01
Scope of this policy
This Policy explains how personal data is processed when you visit public pages, create an account, interact, publish or make transactions.
Processing varies according to the role you perform — user, creator, affiliate, partner or administrator — and the features you actually use.
Third-party services accessed through their own links have independent policies. When a partner participates in our flow, sharing must be limited to what is necessary for the corresponding purpose.
02
Data we may process
We collect only categories compatible with registration, security, personalization, communication and financial operations.
- Identity and contact: name, nickname, email, telephone number, date of birth and information provided in the profile.
- Verification: documents, selfie, age result, requested role and records needed for KYC.
- Account and security: identifiers, protected credentials, IP address, device, sessions and audit events.
- Content and interaction: posts, stories, offers, live streams, messages, groups, reactions, followers and reports.
- Transactions: amount, product, recipient, status, tax or registration document and payment-method identifiers.
- Preferences and browsing: pages visited, campaigns, cookies, consent records and communication choices.
- Location: only when authorized or necessary for a requested feature.
Sensitive financial data
Full card details and payment-method credentials must be processed by the appropriate financial partner; the platform uses the identifiers needed to track the transaction.
03
Why we use data
Every processing activity must be tied to a legitimate purpose compatible with the requested experience.
- Create, authenticate, recover and protect accounts.
- Personalize the feed, search, creator discovery and recommendations.
- Deliver messages, groups, calls, live streams, subscriptions, private content and gifts.
- Process and reconcile financial transactions, prevent fraud and keep transaction records.
- Verify adulthood, identity, roles and payout requirements.
- Moderate content, investigate reports, enforce rules and maintain audit logs.
- Send operational communications and, when permitted, news or campaigns.
- Measure performance, stability and use to improve the product.
- Comply with legal, regulatory and contractual obligations or orders from a competent authority.
05
When data may be shared
SocialFans must not expose data without a purpose. Some processors receive limited information to perform specific steps.
- Infrastructure, storage, email, notification and technical monitoring providers.
- Payment, anti-fraud, reconciliation and payout partners.
- Identity or age-verification services when required by the flow.
- Creators and users involved, only as necessary for the interaction, delivery or transaction.
- Consultants, auditors and service providers subject to security and confidentiality duties.
- Authorities or authorized third parties when required by law, to protect rights or address a relevant risk.
- Corporate transactions, with appropriate controls and notice when required.
06
Security and incident response
We use technical and organizational controls proportionate to risk without claiming that any digital environment is infallible.
- Transport encryption and credential protection.
- Access control based on role and operational need.
- Logs, alerts, event reviews and anti-fraud measures.
- Backups, continuity procedures and restrictions on protected content.
- Incident analysis, containment and communication processes when applicable.
Users must also keep their devices updated, use a unique password, enable additional security features and never share authentication codes.
07
Retention, restriction and deletion
Data is kept for the period necessary for its purpose, operational security and legal obligations.
- Account data remains while the account is active and for the necessary period after closure.
- Financial and tax records may follow their own legal retention periods.
- Security, moderation and audit logs may be preserved for prevention and the defense of rights.
- Deleted content may remain temporarily in restricted backups until the deletion cycle completes.
- Deletion requests are assessed against retention duties, investigations, disputes and third-party rights.
08
Data subject rights
Within the limits of the LGPD and applicable law, you may request information and exercise control over your data.
- Confirmation that processing exists and access to the data.
- Correction of incomplete, inaccurate or outdated data.
- Information about sharing and relevant processing criteria.
- Anonymization, restriction or deletion when applicable.
- Portability, subject to regulation and applicable feasibility.
- Withdrawal of consent and information about its consequences.
- Objection to or review of processing when there is a legal basis for the request.
We may request identity confirmation before responding so another person cannot obtain or alter your data.
09
Adulthood, KYC and protection of minors
SocialFans is intended for adults and uses verification signals appropriate to the features accessed and roles requested.
- Suspicious accounts or access may be temporarily restricted while a review takes place.
- Creators and other higher-risk roles may require a document, selfie and additional review.
- Verification results must be used for security, compliance and the prevention of unauthorized access.
- Reports involving possible minors receive priority handling and may lead to evidence preservation.
See the Protection of minors and 18+ verification page for a dedicated explanation.
10
Privacy contact
Requests must contain enough information to locate the account and understand the request, without including a password or authentication code.
Privacy email: privacidade@socialfans.art
You may also use the contact page to submit your request and follow the response through the channels provided.