Data and privacy (LGPD)

Who is responsible for your data

This policy covers the lotaloja.com website, the client area and the partner area. It follows Brazil’s General Data Protection Law (LGPD, Law 13,709/2018).

The data controller is Lotaloja Tecnologia e Marketing Ltda, Brazilian company ID (CNPJ) 69.859.163/0001-20, registered at SHN Quadra 2, Bloco F, Ed. Executive Tower, Asa Norte, Brasília, DF, 70702-906, Brazil.

The data protection officer is Felipe Gomes. To reach him, use the button below, which opens an email to the team.

Email the data protection officer

What data we use, why, and on what legal basis

Every use of data needs a legal basis (LGPD, article 7). We use four: consent (you authorized it), performance of a contract (the data is needed to do what you asked for or hired), legitimate interest (the use is needed for the site and service to work, respecting your rights) and legal obligation (the law requires us to keep it).

Visiting the website

Data: IP address, browser, device, pages opened and time, logged by the hosting provider.
Why: keep the site running, prevent attacks and fix errors.
Legal basis: legitimate interest. Where the law requires access logs to be kept, legal obligation.

Usage measurement (Google Analytics 4)

Data: pages viewed, where the visit came from, clicks on contact, podcast and checkup, device type and approximate region, linked to a random ID stored in Google cookies.
Why: learn which pages help and which need work. We only look at totals. Google Analytics does not receive your name, email or phone.
Legal basis: legitimate interest. You can object by blocking these cookies, as explained on the Cookies page.
Google Analytics loads only after your first interaction with the page (scrolling, tapping or typing) or a few seconds after it finishes loading.

Google sign-in and portal use

Data: the verified email of your Google account and the basic profile data Google sends at sign-in, plus access logs and connected devices.
Why: identify your account and control access to proposals, materials, opportunities and authorized visits.
Legal basis: performance of a contract, or steps taken at your request before a contract.
Sign-in does not give Lotaloja access to your password, inbox, contacts or Google files. This data is not sent to AI models.

Free checkup

Data: your questionnaire answers, including the sentence you write.
Why: write your result. The checkup is in the client area, with Google sign-in. Your answers are sent to Anthropic (the Claude model) only to write the result. Your name, email and WhatsApp are not sent. The result is saved in your area, and you decide whether to share it.
Legal basis: steps taken at your request before a contract.
In the free-text sentence, do not write health data, ID numbers or other people’s data.

Checkup or proposal requests in the portal

Data: the business name, contact and goal you provide.
Why: send the request to the team or the partner in charge and prepare the proposal.
Legal basis: steps taken at your request before a contract.

Partner link

Data: the code of the partner who introduced Lotaloja to you.
Why: know who made the introduction and pay the right partner. The portal keeps the partner link in a 90-day cookie and connects it to your account after checking the partner. If you ask, the site also remembers the code in this browser for up to 90 days. The partner link does not give access to private documents.
Legal basis: legitimate interest. The browser reminder depends on your consent, and you can delete it at any time with the “Remove saved partner link” button in the footer.

Contact by email

Data: your email address and whatever you write.
Why: reply to your message.
Legal basis: legitimate interest, or steps taken at your request before a contract.
Signing in, taking the checkup or emailing us does not authorize marketing campaigns.

Contracted services

Data: the contact and billing details of the client and the materials agreed in the contract.
Why: deliver the service, bill and issue invoices.
Legal basis: performance of a contract. For invoices and accounting records, legal obligation.
When the service involves your customers’ data, as with WhatsApp replies, your business is the controller of that data, and Lotaloja processes it only as the contract provides. Any AI review of your materials tells you beforehand which data will be used, why and by which providers.

Preferences saved on your device

Your browser stores the light or dark theme you chose and the podcast position, so you can resume where you stopped. The audio is downloaded from our server only when you press play. These preferences stay on your device and are not sent to Lotaloja.

Who we share data with

We do not sell personal data. We share it only with providers that work for Lotaloja (called processors under the law), each for one task:

Google: portal sign-in and usage measurement (Google Analytics 4).
Cloudflare: points the lotaloja.com address to the site (DNS), runs the technical infrastructure and stores the portal’s data.
Hostinger: website hosting.
Anthropic: writes the free checkup result with the Claude model, from your answers, without your name, email or WhatsApp.

The partner in charge receives the details of the request you sent to them. We also hand data to authorities when the law or a court order requires it.

Transfers outside Brazil

Google, Cloudflare and Anthropic are US companies and may process data outside Brazil. Hostinger may also use servers in other countries. These transfers follow article 33 of the LGPD, with the contractual data protection safeguards these providers offer.

How long we keep data

A portal session expires after 8 hours.
Temporary sign-in records, including sign-in attempts, are deleted in the automatic cleanup after they expire.
Portal audit logs enter that cleanup after 90 days.
The partner link is kept for 90 days in the portal cookie and, if you ask, in the browser reminder.
Your account, links, opportunities and checkup result are kept while your relationship with Lotaloja lasts, or until you ask for deletion.
Contracts, invoices and billing records are kept for as long as tax and accounting law requires.
Google Analytics cookies last up to 2 years in your browser, unless you delete them first.

A proposal’s access deadline does not mean all account data is deleted on that date.

Your rights

Under the LGPD (article 18), you can ask at any time for:

confirmation that we process your data, and access to it;
correction of incomplete, wrong or outdated data;
anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
portability of your data to another provider;
deletion of data processed with your consent;
information about who we share your data with;
information about your option not to consent and what happens if you do not;
withdrawal of consent;
objection to a use based on legitimate interest that does not follow the law;
review of decisions made solely by automated means (article 20). The checkup result is a suggestion written by AI, and you can ask the team to review it.

How to ask

Write to us with the button on this page. The team confirms your identity before acting. Requests for confirmation and access are answered within 15 days, as article 19 provides. Deletion requests are assessed within 30 days, taking legal obligations and required records into account.

In the portal, you can also use “Sign out” or “Connected devices” to end sessions. If you are not satisfied with our answer, you can complain to Brazil’s National Data Protection Authority (ANPD).

Email the data protection officer

Security

Sign-in is handled by Google, and Lotaloja never receives or stores your password. The site and the portal use an encrypted connection (HTTPS). Sessions expire after 8 hours, each person sees only what was released to them, and access is logged for auditing.

If an incident could cause significant risk or harm, we notify the ANPD and the people affected, as article 48 of the LGPD requires. Do not send passwords, bank details or other people’s sensitive data by email or through the checkup.

Children and teenagers

The site and services are meant for adults and businesses. We do not knowingly collect data from anyone under 18. If we learn we received a child’s data without consent from a parent or guardian, we delete it.

Changes to this policy

Online payment: plans and the review are paid on the Asaas page (Asaas Gestão Financeira, a payment institution authorized by Brazil’s Central Bank). Card details are typed straight into Asaas; Lotaloja never sees or stores the card number. Asaas sends us your name, email, tax ID and the payment status, so we can start the service and issue the invoice. When something changes, we update this page and the date at the top.

See also the Terms of use and the Cookies page.