LGPD compliance

Processing is grounded on consent (art. 7, I) for supporter participation, captured electronically per individual via the Supporter Agreement; and on legitimate interest (art. 7, IX) for client service operations, balanced against data-subject rights via opt-out, transparency and minimization.

We honor all rights granted by art. 18 — confirmation, access, correction, anonymization, portability, deletion, consent revocation, information about sharing, and review of automated decisions. Requests are handled via /excluir-dados with a protocol number and a 15-day response window.

Production data is stored in sa-east-1 (São Paulo) — Supabase Postgres for the institutional site MVP and AWS (RDS Multi-AZ + S3) for the platform when it launches. No personal data leaves Brazilian soil under normal operation.

• Form leads: 24 months from last interaction, then anonymized.
• LGPD requests log: 5 years (regulatory obligation under ANPD guidance).
• Consent records: 5 years (proof of consent).
• Supporter audit events: 5 years (electoral and platform-policy traceability).
• Invoices and fiscal data: 5 years (tax obligation).

Meta access tokens are encrypted at rest with AES-256-GCM, master key in AWS KMS with automatic rotation. Database uses Row-Level Security to enforce multi-tenancy even if the application layer forgets a filter. TLS 1.2+ on all connections; HSTS preload at the edge (.app.br is HSTS-preloaded at the TLD level).

Listed and updated in the Privacy Policy. Current list includes Supabase, Cloudflare, Resend and Anthropic. Each has a documented purpose, region and DPA in place.

dpo@bandeira.app.br · Bandeira Tecnologia LTDA · São Paulo, Brazil · Reachable for ANPD inquiries, breach notifications and individual requests.