Privacy policy

This translation is provided for convenience. The Portuguese version is the legally binding one: read it in Portuguese.

Summary: we use your data to create and maintain your account, charge the monthly fee, process our customers' sales, prevent fraud and comply with the law. We do not sell data and we do not use our customers' buyers' data for our own advertising. Full card details are never stored here. To exercise your rights, write to [email protected].

1. Who this policy applies to

• Visitor: anyone browsing recebbe.com.br.
• Seller: anyone who creates an account to sell through Recebbe.
• Buyer: anyone who pays through the payment page of one of our sellers.

2. Who decides about the data

• Recebbe is the controller (operated by Carbono Tecnologia & Instituição de Pagamento Ltda, CNPJ 30.037.007/0001-49, Rua José Vedovatto, 2010, Sala 01, Jardim Bom Retiro, Sumaré/SP, Brazil) of visitor and seller data: sign-up, monthly fee billing, platform security and compliance with legal obligations.
• Recebbe is the processor of buyer data: it processes that data on behalf of the seller, who is the controller of the sale. Recebbe creates the charge, records the order, sends the order emails and notifies the seller's systems.
• Recebbe becomes the controller again, even for purchase data, for the platform's own purposes: fraud prevention, security, record keeping required by law and defense in legal proceedings.

3. What data we collect

• Visitor: technical access data (IP address, browser, operating system, pages viewed), the theme preference saved in your browser and, when you arrive through a referral link, the referrer's code.
• Seller: name, email, CPF or CNPJ, password (stored only as a cryptographic hash), company details, monthly fee billing details and dashboard usage records.
• Referral program participants: CNPJ (Brazilian company tax ID), company name, PIX key and the service invoice (XML and PDF) sent to receive each payout.
• Buyer: name, email, CPF or CNPJ, phone, address when the seller requires it, order data (product, offer, amounts, payment method, status) and, for cards, only the brand and the first and last digits.
• Security and fraud prevention: IP address, device, approximate location based on IP and attempt history.
• Visit source: campaign parameters in the link (utm_source, utm_medium, utm_campaign, utm_content, utm_term, src and sck).

Full card details (number, expiry date and security code) go encrypted straight to the payment gateway and are not stored by Recebbe.

4. What we use it for and on what legal basis

• Creating and maintaining the account, providing access to the dashboard and charging the monthly fee: performance of a contract (art. 7, V, of the LGPD).
• Processing the seller's sale, creating the charge and sending the order emails: performance of the contract between buyer and seller, with Recebbe as processor.
• Asking for a purchase review: a few days after an approved purchase, the seller may send the buyer, through Recebbe, an invitation to review the product. Answering is optional. The review (rating, comment and the display name the buyer chooses) only appears on the seller's checkout if the seller approves it, never with email, CPF or other contact details: legitimate interest of the seller, and the buyer may request removal at any time.
• Preventing fraud and protecting the platform, sellers and buyers: legitimate interest (art. 7, IX).
• Keeping access records and tax data: legal obligation (art. 7, II), such as Brazil's Civil Rights Framework for the Internet (Marco Civil da Internet) and tax legislation.
• Paying commission to referrers: performance of the referral program contract.
• Sending service notices (plan changes, outages, relevant news): legitimate interest, with an unsubscribe link in emails that are not essential.
• Responding to complaints and legal proceedings: regular exercise of rights (art. 7, VI).

Recebbe does not sell your data and does not use it for its own advertising.

5. Who we share it with

• The seller's payment gateway (such as Asaas or CarbonoPay), card networks and banks: to process and confirm the payment.
• Seller: receives the order data of their buyers, and may send it to their own systems through integrations they have set up.
• Recebbe's suppliers: hosting, database and file storage (DigitalOcean, with servers in the United States) and email delivery (Resend), always under contract and only to provide the service. For this reason, part of the data is processed outside Brazil, with the LGPD safeguards for international transfers.
• Authorities: when there is a legal obligation or a court order.

6. Transfers outside Brazil

Some infrastructure and email delivery suppliers may store data on servers outside Brazil. In those cases, the transfer follows art. 33 of the LGPD, with suppliers that adopt adequate protection standards and contractual clauses.

7. How long we keep it

• Access records (IP, date and time): at least 6 months, as required by Brazil's Civil Rights Framework for the Internet.
• Seller account: for as long as the account exists. After closure, 30 days for export and then deletion or anonymization.
• Order and payment data: generally up to 5 years after the purchase, due to legal, tax and consumer protection obligations.
• Referral program invoices: 5 years, for tax obligations.
• Theme preference and referral code: stored in your browser for up to 1 year and 60 days, respectively.

8. How we protect it

Encrypted connection (HTTPS) on every page, passwords stored only as a cryptographic hash, encrypted gateway keys (AES-256-GCM), role-based access, logging of sensitive operations and monitoring of abnormal behavior. Full card details are never stored by Recebbe.

9. Your rights

Under the LGPD (art. 18), you may request confirmation of and access to your data, correction, anonymization, blocking or deletion of data that is unnecessary or processed in breach of the law, portability, information about sharing, withdrawal of consent, objection to processing based on legitimate interest and review of automated decisions.

If you are a buyer, the fastest route is usually the seller's support, since the seller is the controller of that sale; we handle what is our responsibility and forward the rest. We reply within 15 days. Some data may remain stored when the law requires it. If you are not satisfied, you may file a complaint with Brazil's National Data Protection Authority (ANPD).

10. Cookies and browser storage

This site does not use advertising cookies and has no third-party trackers. We only use what is necessary: the theme preference (light or dark) and the referral code, when you arrive through a referral link. The payment page stores the link's campaign parameters only for the session, and loads a Meta pixel or Google tag only when the seller of that checkout has set one up.

11. Minors

Recebbe is for people aged 18 and over. We do not intentionally create accounts for or process data of children and teenagers.

12. Changes to this policy

This policy may be updated. The version in effect is always the one on this page, with the date at the top. Material changes are announced by email to account holders.

13. Contact and data protection officer

To exercise your rights or ask questions about privacy, write to Recebbe's data protection officer: [email protected]. See also the Terms of use and the Acceptable use policy.