Privacy Policy
This policy explains, in plain language, what personal data we collect, what each piece is used for, and the rights you have — under Brazil's LGPD (Law 13.709/2018) and, for visitors in the EU, the GDPR.
1. Who we are
We operate the website opanije.com and a WooCommerce store. The data controller is Adson Vasconcelos dos Santos Junior — CNPJ 41.926.927/0001-34. For any privacy matter, contact us at [email protected].
2. Data we collect
- Orders and payments: name, email, billing/shipping address and order items when you buy from the store. Payment is processed by Stripe and PayPal; we do not store full card details on our servers.
- Paid-course sign-in and payment: to access the paid course, you sign in with your Google account. We receive and store the unique identifier for your Google account (its "subject") linked to your course access; a first-party cookie tied to that sign-in is set during the process. Course payment is processed by Mercado Pago, in Brazilian reais (BRL); we do not store full card details on our servers.
- Course video playback: course videos are delivered through Cloudflare Stream, which issues a short-lived playback token for each video session you watch.
- Transactional email: your email is used to send order confirmations and service messages via Brevo.
- Lead capture: when you opt in to receive content or reach us on WhatsApp, we record, on the basis of your consent: funnel, page, locale, consent basis and consent timestamp, plus the email you provide. These records are stored on our own site.
- Usage analytics: audience metrics via Google Analytics 4, loaded only after your consent.
- Experience / support tools: Hotjar and Intercom load only with your consent.
- Security and delivery: Cloudflare provides CDN and security; technical server logs (including IP address) are generated to operate the site and prevent abuse.
3. Legal bases
- Performance of a contract: processing orders and payments (LGPD art. 7, V; GDPR art. 6(1)(b)).
- Consent: analytics cookies, marketing email, and email/WhatsApp capture (LGPD art. 7, I; GDPR art. 6(1)(a)). You may withdraw consent at any time.
- Legitimate interests: site security and fraud prevention (LGPD art. 10; GDPR art. 6(1)(f)).
- Legal obligation: keeping tax and accounting records (LGPD art. 7, II; GDPR art. 6(1)(c)).
4. We do not sell your data
We do not sell or rent personal data. We share data only with the processors needed to run the service: payment processors (Stripe, PayPal, Mercado Pago), sign-in provider (Google), video delivery (Cloudflare Stream), email provider (Brevo), CDN/security (Cloudflare), and — only with consent — Google (Analytics), Hotjar and Intercom.
5. International transfers
Some processors above are based outside Brazil and the EU. Where that happens, we rely on appropriate contractual safeguards (e.g. standard contractual clauses) to protect your data.
6. How long we keep your data
We keep order data for the period required by tax law; contact/marketing data is kept for as long as consent lasts or until you ask us to delete it; technical logs are kept for a limited period. A course purchase record that is started but not completed (an abandoned checkout) is automatically deleted after 30 days. Once payment is confirmed, your course access record — linked to your Google account — is kept for as long as your lifetime access remains active, i.e. until it is revoked through a refund or a payment dispute, as described in the Terms of Service.
7. Your rights
Under LGPD (art. 18) and GDPR (arts. 15–22) you may request: confirmation and access, correction, anonymisation or deletion, portability, information about sharing, withdrawal of consent, and objection to processing. To exercise them, email [email protected]. You may also complain to a supervisory authority (in Brazil, the ANPD).
8. Cookies
We describe the cookies we use and how to manage them in our Cookie Policy.
9. Children
The site is not directed to minors and we do not knowingly collect children's data.
10. Data protection officer (DPO) and contact
Privacy requests and DPO contact should be sent to [email protected].
11. Changes to this policy
We may update this policy; the version in force is always the one published on this page, bearing the effective date above.