Skip to content
afetovirtual
Legal

Privacy policy

Last updated: October 30, 2026. This policy explains how Afeto Virtual processes personal data, under Brazil's General Data Protection Law (LGPD, Law 13.709/2018).

1. Who is responsible

The controller of your data is the individual who runs Afeto Virtual, who also acts as the data protection officer (encarregado). Contact: gustavodev24@gmail.com or through the support page.

2. Data we process

  • Account: e-mail, name, language, the answers to the welcome questions (when given) and how the account was created (form, checkout or Google).
  • Gift content: everything you put in it: names, dates, city, photos, captions, letter, music, chapters and texts. It may include data about the person receiving it; you declare you may share it.
  • Payments: plan, amount, coupon, e-mail and status. Card data is entered with Stripe and never reaches us.
  • Creation steps: which steps of the editor a gift reached and when, its source link (if you arrived through one) and your opinion in the chat with Lumi.
  • Technical logs: date and time, requested address, IP address, browser and device, kept for up to 30 days.
  • Gift opens: date and an anonymous visitor identifier.
  • Anonymous measurements: clicks on the home page (position, screen width and device type, without identifying anyone), visits through tracked links (source, device type, time), people online at the moment (counted only while the page is open, nothing stored) and audience counts with a one-way pseudonymous marker (up to 366 days).
  • Support: the messages you send us.

3. Why, and on what legal basis

  • To provide the service you hired (contract, art. 7, V): create, save, publish and deliver the gift, sign-in, payment, receipts and service e-mails.
  • Security, fraud prevention and improving the service (legitimate interest, art. 7, IX): technical logs, creation steps, sources and anonymous measurements, used to fix problems, prevent abuse and understand where people get stuck.
  • Legal obligations (art. 7, II): keeping payment records as required by tax and consumer law, and answering lawful requests from authorities.
  • Consent (art. 7, I): news e-mails, only if you agreed; you can withdraw at any time.

4. Access by our team

Our administrators can access accounts, gift content (including photos and texts), orders and technical logs only when needed: support you asked for, security, fraud or payment problems, checking reports and enforcing the terms of use. Access is restricted to administrators and never used for any other purpose.

5. Who we share data with

We do not sell personal data. We use service providers that process data on our behalf, only for the purposes above:

  • Stripe: payments.
  • Brevo: sending e-mails (sign-in codes, receipts, notices).
  • Google: "Sign in with Google", when you choose it.
  • YouTube (Google): when a gift uses a YouTube song, its player loads from YouTube, which may collect data under Google's own policy.
  • Meta (Facebook/Instagram): the Meta Pixel measures visits and ads results using browsing data and cookies.
  • Hosting and database provider: where the site and data are stored.

Some of these providers are located or process data outside Brazil (for example, in the United States). These international transfers follow art. 33 of the LGPD, relying on the providers' contractual guarantees and data protection standards.

6. How long we keep data

  • Account and gifts: while they exist. When you delete a gift or your account, its content and files are erased.
  • Technical logs: up to 30 days. Audience markers: up to 366 days.
  • Payment records: for the period required by law, unlinked from the deleted account.
  • Measurements about creation (steps, times, sources, opinions): when a gift or account is deleted they are anonymized (the link to the person and any written text are removed) and kept only as statistics, which are no longer personal data (art. 12).

7. Your rights

Under art. 18 of the LGPD you may ask for: confirmation that we process your data; access; correction; anonymization, blocking or deletion of unnecessary data; portability; information about who we share with; withdrawal of consent; and objection to processing based on legitimate interest. Many of these can be done in your dashboard (edit, delete gifts, delete account); for the rest, contact us gustavodev24@gmail.com or through the support page. We answer within 15 days. You may also complain to the National Data Protection Authority (ANPD).

8. Cookies

See the cookie policy for the cookies we use and what for.

9. Security

Encrypted connections (HTTPS), password-free sign-in with a one-time code, restricted admin area and gift links that are not indexed by search engines. No system is 100% secure; if an incident may cause relevant harm, we will notify the ANPD and the people affected, as the law requires.

10. Age

The service is meant for people aged 18 or over. If you believe a minor has given us data, contact us and we will delete it.

11. Changes

We may update this policy; the date at the top shows the latest version. Relevant changes will be announced on the site or by e-mail.