Privacy Policy

Version in effect: November 11, 2026.

This policy explains how Cafune.ai (“we”), acting as controller, processes the personal data of people who visit cafune.ai and request early access to Cafune.ai, in accordance with the Lei Geral de Proteção de Dados (Brazil’s General Data Protection Law; Lei nº 13.709/2018, that is, Law No. 13,709/2018; the “LGPD”).

Data we process

When you request access, we record:

• your email address;
• your confirmation that you are 18 or older and that you accept the Terms of Use and this policy, with the date and the version accepted;
• the language and variant of the page on which you made the request;
• your referral code and, if applicable, the code of the person who referred you;
• the source parameters included in the link you visited from (utm_source, utm_medium, and utm_campaign), if any;
• your survey answers, if you respond;
• technical records of the request, such as the date, the email confirmation, and the delivery status of messages.

To protect the site, we use the IP address of each request only to limit abuse: it is converted into a cryptographic code, using a key that changes every day, and is never stored in its original form.

We do not ask for your name, phone number, identification documents, precise location, or sensitive personal data.

What we use the data for and on what legal basis

• Organizing the list, confirming your email address, calculating your position, and sending the invitation and communications about early access: consent, which you give when you submit your request (art. 7º, I, of the LGPD, that is, Article 7, item I).
• Preventing fraud and abuse and protecting the site: legitimate interest (art. 7º, IX, that is, Article 7, item IX).
• Measuring use of the site in aggregate, without identifying you: legitimate interest (art. 7º, IX).
• Complying with legal obligations and exercising rights in legal proceedings: arts. 7º, II and VI (Article 7, items II and VI).

Cookies and data on your device

We do not use advertising or tracking cookies. Your browser stores your request locally, to show your position on a later visit, as well as any referral code received through a link. You can delete this data in your browser settings.

When enabled, usage analytics is performed by Plausible Analytics, without cookies and without personal identifiers: it records the page, the source of the visit, the language, and actions such as opening the form, but never your email address.

Who we share data with

We do not sell personal data. We share data only with processors that provide services to us, under contract and for the purposes of this policy:

• Cloudflare: website hosting, database, and protection against attacks;
• Resend: sending confirmation and invitation emails;
• Plausible Analytics: cookie-free usage statistics, when enabled.

We may also share data when required by law or by a competent authority.

International transfers

These processors may store or process data outside Brazil, including in the United States and the European Union. For these transfers, we adopt the safeguards provided for in art. 33 of the LGPD (Article 33), such as standard contractual clauses.

How long we keep data

• Your request and the data linked to it: for as long as the early access program lasts and for up to 12 months after it ends, or until you request deletion, whichever occurs first.
• Email confirmation links: up to 7 days.
• Access to your request stored in the browser: up to 180 days.
• Records used to limit abuse: up to 2 days.

At the end of these periods, the data is deleted or anonymized, unless the law requires it to be retained.

Security

We use encrypted connections, store confirmation and access codes only in cryptographic form, limit access to the data to those who need it, and do not store IP addresses. No system is completely secure: if an incident occurs that may create significant risk or harm, we will notify you and the Autoridade Nacional de Proteção de Dados (ANPD, Brazil’s National Data Protection Authority), in accordance with the law.

Minors

Early access is limited to people 18 and older, and we do not knowingly collect data from minors. If we learn of a request made by a minor, it will be deleted.

Your rights

Under the LGPD (art. 18, that is, Article 18), you may request at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary or excessive data, or of data processed in violation of the law;
• portability of your data;
• information about who we share your data with;
• withdrawal of your consent and deletion of the data processed on the basis of it, which removes your request from the list.

To exercise these rights, write to contato@cafune.ai. We will respond within 15 days. You may also file a complaint with the ANPD.

Data protection officer and contact

The channel for communicating with the data protection officer is contato@cafune.ai.

Changes

We may update this policy. The date of the version in effect appears on this page. If a change materially affects the use of your data, we will notify you at the registered email address and, where necessary, ask for your consent again.