Privacy Policy

How we collect, use, share and protect personal data

DISRUPTY TECNOLOGIA E SOLUÇÕES DIGITAIS LTDA. • International (English) version

Your privacy matters to us. It is Disrupty’s policy to respect your privacy regarding any information we may collect on the Disrupty website and any other sites and services we own and operate (the “Platform”). We ask for personal information only when we truly need it to provide a service to you, and we do so by fair and lawful means, with your knowledge and, where required, your consent. We also tell you why we are collecting it and how it will be used.

This Policy applies worldwide, to Brazilian and non-Brazilian users alike, and is designed to be compatible with applicable data-protection laws — including Brazil’s General Data Protection Law (LGPD, Law No. 13,709/2018), the EU/UK General Data Protection Regulation (GDPR) and other equivalent frameworks that may apply to you.

0. Quick guide for buyers

Bought from a store that uses Disrupty? Here is, in short, how we look after your information and what your rights are.

Why do you use my data?

We handle the payment for your purchase and support the store where you bought so it can keep you informed about your order (access release, tracking, etc.) and present new offers from that same store. Occasionally, we also send a short survey about your payment experience.

Do you cross my data with other stores?

No. The purchase history and behaviour recorded in one store stay restricted to that store and never feed offers from another store.

How do I exercise my rights?

Requests for information or deletion of data can be made by email to sac@disrupty.tec.br.

1. Who we are and the role of each party

1.1 This Policy is maintained by DISRUPTY TECNOLOGIA E SOLUÇÕES DIGITAIS LTDA. and its affiliates (“Disrupty”, “we”). For international operations, a Disrupty group entity may act as Merchant of Record for the relevant sales.

1.2 We are a technology platform for the sale of digital products (courses, e-books, mentorships and the like). We bring together, in one place, checkout, payment processing and routing (multi-acquirer), payouts (including via PIX), member area, sales recovery, funnels, automations over WhatsApp, e-mail and SMS, and an affiliate program.

1.3 Three actors take part: Disrupty; the Producer (and the Affiliate), who use the Platform to sell; and the Buyer, the consumer who purchases the products offered in the Producer’s stores.

How responsibilities over data are divided:

• As Processor — whenever we process a Buyer’s information solely following the orders and instructions of the Producer, in order to complete the payment and trigger that specific store’s communications (CRM).
• As Controller (alone or jointly) — when the processing serves our own purposes, such as combating fraud, keeping the Platform secure, meeting regulatory requirements, producing anonymized indicators, conducting institutional research about the checkout, or when the Buyer authorizes us directly (opt-in) at the payment screen.
• Producer and Affiliate data — regarding the registration, account and operation of these persons, Disrupty always acts as Controller.

1.5 Knowing our role helps direct each request to the right recipient. If a request concerns processing under the Producer’s responsibility, we will forward it or direct the data subject to the relevant Controller.

2. Who is covered by this Policy

2.1 This Policy applies to: Producers and Affiliates who contract and operate the Platform, checkout, member area and communications; Buyers, whose data we process by reason of purchases and messages sent; and visitors to our sites and channels.

2.2 Processing that each Producer carries out on its own account, on its own sites and systems, is not covered here — that follows the respective Producer’s policy. Our sites may also link to external sites we do not operate; we have no control over their content or practices and cannot accept responsibility for their privacy policies.

3. Personal data we collect

Depending on your relationship with us and the features you use, we may process the following categories:

3.1 Card data. We follow the PCI-DSS standard when handling cards. The CVV is never stored, and card numbers are protected by tokenization.

3.2 Aggregate indicators. Performance dashboards may include statistical cuts of audience, always in an aggregated and anonymized manner. Any individual display or discriminatory cross-referencing of profiles for the Producer is prohibited, with data minimization applied.

3.3 Minors. The Platform is intended for persons aged 18 or over, and we do not knowingly collect data of children or adolescents in the communications. If we identify improper processing, we will take steps to end it, in line with applicable law.

4. Why we process data and on what legal basis

Each use of data has a defined purpose and a legal basis under applicable data-protection law, as summarized below:

4.1 Legitimate interest. Whenever we rely on this basis, we carry out an assessment of the impact on the data subject’s rights (a Legitimate Interest Assessment) and adopt technical and contractual safeguards. You may request details of that assessment through the channels indicated in this Policy.

5. Segmentation, profiling and automation

5.1 Communications rely on profiling to define who should receive, and when, the most relevant offers of the Producer itself (for example, customers inactive for some time, or a likely repurchase window).

5.2 Respect for consumer expectations. Behaviour is read for the Producer’s marketing on a store-by-store basis, without mixing databases. Under no circumstances does what was bought in one store generate an automatic offer in another.

5.3 Artificial intelligence may be used only to refine the tone of messages, starting solely from the data strictly necessary to send them.

5.4 Automated decisions. The automatic sorting of communications is informational: it produces no legal effect on the Buyer and does not limit access to products. The data subject may request clarification about the criteria and, where applicable, review. The anti-fraud system examines transactions to approve or decline payments, always on the basis of security and fraud prevention.

6. Consent, opt-out and your controls

6.1 Every message sent through our tools carries a clear, direct way to decline further contact (opt-out). As soon as we receive the request, we remove the Buyer from the sending lists within the applicable period.

6.2 We keep a consultable history of each manifestation (opt-in and opt-out) by purpose, recording date, time and the version of the terms then applicable.

6.3 Consent given at checkout to receive exclusive Disrupty benefits may be withdrawn whenever you wish, as easily as it was granted — via the privacy e-mail or the unsubscribe links in the messages.

6.4 If the Buyer declines or exercises rights with the Producer (Controller), Disrupty will provide technical support, as Processor, to reflect that block in its own systems.

6.5 Your choice. You are free to refuse our request for personal information, understanding that we may then be unable to provide some of the services you want. Continued use of our site is considered acceptance of our practices around privacy and personal information.

7. Who we share data with

We do not publicly share personally identifiable information, and we share data only to the extent strictly necessary for the purposes of this Policy, or where required by law, with:

7.1 Disrupty does not sell personal data. We may combine databases and make them available in a fully anonymous, non-identifiable manner. We require all providers and sub-processors to maintain security and confidentiality levels aligned with applicable law.

8. International data transfers

8.1 Because we serve users in different countries and use infrastructure such as Meta (WhatsApp), pixels of companies based abroad and certain providers, and because international sales may involve a Merchant of Record and payout rails located outside your country, personal data may be transferred internationally.

8.2 In these cases, we apply the safeguards required by applicable law — in particular standard contractual clauses or another valid transfer mechanism — and always minimize the data sent.

9. Cookies and similar technologies

9.1 We use cookies and similar resources to keep sites and checkout working, store your preferences, measure audience and improve the experience:

9.2 Non-essential cookies only take effect after your consent, which can be adjusted in the cookie banner and in your browser settings. Disabling some of them may reduce certain functions.

9.3 Advertising partners and AdSense. Where we display advertising, third-party advertising services (such as Google AdSense) may use cookies (for example, the DoubleClick cookie) to serve more relevant ads across the web and to limit the number of times a given ad is shown to you. Behavioural-advertising cookies anonymously track interests to present relevant ads, and affiliate-tracking cookies allow us to see whether customers reached our site through a partner, so we can credit that partner appropriately. For more information about Google AdSense, please consult Google’s official privacy FAQs.

10. Data retention

10.1 We keep data only for as long as the purposes and the law require. Reference table:

10.2 Once the periods expire, we delete or anonymize the data, except where the law requires retention.

11. How we protect information

11.1 When we store data, we protect it within commercially acceptable means to prevent loss and theft, as well as unauthorized access, disclosure, copying, use or modification. We apply technical and organizational measures: encryption of sensitive data, tokenization of cards, restricted access under the least-privilege principle, continuous monitoring and the international payment-industry standards (PCI-DSS).

11.2 Producer environment. Disrupty is not responsible for the creation or security of the Producer’s virtual environment, nor for how the Producer’s customers access it. The Producer is solely responsible for installing and keeping updated the systems, devices and minimum security requirements needed to use our solutions.

11.3 In the event of a relevant security incident, we act in accordance with applicable law, notifying the competent authority and the data subjects whenever the law so requires.

12. Your rights and how to use them

Subject to applicable law, the data subject may request:

• Confirmation that processing exists and access to the data;
• Correction of incomplete, inaccurate or outdated information;
• Anonymization, blocking or deletion of unnecessary data or data processed outside the rules;
• Portability, subject to trade and industrial secrets;
• Deletion of data based on consent, except where the law requires retention;
• Information about sharing and about the possibility of not consenting;
• Withdrawal of consent and objection to processing based on legitimate interest.

Where to make each request, according to your role:

• Producer or Affiliate — many adjustments, registration corrections and data consultations can be made directly in your Disrupty account panel.
• Buyer, regarding purchase data — because the Producer is the Controller of the original transaction data, it is best to send deletion or portability requests to the Producer first. We provide all necessary operational support.
• Buyer, regarding Disrupty’s own offers — to withdraw consent for benefits or surveys selected at checkout, simply contact our privacy channel.

12.1 For any formal request, contact our team at sac@disrupty.tec.br. We may ask for some additional data solely to confirm your identity and protect you. The data subject may also lodge a complaint with the competent data-protection authority.

13. User commitment

The user undertakes to make appropriate use of the content and information that Disrupty offers, on an illustrative but non-limiting basis, and in particular:

• Not to engage in activities that are illegal or contrary to good faith and public order;
• Not to spread propaganda or content of a racist or xenophobic nature, games of chance, any type of illegal pornography, apology for terrorism, or content against human rights;
• Not to damage the physical (hardware) and logical (software) systems of Disrupty, its suppliers or third parties, nor to introduce or spread computer viruses or any other systems capable of causing such damage.

14. Updates to this Policy

14.1 This Policy may change from time to time, to keep up with changes in the law, in regulation or in the Platform’s own features. The version in force, with the corresponding date, will always be published on our official channels; changes that materially affect the processing purposes will be communicated by appropriate means.

14.2 Continuing to use the services after an update is published means you have taken notice of the new terms.

15. Governing law and jurisdiction

15.1 This Policy follows applicable data-protection legislation, including, as applicable, Brazil’s LGPD (Law No. 13,709/2018), the Brazilian Internet Civil Framework (Law No. 12,965/2014) and the Consumer Protection Code (Law No. 8,078/1990), as well as equivalent frameworks such as the GDPR for users to whom they apply.

15.2 For disputes connected to this document, the courts of the domicile of Disrupty are elected, without prejudice to the consumer’s right to the jurisdiction of their own domicile where the law so permits.

16. More information

We hope this is clear. If there is anything you are unsure about, it is usually safer to leave cookies enabled in case they interact with a feature you use on our site. If you have any questions about how we handle user data and personal information, please contact us at sac@disrupty.tec.br.

This Privacy Policy should be read together with the Disrupty Terms of Use and Content Policy.