Privacy Policy

1. Responsible organization and scope

1.1. The E-lemento platform is operated by E-Lemento Soluções em QR-Codes Ltda., CNPJ 37.806.846/0001-23, headquartered at Rua Cacaquera, 39, Sala C, Vila Antonina, São Paulo/SP, CEP 03412-030. Contact for questions and rights: info@e-lemento.com, subject “Privacy”. Do not send passwords or full card numbers.

1.2. This Policy applies to website visitors, customers, administrators, invited users, people accessing QR Codes, support requesters and assistant users where E-lemento carries out the processing. External destinations opened through QR Codes have their own responsible organizations and are not automatically covered by this Policy.

1.3. Privacy channel and data protection officer: requests are received through the channel in item 1.1. The officer’s identity and contact details, where appointment is required, shall be disclosed under applicable rules. Any statutory exemption from appointment does not remove the duty to assist data subjects.

2. Controller and processor roles

2.1. E-lemento normally acts as controller when determining purposes and means for registration, authentication, platform security, billing, customer relations, fraud prevention and its own marketing, where present.

2.2. For operations involving third-party content and data defined and entered by business Customers, E-lemento may act as processor under the Customer controller’s lawful documented instructions, within the actual operation and any DPA. Roles must be determined by activity, rather than by a blanket declaration.

2.3. When a Customer chooses to publish personal data in a public QR Code, they must identify their legal basis, purpose and transparency and assistance obligations; E-lemento remains responsible for processing under its control, security and its own obligations. Requests made directly to E-lemento about processing controlled by the Customer shall receive appropriate referral or guidance, without improper disclosure.

3. Categories, sources and purposes

3.1. Legal bases depend on the specific purposes and circumstances of each processing activity. Agreement with this Policy does not replace freely given, informed and unambiguous consent where that is the required basis.

3.2. Strictly necessary data shall be identified on forms; its absence may prevent a particular feature from working. For optional processing, refusal must not block features unrelated to the optional purpose.

3.3. Personal data may also be received from Account administrators, invited users, identity and payment providers, support recipients and integrated services, always according to the actual workflow.

4. Visitor data and QR Code statistics

4.1. Scanning a dynamic QR Code may generate a request to the redirect domain, including IP, date/time, resource identification, technical information and any campaign parameters. Processing supports delivery of the redirect, security and contracted statistics.

4.2. IP addresses, approximate location and online identifiers may constitute personal data, even when displayed to the Customer in aggregated form. Distinct identifiers do not ensure distinct people; the absence of identification by name does not imply irreversible anonymization.

4.3. Access to reports and data granularity shall be subject to Account permissions and operational need. E-lemento must apply data minimization and, where appropriate, information masking, distinguishing retention of raw events from retention of aggregated metrics.

4.4. The person responsible for campaigns or QR Codes displayed in physical locations may have their own duty to inform visitors about data collection and use, depending on the context.

5. Cookies, local storage and choices

5.1. We use cookies and local storage to maintain platform operation and security and remember your preferences. Analytics is optional: choose “Essential only” or “Allow analytics” and change your choice in “Cookie preferences”. Refusal does not prevent use of contracted features. Accepting the Terms or continuing to browse does not authorize this measurement.

5.2. When enabled and authorized, Google Analytics measures visits, content, purchasing steps and platform use. Measurement may involve standardized pages and events, language, campaigns, browser, device and pseudonymous identifiers. We do not treat this data as anonymous merely because it does not contain your name. Google Tag Manager, where used, manages tags according to the same choices; it does not authorize new pixels or purposes.

5.3. We do not include names, emails, card data, passwords, messages, QR Code content or customers’ private addresses in analytics parameters. The browser’s connection to Google transmits technical data, including IP. See how Google collects and processes this information through the links in this section.

5.4. With your specific permission and where this feature is enabled, server-side measurement may also consider confirmed registrations, QR Code creation and activation, issuance of download links, and confirmed purchases and refunds. It may include the value, currency and a pseudonymous transaction reference to avoid duplicate counting, without full card details or QR Code content. This is distinct from records necessary to provide the service, bill customers and comply with legal obligations.

5.5. When you withdraw permission, we stop new analytics submissions that depend on it. This does not automatically delete information already sent to Google or records retained under another legal basis. Cookie duration differs from retention of events and reports. You may also block or delete browser storage; this may end your session or remove preferences. Choices are specific to each browser and device.

5.6. Google reCAPTCHA is triggered for protected actions on login, registration, email verification and password recovery forms to assess connection and browser technical data and reduce abusive automation. It is used at those specific actions, but the cookie may remain in the browser after submitting or closing the form. This protection is distinct from audience analytics. Refusing analytics does not automatically disable security controls. The Google domain may involve other cookies depending on the browser context.

5.7. Analytics permission does not authorize personalized advertising or remarketing. Administrative report access uses a credential held only on the server and does not install additional cookies in your browser. For information about retention, sharing, transfers and your rights, use E-lemento’s privacy channel.

5.8. The inventory of Google analytics and security technologies and related preferences is available on this page and in “Cookie preferences”, showing the name, responsible party, purpose, category and known duration. Items depend on enabled features; the table distinguishes provider defaults from periods set by E-lemento. Storage duration on the device does not determine data retention in the services. Additional information about other features and their providers may be requested through the privacy channel.

5.9. In the Google Analytics configuration checked on October 31, 2026, retention is 2 months for event data and 14 months for user data. New activity resets the user data retention period. These controls do not limit most standard reports with aggregated data and do not correspond to cookie duration in the browser.

5.10. For reCAPTCHA protection, E-lemento is the personal data controller and Google acts as processor under the service terms and the Google Cloud data processing addendum. The purpose is to protect the platform against fraud, abuse and improper automated access.

6. Sharing, subprocessors and payments

6.1. Data may be made available on a limited basis to hosting, storage, protection and monitoring providers, authentication, email delivery, financial processing, support and AI providers only where contracted and necessary. Providers are bound by appropriate security and data protection conditions according to their roles.

6.2. Financial processing may involve Stripe for new purchases and PayPal for legacy contracts, according to the payment method actually made available and disclosed in the purchase flow. Full card details and security codes must not be sent through general forms, chat or support email.

6.3. E-lemento may comply with legal orders and valid requests from authorities within the limits of the law, applying minimization and challenges where appropriate. Merely using the Platform does not result in indiscriminate sale of personal data.

6.4. An operational provider record shall be maintained, including each provider’s legal name, country, service, data categories, role, data location, retention, subprocessor access and international transfer mechanism.

6.5. When analytics is enabled and authorized, Google may process analytics data to generate audience and usage reports. Security through reCAPTCHA and Google identity login have distinct purposes. The administrative report-query credential is not shared with the browser. Provider information: https://policies.google.com/technologies/partner-sites?hl=en and https://policies.google.com/privacy?hl=en.

7. International transfers

7.1. If data is accessed, stored or processed in another country in a context qualifying as an international transfer, E-lemento shall identify the operation, recipient and appropriate authorizing basis, applying safeguards under the LGPD and ANPD regulations, including Resolution CD/ANPD No. 19/2024 where relevant.

7.2. Merely using cloud services, accepting this notice or selecting an international provider does not replace the required transfer mechanism. Accessible information and instruments may be requested through the privacy channel under the law.

8. Artificial intelligence assistant

8.1. The assistant may answer questions and, depending on features actually enabled, help prepare, review and create QR Codes and open support tickets. For these purposes, messages and the necessary, authorized context of the selected Account may be sent to the AI provider actually enabled. Actions are linked to the authenticated user and subject to applicable permissions and confirmations, without authorization to access other accounts, change permissions or perform financial operations. Do not enter third-party information without a legal basis, passwords, tokens, card details or unnecessary sensitive data.

8.2. Normal assistant conversation history, where enabled, is displayed for up to 30 days, after which records cease to form part of ordinary history and usage context through soft deletion, subject to justified legal and operational needs. This period does not mean immediate physical deletion of backups, provider records or lawfully retained evidence; the specific periods for each layer must be made available upon request where applicable.

8.3. Information about AI providers actually used, countries involved, use of data for training, retention and relevant protections shall be provided in a manner consistent with the operations and applicable transparency obligations. E-lemento does not claim zero provider retention or an absolute prohibition on training without a verifiable contractual and technical basis.

8.4. Personal data in automated results must not be used in decisions with significant effects without assessing risks, controls and applicable rights, including information and review where required by the LGPD.

8.5. When an interaction results in a support ticket, only data necessary for support should form part of the ticket; the entire conversation shall not be transferred automatically. Ticket records follow support periods and purposes, distinct from ordinary assistant history. Interaction and assisted-action records may be used, to the extent necessary and with restricted access, to investigate abuse, unauthorized access and failures, subject to applicable legal bases and retention periods.

9. Children, teenagers and sensitive data

9.1. The Platform must not be used to openly publish sensitive data or data concerning children and teenagers without a specific legal basis, necessity and appropriate safeguards. E-lemento may block unsuitable content in justified circumstances, including to reduce risks to minors.

9.2. Where an operation involves children and teenagers, applicable statutory safeguards shall be observed, including Brazil’s Digital Child and Adolescent Statute (Law No. 15,211/2025), to the extent it applies to the services and features.

10. Storage, retention, disposal and backups

10.1. Data shall be retained for the period necessary for the purposes described, legal obligations, security and the regular exercise of rights, subject to necessity and transparency. There is no commitment to perpetual retention.

10.2. Where legally required, internet application access records are kept for the period under Brazil’s Internet Civil Framework (generally six months for an application provider subject to that obligation). Such records must not be confused with QR Code content or detailed statistics.

10.3. Tax and transaction data shall have retention periods appropriate to the respective obligation; personal data incident records shall be kept for the applicable regulatory minimum, including five years under Resolution CD/ANPD 15/2024, subject to any longer period necessary or ordered.

10.4. An operational table shall document actual retention periods for: registration and access, QR Codes and attachments, raw scan records, aggregated metrics, payments, support, chat/AI, audit logs, backups, soft deletions, data held by subprocessors and periods after closure. True anonymization must not be confused with reversible aggregation or pseudonymization.

10.5. The Customer may request export of their Account data within 15 calendar days after closure, through support and ownership verification, under the Terms of Use. This contractual period does not reduce personal data subjects’ rights, alter statutory retention periods or guarantee automatic physical deletion of backups.

10.6. Upon a legitimate request, data may be corrected, blocked, anonymized or deleted where appropriate. Mandatory or necessary retention shall be justified and segregated where reasonable; deletion from active systems and backups may follow a technically consistent and documented schedule.

10.7. The Google Analytics configuration checked on October 31, 2026 retains event data for 2 months and user data for 14 months, resetting the user data period with each new activity. These controls do not affect most standard reports with aggregated data. Cookie expiry and withdrawal of consent do not automatically delete data already processed. E-lemento must review these periods and this notice when changing the configuration; other records follow the purposes and retention criteria of this Policy.

11. Technical security and incidents

11.1. Administrative and technical security measures proportionate to risk and actually deployed are adopted, including access control, credential protection, logical segregation, records and monitoring according to controls actually implemented and documented. Zero risk is not guaranteed.

11.2. Administrators must limit guests, safeguard credentials and protect their devices. Incidents or suspicions may be reported to info@e-lemento.com.

11.3. Incidents that may pose a significant risk or harm to data subjects shall be assessed and reported by the legally responsible party to ANPD and data subjects where required, within regulatory deadlines; the general rule sets three business days for notification by the controller, subject to particularities and legally applicable differentiated rules. E-lemento, when acting as processor, shall cooperate promptly with the controller.

11.4. Notifications may be supplemented as the investigation progresses; incidents must be recorded and handled under applicable obligations. Contractual notification commitments between controller and processor should be detailed in the DPA.

12. Data subjects’ rights and assistance

12.1. Under the LGPD, a data subject may request confirmation of processing, access, correction, anonymization/blocking/deletion of unnecessary or unlawfully processed data, portability where regulated/applicable, information about sharing, consent and its consequences, withdrawal of consent, deletion of data processed on consent where appropriate, objection as provided by law and review of exclusively automated decisions affecting their interests.

12.2. Requests may be made to info@e-lemento.com, subject “Privacy”. Proportionate verification of identity and authority may be required, avoiding excessive data requests. Assistance with rights is free in the circumstances provided by law.

12.3. Confirmation and access in simplified form must be provided immediately where possible; a full statement shall comply with the statutory deadline, generally up to 15 days, subject to specific applicable provisions. Other rights shall follow regulatory deadlines, with reasons given for inability to comply or referral to the competent controller.

12.4. If E-lemento is the processor for the requested activity, it shall cooperate and identify the responsible controller where appropriate and permitted, without frustrating the data subject’s rights. Data subjects may refer matters to ANPD and competent bodies.

13. Marketing, transactional messages and communications

13.1. Messages concerning login, security verification, necessary contractual changes, invoices, risk warnings and support requests may form part of service provision under the relevant legal basis.

13.2. Advertising and newsletters, where used, shall observe their own legal basis, transparency, the opportunity to object and an effective unsubscribe mechanism where applicable. Essential features must not be conditional on optional marketing.

14. Account closure and data rights

14.1. The contractual period of 15 calendar days after closure concerns the opportunity to request export of technically exportable Account content lawfully belonging to the customer. Verification of identity and authority, format and delivery shall follow the Terms of Use and technical feasibility, without restricting personal data access and portability rights under the LGPD.

14.2. Expiry of this window does not authorize indefinite retention of personal data or rejection of valid data subject requests. Deletion, anonymization or retention shall follow the corresponding legal basis, including legally necessary records, tax obligations, security, rights in litigation and the documented backup cycle.

14.3. Commercial credits for QR Code downtime, support hours and B2B contractual limitations are governed by the Terms of Use. None of these conditions removes LGPD rights or changes the responsibilities of controller or processor.

15. Governance, data subject assistance and accountability

15.1. E-lemento shall seek to maintain records of processing operations, purposes, data categories, assessed legal bases, retention periods, recipients and process owners. Public disclosure of this Policy does not replace that internal record or a legitimate interest assessment where necessary.

15.2. Requests made by representatives require appropriate proof of authority, with minimal information collection. E-lemento may refuse clearly fraudulent requests or requests involving disclosure of other people’s data, giving reasons in accordance with the law.

15.3. When processing on behalf of a Customer controller, instructions that appear to violate the law may be questioned; E-lemento may suspend execution of the specific instruction where necessary to avoid illegality, informing the Customer where permitted.

15.4. Personal data protection includes data subjects without an Account, including QR Code recipients, published contacts and third parties identified in attachments, texts or prompts.

16. Minimization and specific protection when scanning QR Codes

16.1. QR Codes may direct visitors to destinations defined by Customers; as a rule, E-lemento does not validate the destination website’s privacy policy, security, legality or continuity. E-lemento is responsible for its own processing and legal obligations, without automatically becoming controller of every operation carried out at the destination.

16.2. Tracking parameters added by the Customer to URLs may enable identification and association of behavior. The Customer must observe purpose, transparency, legal basis and minimization when configuring them, especially in campaigns involving identified people, children or sensitive data.

16.3. Access to statistics by administrators and collaborators is conditional on Account permissions. Exports or sharing decided by the Customer may create responsibilities for the recipient, without releasing E-lemento from obligations concerning incidents under its control.

17. Protection, incident response and the provider chain

17.1. When an incident affects data processed on behalf of a Customer controller, E-lemento must cooperate with available information and notify the Customer within a time compatible with the risk and regulatory obligations, subject to the DPA’s operational conditions. There is no fictitious commitment to instantaneous detection.

17.2. Providers with access to data shall be assessed proportionately to risk, including access scope, confidentiality, security, incidents, subcontracting, retention and transfers. A contract does not eliminate liability assigned to E-lemento by law.

17.3. Technical measures may include, as actually implemented, access management, environment segregation, encryption in transit, backups, monitoring, protection against abuse and recovery procedures. Measures not implemented must not be advertised as active.

18. Data export and the distinction between contractual and LGPD rights

18.1. The 15-day window is a period for requesting an operational export of Account content after closure, rather than a deadline for responding to a personal data subject’s access right. That right remains enforceable under statutory conditions and exceptions even after the contractual window.

18.2. Where the Account has multiple users or third-party content, E-lemento may limit delivery to the authorized representative and necessary scope, with security mechanisms to prevent unauthorized access or compromise of trade secrets.

18.3. Contract termination does not mean instantaneous deletion of backups or records that must be retained for legal obligations, fraud prevention or defense of rights. Any residual processing shall have a defined purpose and restricted access.

19. Human review, AI and future changes

19.1. E-lemento does not promise accuracy, absence of bias or legal suitability of AI-generated content. Processing prompts and attachments must observe transparency, minimization and third-party rights. Where a material change concerns the provider, purpose, legal basis or retention conditions, relevant documentation and notices shall be updated before incompatible processing occurs.

19.2. This Policy does not authorize use of Customers’ personal data to train E-lemento’s own or third-party models outside disclosed purposes and legal bases. Such changes require their own legal assessment, transparency and consent where actually mandatory.

19.3. If new features involve exclusively automated decisions with significant effects, biometrics, precise geolocation, behavioral advertising or children and teenagers, E-lemento must assess legal bases, impacts and mechanisms for exercising rights in advance.

20. Disclosure, languages and version history

20.1. Material changes to this Policy shall be documented by version and date, with appropriate communication. Incompatible changes of purpose require assessment and new measures, including consent where required. The published version shall identify its effective date and maintain a history of material changes. Translations must preserve applicable rights.

20.2. Electronic messages accepting Terms of Use do not replace specific collection notices, granular consent where required or processing information that the LGPD requires to be made available.