Privacy policy

1. Who is responsible

[razão social a definir / company name to be defined] ([CNPJ a definir / tax ID to be defined]), [endereço a definir / address to be defined], is the controller of the data processed on Manufatu. Privacy contact: privacidade@manufatu.com.

2. What data we process

Account: email, name, language and country. Account use: sessions, sign-in codes (stored only as hashes), consents.

Businesses: name, city, description, categories, photos, services and prices; verification documents when you send them; payout account details (the payment partner keeps tax and banking documents).

Orders: quote requests, quotes, messages, files, progress and delivery photos, reviews, event history and payments. Delivery address where applicable.

Technical: visit counts per page and source (not identifying visitors) and security logs. We use no advertising trackers. Uploaded images have location and device data removed on your device before upload.

3. Why we use it and the legal basis

To run the platform and perform our contract with you (accounts, pages, quotes, orders, messages, payments); to meet legal obligations (tax, fraud prevention); for our legitimate interests (security, abuse prevention, improving the service, aggregate statistics); and with your consent where we ask (for example, to tell you when someone becomes available in your area).

4. Who we share it with

Providers of parts of the service, under contract: payment partner (Asaas), email delivery (Resend), image hosting (Cloudinary), application and database hosting. The other party to an order, only what the work needs (name, messages, order photos). Authorities where the law requires. We don't sell personal data.

Some of these providers are outside Brazil; we require appropriate safeguards.

5. Sensitive documents

Verification documents are stored encrypted, never shown publicly, and every access is logged. Only the business itself and authorised Manufatu staff can open them, to verify identity or registration.

6. How long we keep it

While the account exists and as long as needed to meet legal obligations and protect rights. Order, payment, review and history records are kept, without contact details, after an account closes. Order evidence (photos and files) is kept for the applicable dispute and limitation period, then removed or reduced. Exact periods will be published on this page.

7. Your rights

You can ask for confirmation of processing, access, correction, anonymisation, portability, information about sharing and deletion of data processed on consent, and withdraw consent. Under "Account" you can download your data and close your account. Other requests: privacidade@manufatu.com. You may also complain to the Brazilian data protection authority (ANPD).

8. Cookies

We only use essential cookies: the sign-in session and your chosen language.

9. Security

Codes and sessions are stored as hashes; payment keys and sensitive files are encrypted; relevant accesses and actions are logged; attempt limits guard against abuse. No system is perfect: if an incident affects your data, we will tell you as the law requires.

10. Children

Manufatu is not intended for people under 18 without a guardian.

11. Changes

We will update this policy when processing changes and announce material changes.