Privacy policy

1. Who controls your data. BBSolutions Digital Services, inscrita no CNPJ 43.212.363/0001-01, com sede em Edifício La Terrasse, R. 428, nº 115, 15º andar, Morretes, Itapema/SC, CEP 88220-000. We are the controller of the personal data processed on this site and in the applications we offer by subscription. Contact for any privacy matter: [email protected].

2. What data we process. We collect the minimum necessary to run the service.
When subscribing, on this site: the e-mail and the record of acceptance (version of the terms and of this policy, date, time, network address and whether the sign-up was a free trial).
In Verax Markets: e-mail, password (stored only as an irreversible cryptographic digest), the second authentication factor secret, session records (date, time, network address and browser), the markets subscribed with the subscription history, and preferences such as language and favourites.
In the Telegram alerts, if you link them (with the add-on or in the free trial): the number of the conversation with our bot, the username and the display name on Telegram, the language of the alerts, the markets you left switched on, the dates of the link and of the last alert, the last day of the free trial, if you linked during it, and a four-character code that identifies your account in each alert. From anyone who writes to the bot without a linked account, we keep only the daily count, with no data about the person.
At payment: name, CPF or CNPJ (Brazilian tax ID), phone, address and card are entered on the page of Asaas, our payment processor, and stay with Asaas. From Asaas we receive the status of each charge and of the subscription.
When checking the free trial: we look up in Asaas the CPF or CNPJ entered at payment, only to find out whether that person has already had a trial or a subscription. We do not store the number, only the result of the check. This refusal is automatic; if you disagree with it, you can ask for a review by a person through the contact e-mail.
Voluntary contact: the waiting list e-mail and the messages sent to us.
We do not collect sensitive data and we do no behavioural profiling.

3. On what legal basis. Performance of the contract: registration, subscription, billing and the account and billing e-mails.
Legal obligation: keeping access records for six months (Brazilian Internet Civil Framework) and tax records.
Legitimate interest: security, protection against bots and fraud prevention, including the free trial check and the code in the Telegram alerts, which identifies improper sharing.
Regular exercise of rights: keeping proof of acceptance and the payment history.
Consent: waiting list, which you can withdraw at any time.
We comply with the Brazilian General Data Protection Law (Law 13.709/2018) and, where applicable to the visitor, the European General Data Protection Regulation.

4. What we use it for. To authenticate your access, operate and bill the subscription, send account and billing notices (access granted, trial started, reminder before the first charge, cancellation confirmed and relevant changes to the service), send the region alerts on Telegram to whoever linked them, with the add-on or in the free trial, prevent fraud and abuse, and meet legal obligations. We do not sell your data, we do not share it for advertising and we do not send commercial messages from partners.

5. Who we share it with. Only with suppliers that perform essential functions on our behalf, limited to what is necessary:
Asaas (Brazil): processing of the payment and the recurring billing.
Amazon Web Services (servers in Brazil, São Paulo region): hosting of the site, Verax Markets and the databases.
Cloudflare (United States): every access to the site and the application goes through it; it delivers the pages and protects against attacks and bots. It sees the network address and the technical data of the connection.
Microsoft (Exchange Online): sending of the account and billing e-mails and the customer service mailbox.
Telegram (based in Dubai, United Arab Emirates): delivers the Telegram alerts to whoever linked them, with the add-on or in the free trial. It receives the conversation number and the content of each alert.
We may also disclose information under a court order or a request from a competent authority.

6. International transfers. Cloudflare and Microsoft process data outside Brazil, mainly in the United States, and Telegram, for those who link the Telegram alerts, on its own servers outside Brazil. These transfers rely on these suppliers' data processing agreements and on the mechanisms provided for in article 33 of the LGPD (Brazilian data protection law).

7. How long we keep it. Account and subscription: while the account exists and then 5 years, for tax obligations and the defence of rights.
Proof of acceptance and payment history: 5 years after the subscription ends.
Result of the free trial check and the e-mail linked to it: for as long as we offer a free trial, to apply the one-trial-per-person rule.
Access records: 6 months.
Link with Telegram: until you unlink it, block the bot or delete the account; with the plan, the add-on or the free trial ended, up to 90 days. The alert code is kept while the account exists, to identify an alert that was passed on.
Count of messages to the bot from people without a linked account: only the number for each day, for up to 400 days.
Waiting list: until the product launch or until you ask.
Once the period ends, the data is deleted or anonymised.

8. Your rights. You can, at any time and at no cost, request: confirmation that we process your data; access to it; correction; anonymisation, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about whom we share it with; withdrawal of consent; objection to processing based on legitimate interest; and review of an automated decision, such as the refusal of the free trial. Just write to [email protected]. To protect you, we may confirm that the request comes from the data subject, for example through the registered e-mail. We reply within fifteen days. In Brazil you can also complain to the National Data Protection Authority (ANPD); in the European Union, to the authority of your country.

9. Cookies. We only use cookies needed for operation and security. None is for advertising or marketing tracking.
On this site: bbs_lang (language, 1 year) and __Host-bbs_csrf (protects forms against forged submissions, 8 hours). Only for the site team: __Host-bbs_session (administration session, 12 hours) and __Host-bbs_etapa (login with second factor, 5 minutes).
In Verax Markets: veraxmarkets_session (keeps you signed in, 12 hours) and vrx_lang (language, 1 year).
From Cloudflare: technical security cookies, such as cf_clearance and __cf_bm, used to tell people from bots.
You can delete them in your browser. Without them, the session ends and the language returns to the default.

9.1. What the page loads from outside. The pages, the typefaces and the chart and icon libraries come from our own domain. Cloudflare, which sits in front of the site and the application, adds two scripts of its own: one that tells people from bots and another that protects the e-mail addresses on the page against automated harvesting. There is no heatmap, embedded chat, social network pixel or browsing analytics service.

10. Security. We adopt technical and administrative measures to protect your data: password stored only as a cryptographic digest with a slow derivation algorithm, second authentication factor, encrypted traffic, billing data encrypted at rest in a separate service, restricted and authenticated administrative access, the principle of least privilege and an audit trail of relevant operations. No system is infallible: if a security incident with relevant risk to you occurs, we will notify you and the competent authority within the legal deadlines.

11. Minors. Our products are not intended for people under 18 and we do not knowingly collect data from children or adolescents. If such processing is identified, the account is closed and the data deleted.

12. Changes to this policy. If we change this policy in a relevant way, we will notify you by e-mail before the change takes effect. The version date is at the top of this page, and previous versions remain published.

13. Data protection officer. As a small-scale processing agent (ANPD Resolution CD/ANPD nº 2/2022), we do not appoint a data protection officer. Requests about personal data are handled through [email protected].