Privacy Policy

1. Data Controller and DPO

LK Criações Web, trade name of 48.844.509 Lucas Mateus Lopes, Brazilian CNPJ 48.844.509/0001-47, is committed to protecting personal data in compliance with LGPD (Brazil), GDPR (EU), UK GDPR, and CCPA/CPRA (California).

LK Criações Web acts as Data Processor (LGPD Art. 5, VII / GDPR Art. 4(8)) for Client end-user data — processing it under Client instruction. For Client and visitor data, LK Criações Web acts as Data Controller. DPO: contato@lkcriacoesweb.com.br

2. Data We Collect

• Registration: name, email, password (bcrypt-hashed), phone (optional).
• Payment: processed by PCI-DSS gateways (Stripe, Asaas) — we never store full card numbers.
• Browsing: IP (SHA-256 hash), device, browser, referral URL.
• Geolocation: country/region via Cloudflare headers. Never precise GPS without consent.

3. Purposes and Legal Basis

We process data for: (a) service delivery (Art. 6(1)(b) GDPR / Art. 7-V LGPD); (b) fraud prevention (legitimate interest Art. 6(1)(f) / Art. 7-IX); (c) marketing with consent (Art. 6(1)(a) / Art. 7-I); (d) legal obligations (Art. 6(1)(c) / Art. 7-II). We never sell personal data.

4. Data Sharing

We share data only with:

• Payment gateways (Stripe, Asaas) — PCI-DSS certified.
• Email providers (Resend, Brevo) — transactional only.
• Hosting (Hetzner, Germany) — within EU/EEA.
• Analytics (PostHog) — IP anonymized.
• Error tracking (Sentry) — minimal data, no PII.
• AI providers (OpenAI, Google, Anthropic) — prompts only, no PII.
• Competent authorities — when required by law.

5. Your Rights

Depending on your jurisdiction (LGPD Art. 18, GDPR Chapter III, CCPA): access, rectification, erasure, portability, restriction, objection, withdrawal of consent. Contact: contato@lkcriacoesweb.com.br. Response within 15 business days (LGPD) or 30 days (GDPR/CCPA). Lodge complaints with your supervisory authority (ANPD, ICO, CNIL, BfDI, CPPA, etc.).

6. Retention, Security, and International Transfers

Active account data retained during account lifetime. Anonymized within 90 days after cancellation (except legal obligations — 5 years). Access logs: 6 months (Brazil Internet Act). We use TLS 1.2+, bcrypt, RBAC, 2FA, automated encrypted backups. Incident notification within legal timeframes (LGPD Art. 48; GDPR Art. 33: 72h).

International transfers: Stripe (EU-US DPF), Hetzner (EU), Resend/Brevo (SCCs), OpenAI/Anthropic (SCCs), PostHog (IP anonymized), Sentry (SCCs). No transfer without adequate safeguards.

7. Cookies and Children

See our Cookie Policy. The Platform is not directed at children under 13. Users aged 13–17 require parental consent (LGPD Art. 14 / GDPR Art. 8).

8. Supervisory Authorities

• Brazil: ANPD — gov.br/anpd
• EU: your Member State's data protection authority
• UK: ICO — ico.org.uk
• California: CPPA — cppa.ca.gov
• EU ODR: ec.europa.eu/consumers/odr