Privacy policy (LGPD)

Data we collect

Email, phone number, KYC documents (ID card, driver's licence or passport, CPF, selfie), transaction history, IP address, user-agent, consent logs.

Legal basis (LGPD art. 7)

Explicit consent (sign-up), performance of a contract (transactions), legal obligation (KYC).

Your rights

• Full access: GET /api/me/export
• Correction: through the profile dashboard
• Deletion: DELETE /api/me — immediate soft-delete, permanent deletion within 30 days
• Portability: JSON dump via the export endpoint

DPO

Data Protection Officer: dpo@clubesecretto.com

Retention

KYC documents: 5 years after account deletion (legal obligation). Other data: deleted within 30 days of a deletion request.