Privacy Policy

1. Who is the controller

For merchant registration and account operation data, LumeaPag is the controller. For buyer data that appears in charges, the merchant decides the purpose of the sale and LumeaPag acts as a processor, handling that data to enable the payment and meet legal obligations.

2. Data we collect

• Registration: name or company name, tax ID (CPF or CNPJ), representative name, email, phone, address, type of operation, and estimated revenue and average ticket.
• Identity verification: ID document, selfie and, where applicable, company registration certificate.
• Financial: PIX key and payout details, transaction history, balance, fees and withdrawals.
• Buyer data in charges: name, email, tax ID or equivalent document, phone and, when provided, address.
• Technical: IP address, browser, device, access and API request logs, and session identifiers.

3. Why we use it and on what legal basis

• Performing the contract: creating and maintaining the account, processing charges, settling funds and calculating fees (LGPD art. 7, V).
• Legal and regulatory compliance: identity verification, anti-money-laundering and fraud prevention, and record keeping (art. 7, II).
• Legitimate interest: platform security, abuse and fraud prevention, support and service improvement (art. 7, IX).
• Consent: when you turn on optional features such as device notifications. You can withdraw it at any time (art. 7, I).

4. Who we share it with

We do not sell personal data. We share only what is necessary with:

• Partner payment institutions and acquirers, to create charges, confirm payments and settle funds.
• Infrastructure, hosting, security and email providers that work for us under contract.
• Tracking tools and integrations that the merchant turns on in their own account (for example marketing and e-commerce platforms).
• Public authorities and regulators, when required by law or court order.

5. Cookies and local storage

This marketing site does not use tracking or advertising cookies. In the platform dashboard we use only strictly necessary cookies and local storage for authentication, session security and remembering preferences such as light or dark theme.

6. How long we keep it

We keep data while the account is active and for the time needed to meet legal and regulatory obligations and to exercise legal rights. Technical logs are kept for a limited period and then removed.

7. Security

We apply technical and organizational measures proportionate to the risk, such as encryption in transit, encrypted storage of credentials, access control, two-step authentication for administrative operations and monitoring. No system is fully immune to incidents; in case of a relevant incident we will notify data subjects and Brazil's National Data Protection Authority as required by law.

8. Your rights

Under article 18 of the LGPD you may request:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• portability, where applicable;
• information about who we share your data with;
• withdrawal of consent and review of automated decisions.

9. International transfers

Part of the infrastructure we use may process data outside Brazil. In those cases we apply the safeguards the LGPD requires for international transfers.

10. Minors

The platform is intended for adults over 18 and for companies. We do not knowingly collect data from minors.

11. Changes to this Policy

We may update this Policy. The date at the top shows the current version and, for material changes, we will notify merchants through the platform.

12. Contact

To exercise your rights or ask privacy questions, contact us through the support channels listed in this site's footer with your name and the subject. We may ask for extra information to confirm your identity before handling the request.