Privacy Policy
Last updated:
Draft under legal review. Highlighted items depend on information from the company and will be filled in before the pilot launches. The Portuguese version prevails.
Who is the controller
Data processed on this site is the responsibility of company legal name, CNPJ CNPJ, headquartered at address (“SomosPoints”).
Privacy contact and data protection officer (DPO): DPO name, contact email.
What data we collect
The email you enter on the waitlist, the page language, the date of your consent and the version of this policy shown at that moment.
When you submit the form we also process your IP address and technical browser signals, only for security (bot check and attempt limiting). We do not write the IP to our database; it stays for a few minutes in the attempt-limiting service.
We use no tracking cookies and no advertising or usage-analytics tools. We use a single functional cookie (NEXT_LOCALE) that remembers your chosen language.
What we use it for and legal basis
Purpose: solely to tell you about the SomosPoints pilot (a place, an invitation and news). We do not use the email for other purposes, and we do not sell or share it for third-party marketing.
Legal basis: your consent (LGPD, art. 7, I), given by ticking the box on the form. You may refuse; in that case we cannot add you to the list, and no other right of yours is affected.
Who we share it with
We use providers that process data on our behalf and only for that purpose: Supabase (database), Vercel (hosting), Cloudflare Turnstile (bot check), Upstash (attempt limiting) and Sentry (error monitoring, configured not to send form content).
We do not share your data with other companies, except where required by law or court order.
International transfer
Some of these providers, such as Cloudflare and Sentry, may process data outside Brazil, including in the United States. The application is hosted in the São Paulo region. The company must confirm the regions of the database and of the attempt-limiting service.
These transfers rely on LGPD art. 33 mechanism, to be confirmed by the company, for example the providers' contractual clauses.
How we protect it
The email is stored encrypted (AES-256-GCM). To avoid duplicate sign-ups we also keep a code derived from the email using a secret key (pseudonymisation). That code is still personal data and gets the same protection.
Access to the database is restricted to the site's server, and connections use HTTPS.
How long we keep it
We keep your email on the list until retention period to be set by the company, for example 6 months after the pilot ends or until you ask for deletion, whichever comes first. After that, the email is erased.
Your rights
At any time and free of charge (LGPD, art. 18), you may: confirm whether we process your data; access it; correct it; request anonymisation, blocking or deletion; request portability; know who we share it with; know the consequences of not consenting; and withdraw your consent.
Withdrawing consent is as easy as giving it: write to contact email and we erase your data. We reply within 15 days (LGPD, art. 19).
You may also file a complaint with the Brazilian data protection authority (ANPD).
Children and teenagers
SomosPoints is intended for people who are 18 or older; the company must confirm. We do not knowingly collect data from minors.
Changes to this policy
If we change this policy materially, we update the date above and, where needed, ask for consent again.