This is a translation provided for convenience. In case of any conflict, the Portuguese version prevails.

This Privacy Policy describes how D-API (CNPJ 40.925.787/0001-17), hereinafter "D-API", "we" or "our", collects, uses, shares and protects the personal data of visitors, leads and customers of the d-api.cloud website and related services.

We process personal data in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018, LGPD) and with the terms of the platforms we use, including the Meta Business Tools Terms and the WhatsApp Business Solution Policy.

1. Data controller and data protection officer (DPO)

The controller of the personal data processed under this policy is D-API. To exercise your rights or ask questions about privacy, contact our data protection officer by email at [email protected] or on WhatsApp at +55 (51) 92001-8823.

2. Data we collect

2.1. Data you provide

Sign-up and contact: name, email, phone number, company and job title, when you fill out forms, book a demo, create an account or send us messages.
Content of communications: messages exchanged by email, WhatsApp or other support channels.
Payment data: processed directly by partner payment gateways; we do not store full card data on our servers.

2.2. Data collected automatically

Technical identifiers: IP address, user agent, operating system, device type and browser language.
Browsing data: pages visited, traffic source (including UTM parameters and fbclid), time on page and actions taken.
Approximate location: city, state and country, derived from the IP address through an external geolocation service.

2.3. Inferred data

We generate derived data (audience segmentation, qualification score and aggregated metrics) from the data collected above, exclusively for the legitimate purposes described in this policy.

3. How we use your data (purposes and legal bases)

Purpose	Legal basis (LGPD)
Responding to contact, demo and support requests.	Pre-contractual procedures (art. 7, V).
Providing the D-API platform services and operating the customer account.	Performance of a contract (art. 7, V).
Billing, issuing invoices and accounting obligations.	Compliance with a legal obligation (art. 7, II).
Measuring campaign performance, optimizing ads and sending marketing communications.	Legitimate interest (art. 7, IX) or consent (art. 7, I), as applicable.
Preventing fraud and abuse and protecting the security of the platform.	Legitimate interest (art. 7, IX).

4. Cookies and tracking technologies

We use first-party and third-party cookies to run the website, measure audience and improve our campaigns. You can block or delete cookies in your browser settings; some features may stop working as expected.

4.1. Essential cookies

Session and theme preferences: required for the website to work and to keep your display preferences.

4.2. Marketing and analytics cookies

Cookie	Source	Purpose	Retention
`_fbp`	Meta Pixel	Identify the browser to measure conversions and optimize Meta (Facebook/Instagram) ads.	90 days
`_fbc`	Meta Pixel	Store the `fbclid` parameter from Meta ad clicks for conversion attribution.	90 days
`da_em`, `da_ph`, `da_fn`, `da_ln`	D-API (first party)	Store email, phone number, first and last name as a SHA-256 hash, to enrich events sent through the Conversions API. We do not store this data in plain text in the cookie.	365 days
`da_ip`, `da_city`, `da_state`, `da_country`	D-API (first party)	Cache the approximate location to avoid repeated requests to the geolocation service.	365 days
Google Ads cookies (`_gcl_`, `_ga`)	Google	Measure Google Ads campaign conversions and attribute clicks.	up to 24 months
Lemonfy cookies	Lemonfy	Identify the affiliate who originated the visit for sales attribution and commission calculation in the partner program.	up to 12 months

5. Meta Pixel and Conversions API (CAPI)

In accordance with the Meta Business Tools Terms, we transparently disclose our use of Meta tools on our website:

Meta Pixel (ID 1711036882898069): a script loaded from connect.facebook.net that sends events such as PageView, clicks and form submissions to Meta.
Conversions API (CAPI): server-side delivery of the same events from our backend (api.d-api.cloud/track), forwarded to Meta for campaign measurement and optimization. Both events share the same event_id for deduplication.
Hashing of personal data: email, phone number, first and last name are normalized (lowercased, with special characters removed) and converted to SHA-256 in the browser before anything is sent. We do not send personal data to Meta in plain text.
Location data (city, state, country and IP) is sent to Meta only to improve event matching (Advanced Matching).
No sensitive categories: we do not use the Meta Pixel to collect or infer sensitive personal data (health, religion, political opinion, sexual orientation, etc.), as required by Meta’s policies.

You can control how Meta uses your data in Meta Ad Preferences.

6. Google Ads

We load the Google tag (gtag.js) with ID AW-17943244217 to measure conversions and optimize Google Ads campaigns. Google acts as an independent controller of this data under its privacy policy. You can control ad personalization at adssettings.google.com.

We share personal data only with processors that help us provide the services, under data protection agreements:

Meta Platforms, Inc.: Pixel and Conversions API for measurement and advertising.
Google LLC: Google Ads for conversion measurement.
Lemonfy: affiliate platform for attributing sales to partners and calculating commissions.
ipapi.co: approximate geolocation based on the IP address.
Cloud infrastructure providers: hosting, database and transactional email.
Payment gateways: payment processing and invoice issuance.
Competent authorities: when required by law, court order or regulatory request.

We never sell personal data.

8. International transfers

Some partners (Meta, Google and infrastructure providers) process data outside Brazil. When this happens, we require the recipient to provide a level of protection compatible with the LGPD, through standard contractual clauses or equivalent mechanisms.

9. Data retention

Leads and business contacts: up to 24 months without interaction, or until a deletion request.
Active customers: for the duration of the contract and for the applicable legal periods after it ends (up to 5 years for tax data).
Cookies: as listed in the table in section 4.
Security logs: up to 6 months, in accordance with the Brazilian Internet Civil Framework (Marco Civil da Internet).

10. Security

We adopt technical and organizational measures proportionate to the risk, including encryption in transit (TLS), role-based access control, environment segregation, audit logging and periodic permission reviews. Despite our efforts, no system is 100% secure; in the event of an incident that may pose a relevant risk, we will notify the affected data subjects and the ANPD (Brazilian Data Protection Authority) as required by the LGPD.

11. Your rights as a data subject

The LGPD grants you the following rights:

Confirm that processing takes place;
Access your data;
Correct incomplete, inaccurate or outdated data;
Request anonymization, blocking or deletion of unnecessary data or data processed in non-compliance;
Data portability;
Deletion of data processed based on consent;
Information about the entities with which we share your data;
Withdraw consent;
Object to processing carried out on other legal bases.

To exercise any of these rights, email [email protected]. We will respond within 15 days.

12. Children and teenagers

The D-API website and services are intended for businesses and professionals over 18 years of age. We do not knowingly collect data from children or teenagers.

13. Changes to this policy

We may update this Privacy Policy from time to time. The date of the last update is shown at the top of the document. Material changes will be communicated by email or by a prominent notice on the website.

14. Contact

D-API, CNPJ 40.925.787/0001-17
Data protection officer email: [email protected]
General support: [email protected]
WhatsApp: +55 (51) 92001-8823