order and payment data preserved even after account deletion.
- Legitimate interest (art. 7, IX): IP/user-agent for fraud prevention at checkout, with limited retention (see section 6).
- Legitimate interest (art. 7º, IX): medição de acessos e localização aproximada (país/estado/cidade) para estatística de audiência — IP nunca é guardado em texto legível, sempre um hash irreversível.
- Consent (art. 7, I): acceptance of the Terms at sign-up; advertising cookies (pixels), when enabled on a specific product.
4. Who we share data with
| Company | Role | What it receives |
|---|---|---|
| Asaas | Payment processing (Pix) | Name, email, CPF/CNPJ, purchase amount |
| Resend | Sending transactional emails | Email and name, notification content |
| Social login (OAuth) | Google account identifier, if you choose that login | |
| Anthropic | AI chat support | Messages typed in the support chat, if you use this channel |
| Meta (Facebook) / Google Ads | Conversion pixel* | Page visit, when enabled by the producer |
*Conversion pixels only load on specific products where the creator has enabled them; today they don't send name, email or CPF — only a visit/conversion signal for the page.
Using AI support involves international data transfer (art. 33 of the LGPD), since messages are processed by Anthropic's servers outside Brazil. Support does not receive your CPF or Pix key directly from our internal tools — but avoid typing sensitive data in the chat's free text.
We do not sell personal data to third parties.
5. Security
CPF/CNPJ and payout credentials are stored encrypted. Passwords are stored hashed (never in readable text). Access to payment data follows multi-layer verification before releasing any amount.
6. How long we keep your data
Order and payment data are kept for the period required by tax law, even if you delete your account. Browsing data used for fraud prevention (checkout IP/user-agent) has limited retention and is not kept indefinitely. When you delete your account, your identification data (name, email, CPF, Pix key) is anonymized — the financial history required for tax purposes is preserved without identifying you.
7. Your rights
As the data subject, you may request, under article 18 of the LGPD:
- Confirmation that we process your data, and access to it;
- Correction of incomplete, inaccurate or outdated data;
- Anonymization or deletion of unnecessary data, subject to the legal obligation to preserve financial transaction history;
- Portability of data to another provider, upon express request;
- Withdrawal of consent, when processing is based on it.
To exercise any of these rights, send a request to [email protected] from the email registered on your account.
8. Cookies
We use essential session cookies to keep you signed in — these don't require consent, since they're necessary for the site to work. When a creator enables conversion pixels (Facebook/Google) on a specific product, third-party advertising cookies may be set to measure the sale's origin — these are only loaded after you accept the cookie banner shown on your first visit. You can decline at any time; your choice is saved for 1 year in a dedicated cookie (lucrazo_cookies) and can be changed by clearing your browser's cookies.
9. Changes to this Policy
We may update this Policy periodically. Material changes will be reflected in the version shown at the top of this page.