Privacy Policy
This policy explains, in plain language, what personal data we collect, what each piece is used for, and the rights you have — under Brazil's LGPD (Law 13.709/2018) and, for visitors in the EU, the GDPR.
1. Who we are
We operate the website opanije.com and a WooCommerce store. The data controller is Adson Vasconcelos dos Santos Junior — CNPJ 41.926.927/0001-34. For any privacy matter, contact us at [email protected].
2. Data we collect
- Orders and payments: name, email, billing/shipping address and order items when you buy from the store. Payment is processed by Stripe and PayPal; we do not store full card details on our servers.
- Paid-course sign-in and payment: to access the paid course, you sign in with your Google account. We receive your Google account's unique identifier (its "subject") and its email address; the identifier is stored linked to your course access, and the email address is used to create or match your account on this site. A first-party cookie tied to that sign-in is set during the process. Course payment is processed by Mercado Pago, in Brazilian reais (BRL); we do not store full card details on our servers.
- Course video playback: course videos are delivered through Cloudflare Stream, which issues a short-lived playback token for each video session you watch.
- Transactional email: your email is used to send order confirmations and service messages via Brevo.
- Site forms: when you fill in a form, we keep the email you give and, where the form asks, your name and message; also the form and page used, the language, the date and time, the record of your consent (which box you ticked and when), the campaign that first brought you here (
utm_source,utm_campaign), and a spam score. The score is computed by rules on our own site, with no artificial intelligence, and anything that looks suspicious is reviewed by a person. Messaging us on WhatsApp creates no record here. - Following up enquiries and unfinished purchases: so that nobody goes unanswered, we copy into our internal follow-up system your name, email, phone (if you gave one), your message, what you tried to buy and the amount, the purchase status, the dates, the page you came from and the record of your consent. We do not copy your address, payment data, Google account or campaign data. The system is used only so that a person on our team can answer you or help you finish the purchase you started: because of it, you are not added to any prospecting list, you receive no automated email, and your data does not go through artificial-intelligence tools. Testimonials sent for publication on the site do not go into this system.
- Usage analytics: audience metrics via Google Analytics 4, loaded only after your consent.
- Experience / support tools: Hotjar and Intercom load only with your consent.
- Security and delivery: Cloudflare provides CDN and security; technical server logs (including IP address) are generated to operate the site and prevent abuse.
3. Legal bases
- Performance of a contract: processing orders and payments (LGPD art. 7, V; GDPR art. 6(1)(b)).
- Consent: analytics cookies, marketing email, and site forms — the box you tick sets what we will use your contact for (LGPD art. 7, I; GDPR art. 6(1)(a)). You may withdraw consent at any time.
- Legitimate interests — unfinished purchases: if a purchase you started is not completed, a person on our team may write to help (LGPD art. 7, IX and art. 10; GDPR art. 6(1)(f)). If you do not want this, reply saying so and we will not write again.
- Legitimate interests: site security and fraud prevention (LGPD art. 10; GDPR art. 6(1)(f)).
- Legal obligation: keeping tax and accounting records (LGPD art. 7, II; GDPR art. 6(1)(c)).
4. We do not sell your data
We do not sell or rent personal data. We share data only with the processors needed to run the service: payment processors (Stripe, PayPal, Mercado Pago), sign-in provider (Google), video delivery (Cloudflare Stream), Google Classroom (the platform the free course is delivered through), email provider (Brevo), CDN/security (Cloudflare), and — only with consent — Google (Analytics), Hotjar and Intercom. The site and our follow-up system run on a server rented from Hetzner (hosting), located in the United States; Hetzner holds the data on our behalf and does not use it for its own purposes. Emails sent to our contact address pass through Cloudflare email routing to our inbox at Google (Gmail). Nothing in the follow-up system is passed on to third parties.
5. International transfers
Our server is in the United States, and some processors listed above are also outside Brazil. For people in the European Union, Brazil has held a European Commission adequacy decision since January 2026, and our hosting provider (Hetzner) handles data under a processing agreement that includes the EU standard contractual clauses. Under the LGPD, transfers needed to answer your enquiry or to carry out a purchase you asked for rely on art. 33, IX; in other cases we rely on the contractual safeguards the processor offers. To learn more, email us at the address below.
6. How long we keep your data
We keep order data for the period required by tax law; messages and contact details sent through the forms stay on the site for up to 24 months after submission and, in the follow-up system, up to 12 months after our last contact — whichever comes first removes the record; consent to receive updates lasts until you withdraw it; unfinished purchases leave the follow-up system after 90 days without a reply, and pending, failed or cancelled store orders are deleted after 90 days; encrypted backups are overwritten in their normal rotation; technical logs are kept for a limited period. A course purchase record that is started but not completed (an abandoned checkout) expires after 30 days: the checkout can no longer be paid, and the expired record is deleted the next time the same learner opens a checkout for the same course; until then, the record is retained. Once payment is confirmed, your course access record — linked to your Google account — is kept for as long as your lifetime access remains active, i.e. until it is revoked through a refund or a payment dispute, as described in the Terms of Service.
7. Your rights
Under LGPD (art. 18) and GDPR (arts. 15–22) you may request: confirmation and access, correction, anonymisation or deletion, portability, information about sharing, withdrawal of consent, and objection to processing. To exercise them, email [email protected]. You may also complain to a supervisory authority (in Brazil, the ANPD). We answer within 15 days. To protect you, we confirm the request from the email address on record. Deletion covers both the site and the follow-up system; we keep only an irreversible code derived from your email, so that we never contact you again. If you are in the European Union or the United Kingdom, you may also complain to your country's data protection authority (in the UK, the ICO).
8. Cookies
We describe the cookies we use and how to manage them in our Cookie Policy.
9. Children
The site is not directed to minors and we do not knowingly collect children's data.
10. Data protection officer (DPO) and contact
Privacy requests and DPO contact should be sent to [email protected].
11. Changes to this policy
We may update this policy; the version in force is always the one published on this page, bearing the effective date above.