Privacy Policy

Last updated: March 19, 2026

1. Controller Identification

[RAZAO_SOCIAL] ("GRIFFE", "we", "us") is the data controller responsible for your personal data in accordance with the Brazilian General Data Protection Law (LGPD — Lei 13.709/2018).

CNPJ: [CNPJ]

Address: [ENDERECO]

Data Protection Officer (Encarregado): [EMAIL_DPO]

2. Data We Collect

Account Data: Name, email address, username, profile picture (via Google OAuth or upload), password (hashed with bcrypt), and account role (buyer/producer).

Payment Data: Payment processing is handled exclusively by Pagar.me (PCI-DSS compliant). We do NOT store credit card numbers. We receive transaction confirmations, order amounts, and payment status.

Producer Data: For sellers — PIX bank account key for payouts, social media links, bio text, and uploaded audio content metadata.

Usage Data: Pages visited, packs viewed, search queries, download history, cart activity, and interaction events for platform improvement.

Technical Data: IP address, browser type and version, device information, operating system, and referral URLs.

Communication Data: Support ticket messages, email correspondence, and feedback submitted through the Platform.

3. Legal Basis for Processing (LGPD Art. 7)

Purpose	Legal Basis
Processing orders, delivering downloads	Contract execution
Account creation and authentication	Contract execution
Fraud prevention and security	Legitimate interest
Marketing emails and recommendations	Consent (opt-in)
Analytics cookies and platform improvement measurement	Consent (opt-in)
Tax records and compliance	Legal obligation
Responding to court orders	Legal obligation

4. Data Sharing

We share personal data only with the following categories of recipients:

Pagar.me: Payment processing (name, email, transaction data). PCI-DSS compliant.

Cloud Infrastructure: Data storage and hosting (encrypted at rest and in transit).

Analytics (PostHog): Usage analytics for platform improvement. Loaded only after you grant analytics consent — if you refuse, or later withdraw, no analytics script is initialised and no events are sent. Data is anonymized where possible.

Legal Authorities: When required by law, court order, or to protect our rights.

We do NOT sell, rent, or trade your personal data to third parties for marketing purposes.

5. Your Rights Under the LGPD

Under the LGPD (Arts. 17-22), you have the right to:

Confirmation — confirm whether your data is being processed
Access — obtain a copy of your personal data
Correction — correct inaccurate or incomplete data
Anonymization/Blocking/Deletion — request anonymization, blocking, or deletion of unnecessary or excessive data
Portability — transfer your data to another service provider
Information on Sharing — know which third parties have received your data
Consent Withdrawal — revoke consent at any time, without affecting prior processing
Opposition — object to processing based on legitimate interest if it violates the LGPD
Review of Automated Decisions — request human review of decisions made solely by automated processing

To exercise any of these rights, email [EMAIL_DPO]. We will respond within 15 days as required by law (LGPD Art. 18, §5).

If you are unsatisfied with our response, you may file a complaint with the National Data Protection Authority (ANPD) at www.gov.br/anpd.

6. Cookies

We use the following categories of cookies:

Category	Purpose	Legal Basis
Essential	Authentication, session management, security (CSRF)	Legitimate interest
Functional	Cookie preferences, language, theme	Legitimate interest
Analytics	Usage patterns, page views, feature adoption	Consent

Analytics cookies are set only after you accept them. The analytics script is not loaded at all until consent is granted, and withdrawing consent stops event capture immediately — no page reload required. Withdrawing consent does not affect platform functionality.

You may change or withdraw your consent at any time (LGPD Art. 18, IX):

7. Data Retention

Account data: Retained while your account is active. Deleted within 30 days of account closure, except as required by law.

Transaction records: Retained for 5 years for tax compliance (Lei 8.137/90).

Usage analytics: Anonymized after 24 months.

Support communications: Retained for 2 years after resolution.

Access logs: Retained for 6 months (Marco Civil da Internet, Art. 15).

8. International Data Transfers

Some of our service providers may process data outside of Brazil. In such cases, we ensure adequate safeguards are in place as required by the LGPD (Art. 33), including Standard Contractual Clauses approved by the ANPD and verification that the recipient provides an adequate level of data protection.

9. Security Measures

We implement industry-standard technical and organizational security measures including: encryption in transit (TLS/HTTPS), secure password hashing (bcrypt with salt rounds), role-based access controls (RBAC), rate limiting on API endpoints, and regular security reviews. Payment data is processed exclusively by Pagar.me under PCI-DSS compliance — we never store card details.

10. Data Breach Notification

In the event of a security incident that may result in significant risk or harm to data subjects, we will notify the ANPD and affected users within 3 business days, as required by the LGPD (Art. 48), including the nature of the breach, data affected, and remediation measures taken.

11. Children's Privacy

GRIFFE is not intended for users under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a minor without parental consent, we will delete it promptly.

12. Changes to This Policy

We may update this Privacy Policy periodically. Material changes will be communicated via email and/or a prominent notice on the Platform. The revision date at the top of this page will be updated. Continued use of the Platform after changes constitutes acceptance.

13. Contact

Data Protection Officer (Encarregado): [EMAIL_DPO]

Privacy inquiries: [EMAIL_PRIVACIDADE]

General support: [EMAIL_SAC]

You may also contact the ANPD: www.gov.br/anpd