Privacy Policy

The data controller is Futanálises, the trade name of 69.126.725 CLEISON ALEXANDRE AZEVEDO PEREIRA, CNPJ 69.126.725/0001-27, with its registered office at Rua Herman, 249 — Jardim Julio, Barueri/SP, Brazil.

For anything concerning this policy — including exercising your rights — write to atendimento@futanalises.com. We reply within 15 days.

To create and maintain your account: name, full name, email, password (stored only as a cryptographic hash — we have no way to read it), and the date on which you accepted these documents.

To issue the tax document and process payment: tax ID (CPF), date of birth, phone and full address (postcode, street, number, complement, district, city and state). These are required by the payment institution and by tax law — without them we cannot charge you or issue an invoice.

For the product to work: the clubs you marked as your favourites, the insights you favourited and the region and language you chose.

Of the payment, we keep only the record: amount, method, date, status and — for cards — the last four digits. The full number, expiry date and CVV never pass through our servers: your browser sends them directly to the payment institution, which returns only an authorisation to us.

Access logs: we keep technical logs with IP address and the date/time of requests, as required by Brazil’s Internet Civil Framework (Law 12.965/2014, art. 15).

Performance of a contract (LGPD art. 7, V) for account, subscription and payment data — without them there is no way to provide the service.

Compliance with a legal obligation (art. 7, II) for tax data and access logs.

Legitimate interest (art. 7, IX) for payment-fraud prevention and for keeping the service secure and available.

We share the minimum necessary, and only with those who operate the service:

Efí (payment institution) — receives your name, tax ID, email, phone and billing address to process Pix and card payments. It is Efí that receives the card data directly from your browser.

Paddle (outside Brazil) — when the charge is in US dollars, Paddle acts as the authorised reseller and processes the payment, collecting your country’s taxes. It receives the data needed to charge you and issue the invoice.

Anti-fraud services — when you pay by card, the payment institution’s script triggers device verification (ClearSale and a related service). These services collect technical characteristics of your device to assess fraud risk. This happens only on the card payment screen.

ViaCEP — receives only the postcode you type, to fill in the address automatically. No other data of yours is sent.

Google — if you choose to sign in with your Google account, we receive your name, email and profile photo from Google. No password is shared.

Google Cloud — hosts the application and the database, on servers located in Brazil (São Paulo region).

We do not sell your data, we do not hand it over for advertising and we use no audience-tracking or profiling tools.

Account and subscription data: while the account exists and, after closure, for as long as needed to meet legal and tax obligations — five years for tax documents, under tax law.

Access logs: six months, as required by the Internet Civil Framework.

Product preferences (favourite club, favourites, language): deleted together with the account.

The LGPD (art. 18) guarantees you: confirmation that we process your data; access to it; correction of anything incomplete or out of date; anonymisation, blocking or deletion of anything unnecessary or excessive; portability; information on who we share it with; and withdrawal of consent.

To exercise any of them, write to atendimento@futanalises.com from your registered email. We ask for this to be sure it is you — granting an access request coming from a third party would be the opposite of protecting your data.

Some data cannot be deleted on request: that of an issued invoice and the access logs, which the law obliges us to keep for the periods above.

Traffic is always encrypted (HTTPS). Passwords are stored as a cryptographic hash with bcrypt. Database and provider credentials live in a secrets vault, never in the code. Administrative access is restricted and logged.

No system is impregnable. In the event of an incident with a relevant risk to your rights, we will notify you and the ANPD (Brazil’s data protection authority), under LGPD art. 48.

The service is intended for those aged 18 and over, and we do not knowingly collect data from minors. If we identify a minor’s registration, the account is closed and the data deleted.

We use only cookies necessary for operation. The detail of each one is in the Cookie Policy.

This policy may be updated. The date of the last change stays at the top, and material changes will be communicated by email. Previous versions remain available on request.

In the event of any discrepancy between translated versions, the Portuguese version prevails.