Privacy Policy

1. Information We Collect

We collect information you provide directly: name, email address, profile photo, and payment information when creating an account. We collect content you upload: photos, videos, and captions shared at events. We automatically collect: IP address, device type, browser information, usage patterns, and cookies. For guests, we collect the name they provide when joining an event and any media they upload.

2. How We Use Your Information

We use your information to provide, maintain, and improve our services; process payments and manage subscriptions; send transactional emails (event notifications, receipts, security alerts); display your content within events as configured by the host; enforce our terms of service and content moderation policies; analyze usage patterns to improve user experience; and communicate about new features and updates (with your consent).

3. Legal Basis for Processing (LGPD)

Under Brazil's LGPD, we process your data based on: Contract performance (providing services you requested); Consent (marketing communications, optional features); Legitimate interest (security, fraud prevention, service improvement); Legal obligation (tax records, regulatory compliance). You may withdraw consent at any time without affecting the lawfulness of processing based on consent before withdrawal.

4. Data Sharing & Third Parties

We share data with: Payment processors (Stripe, PIX providers) for transaction processing; Cloud infrastructure providers for data storage and processing; Email service providers for transactional communications; Analytics services for usage insights (anonymized). We do not sell your personal data. We require all third parties to respect the security of your data and process it in accordance with applicable laws.

5. Cookies & Tracking

We use essential cookies for authentication and session management. We use analytics cookies to understand how our service is used. You can control cookie preferences through your browser settings. Disabling essential cookies may prevent you from using some features of our service.

6. Data Retention

Account data is retained while your account is active and for 30 days after deletion. Event media is retained for the duration of your subscription plus 30 days. Payment records are retained for 5 years as required by Brazilian tax law. Audit logs are retained for 2 years for security purposes. You can request early deletion of your data at any time, subject to legal retention requirements.

7. Data Security

We implement industry-standard security measures including: encryption in transit (TLS 1.3) and at rest (AES-256); secure password hashing (bcrypt); rate limiting and brute-force protection; regular security audits; access controls and role-based permissions; PII encryption for sensitive personal data. While we strive to protect your data, no method of electronic transmission or storage is 100% secure.

8. Your Rights (LGPD)

Under the LGPD, you have the right to: Access your personal data; Correct inaccurate data; Delete your data (right to be forgotten); Port your data to another service; Revoke consent for data processing; Be informed about data sharing with third parties; Object to processing based on legitimate interest. To exercise these rights, contact our DPO at privacy@celebrar.me. We will respond within 15 business days.

9. Children's Privacy

Our services are not directed to children under 13. We do not knowingly collect personal data from children under 13. If you believe we have collected data from a child, please contact us immediately and we will delete it. Minors between 13 and 18 may use the service as event guests with parental consent.

10. International Data Transfers

Your data may be processed in countries outside Brazil where our service providers operate. We ensure that any international transfer of personal data is subject to appropriate safeguards as required by the LGPD, including standard contractual clauses and adequacy assessments.

11. Changes to This Policy

We may update this privacy policy from time to time. We will notify you of material changes via email or through the platform at least 30 days before they take effect. We encourage you to review this policy periodically.

12. Contact / DPO

For privacy-related inquiries or to exercise your data rights, contact our Data Protection Officer.

DPO / Email: privacy@celebrar.me