Privacy Policy

This Privacy Policy explains how CNPJ Data handles the personal data of platform users and how it handles the public business data made available in its searches and spreadsheets.

1. General Information

1.1. CNPJ Data obtains public business data from official sources, especially the database of the National Registry of Legal Entities (CNPJ — Brazilian company registry ID), of the Ministry of Finance, through Receita Federal (Brazil's Federal Revenue Service). This data is processed, organized, and made available in searches and spreadsheets.

1.2. This Policy was prepared based on Federal Law No. 13,709/2018 (Brazilian General Data Protection Law - LGPD) and may be updated whenever there are changes to the platform, the legislation, or our data processing practices.

2. Processing of Personal Data

2.1. User data: For registration, authentication, customer support, and use of the services, we may process:

• Registration data: name, email, and phone number;
• Authentication data: your registered password, stored as a bcrypt hash, with no storage of the password in plain text;
• Payment and billing data: CPF (Brazilian individual taxpayer ID), phone number, and address when required by Asaas or another payment partner;
• Usage and funnel event data: pages visited, actions taken, searches, filters, purchases, downloads, and technical identifiers associated with those events;
• Technical data: IP address, date and time of access, device, and information necessary for the security and operation of the platform.

Legal bases

2.2. Legal bases: The legal basis depends on the purpose of the processing:

• Contract performance: to create and manage the account, authenticate the user, and provide searches, spreadsheets, credits, and support;
• Compliance with a legal obligation: to meet tax, accounting, and regulatory obligations or orders from authorities;
• Legitimate interest: for security, fraud prevention, operational improvement, and the recording of technical and commercial funnel events, while respecting data subjects' rights;
• Consent: when necessary for a specific purpose that requires prior authorization, such as certain communications or third-party technologies.

3. Public Data

3.1. The platform processes business data obtained from official public sources, especially the database of the National Registry of Legal Entities (CNPJ), of the Ministry of Finance, through Receita Federal.

3.2. The business data made available in searches and spreadsheets is public at its source, as provided by the official source. It may include CNPJ number, legal name, trade name, address, registration status, economic activity, company size, and contacts associated with the company.

3.3. CNPJ Data provides the partner list in API queries. In the public lookup, partner identification data is masked; the paid API returns the data available to authenticated access. Business contacts may, in some cases, allow indirect association with an individual and are therefore handled with the applicable protective measures.

4. Purpose of Processing

4.1. User data is used to:

• Enable access to and use of the platform;
• Process payments and manage the purchase and use of credits;
• Send communications about the contracted service, active plans, and available credits;
• Record funnel events in the backend to analyze platform usage and commercial performance;
• Comply with legal and regulatory obligations, including tax and accounting ones;
• Prevent fraud and ensure security.

5. Data Sharing

5.1. Users' personal data may be shared:

• With service providers necessary for the operation of the platform, hosting, communications, and support;
• With Asaas or another payment processing partner, for billing, anti-fraud analysis, and transaction confirmation;
• To comply with legal, judicial, or regulatory obligations;
• In the event of corporate transactions involving the company, when applicable.

Limited sharing

5.2. Sharing is limited to what is necessary for each purpose. Public business data is not sold as exclusive data owned by CNPJ Data; it is processed and organized for availability on the platform.

6. Storage and Security

6.1. Passwords are stored as bcrypt hashes, not in plain text. Access to the platform uses a JWT token valid for 7 days, stored locally in the browser to keep the session active.

6.2. We apply measures compatible with the operation of the platform to reduce the risks of unauthorized access, loss, or improper alteration of data. We do not promise absolute security, and we may retain data for as long as necessary for the stated purposes, compliance with legal obligations, and the regular exercise of rights.

7. Data Subject Rights

7.1. In accordance with the LGPD, data subjects have the following rights:

• Confirmation of the existence of data processing;
• Access to the data;
• Correction of incomplete, inaccurate, or outdated data;
• Deletion of data, where applicable;
• Data portability;
• Withdrawal of consent;
• Objection to processing carried out on the basis of legitimate interest, where applicable;
• Information about the public and private entities with which the data has been shared, where applicable.

How to exercise your rights

7.2. To exercise your rights, please contact us at: contato@cnpjdata.com.br

8. Use of Local Storage Technologies

8.1. We do not use first-party cookies for authentication or funnel tracking. We use the browser's local storage to:

• Keep you signed in to the platform;
• Remember your preferences and settings;
• Associate technical and commercial funnel events with an anonymous or identified use of the platform.

Funnel events and third-party tools

8.2. Funnel events are sent to our backend. When available, the email address provided at registration may be associated with those events for the purpose of analyzing the user journey. You can block local storage in your browser, but doing so may prevent login, preserve searches, and keep some preferences.

8.3. We use Vercel Web Analytics, which states that it does not use third-party cookies and identifies visitors through a hash derived from the request, automatically discarding the session after 24 hours. We also use Google tags for conversion measurement and advertising. These tags may use cookies or identifiers according to Google's settings and are subject to Google's policies.

8.4. Google tags are not loaded before the user makes a choice. They are only loaded after consent is given for measurement and advertising purposes. If you decline, these tags are not loaded, and declining does not prevent the use of the platform's essential features.

9. Changes to the Privacy Policy

9.1. This Policy may be modified at any time to adapt to legislative changes or changes in data processing practices.

9.2. We recommend that users periodically check the updated version of this Policy.

10. Contact

10.1. If you have any questions, requests, or concerns regarding this Policy or the processing of your personal data, please contact us at: contato@cnpjdata.com.br