Privacy Policy
Draft — this text has not been legally reviewed yet. Do not treat it as final until a lawyer signs off.
This policy explains what data Chamaaki collects, why, and what rights you have over it — in line with Brazil's LGPD (Law 13.709/2018), since Chamaaki operates under Brazilian jurisdiction.
1. Who we are
Chamaaki is operated by [Legal entity name], tax ID [CNPJ], based at [address] (the "controller"). Questions about this policy can be sent to privacidade@chamaaki.com.br.
2. What data we collect
Account data (name, email — via NC SSO, our login provider), usage data (searches, bookings, reviews, favorites), location data when you allow it (to search nearby businesses), and business data (address, phone, photos) when you register a business.
3. What we use your data for
To power search and booking, show your history and favorites, process reviews, send booking notifications, and — if you own a business — process your subscription and billing.
4. Legal basis
Contract performance to deliver the service you requested; consent for location and non-essential cookies; legitimate interest for security and fraud prevention.
5. Who we share data with
NC SSO (authentication), infrastructure providers (hosting, transactional email where applicable), and — if you enable it — Google Calendar (calendar sync). We never sell your data to third parties.
6. Cookies
See our Cookie Policy for details.
7. Your rights
You can request confirmation of processing, access, correction, anonymization, portability, deletion of your data, and withdraw consent at any time by writing to privacidade@chamaaki.com.br. We respond within 15 days.
8. Retention
We keep your data while your account is active and for as long as required by law afterward (e.g. tax obligations). Deleting your account may keep booking/review history in anonymized form.
9. Security
We use encryption in transit (HTTPS) and at rest for sensitive data (e.g. integration tokens), and database-level isolation between businesses (row-level security).
10. Changes to this policy
Material changes are announced by email or site banner at least 15 days before taking effect.
11. Contact and data protection officer
Data protection officer: [DPO name/contact]. Email: privacidade@chamaaki.com.br.
Last updated: September 3, 2026