Privacy Policy & Cookie Governance

This Privacy Policy disciplines the collection, processing, storage, and deletion of personal data within the scope of the ChurnDefense Platform. It was structured under strict observance of the General Personal Data Protection Law (LGPD — Law No. 13.709/2018), with continuous alignment to the GDPR for cross-border data flows.

ChurnDefense as Controller (Limited Scope)

ChurnDefense assumes the Controller role exclusively for two categories: (1) registration data of executive representatives and commercial contacts of its Clients (for B2B accounting, billing, and contract execution); and (2) anonymized, aggregated operational data used to train AI models, optimize prediction engines, and produce market benchmark reports. This secondary use is anchored in the legitimate interest legal basis (Art. 7, IX, LGPD) and supported by a Data Protection Impact Assessment (DPIA).

The Platform processes several categories of data to deliver its analytical infrastructure:

B2B Commercial Contact Data

• Full names, institutional email addresses (@company), job titles, and phone numbers
• Company names, domains, and accounting registration data
• Data provided by Client administrators during account creation and profile management

Financial & Payment Metadata (End Users)

• Binary transactional status indicators (default/compliance)
• Encrypted hash tokens linking to payment methods — fully PCI-DSS Level 1 compliant, never storing raw card data
• Historical records of charge failures and decline patterns
• Card expiration temporal references (month/year only)

This data is captured exclusively through webhook integrations with external financial providers (Stripe, Iugu, Paddle), never through primary individual intrusion.

Behavioral & Analytics Data

• Timestamped event logs (UTC) of activities within the Platform
• Session analytics from connected sources (PostHog, GA4) via API integration
• Feature usage patterns and time-on-task metrics
• Engagement metrics with retention offers and cancellation flow interactions

In alignment with the ANPD's official Cookie Guidance and the Privacy by Design methodology, the Platform categorically rejects any form of dark patterns — deceptive interfaces designed to subvert, hinder, or exhaust the user's autonomy in managing their privacy preferences.

The principle of data minimization is rigorously implemented: data is retained only while its founding purpose imposes continued necessity.

In accordance with Chapter III of the LGPD and the GDPR, data subjects have the following rights:

• Access: Request confirmation and a copy of all personal data processed
• Correction: Request rectification of inaccurate or incomplete data
• Deletion: Request erasure of personal data ("right to be forgotten"), subject to legal retention obligations
• Portability: Request data in a structured, machine-readable format (CSV/JSON)
• Objection: Object to processing based on legitimate interest, including marketing
• Restriction: Request limitation of processing in contested accuracy or unlawful processing scenarios
• Review of automated decisions: Request human review of decisions made solely by automated processing (Art. 20, LGPD)

The Platform's infrastructure relies on cloud providers with data centers located outside Brazil. This constitutes an international transfer of personal data under Art. 33 of the LGPD.

Transfer Mechanisms

• Standard Contractual Clauses (SCCs): For transfers to the United States and other jurisdictions without an adequacy decision, the Provider integrates the mandatory SCCs established by CD/ANPD Resolution No. 19/2024 into all DPA instruments. These clauses are non-negotiable and must be incorporated in their entirety.
• EU Adequacy: Transfers to the European Economic Area are facilitated by the mutual adequacy recognition formalized in ANPD Resolution No. 32/2026, allowing free data flow without additional SCCs.

For full details on transfer governance, sub-processors, and security obligations, refer to our Data Processing Agreement (DPA).

We implement industry-standard and regulatory-mandated security measures:

• Data in transit encrypted using TLS 1.2 or higher
• Data at rest encrypted using AES-256
• Access to production systems restricted via SSO and MFA
• Regular penetration testing and security audits
• Infrastructure hosted on SOC 2-compliant cloud providers
• Logical segregation of tenant data in multi-tenant architecture

Responsible disclosure of security vulnerabilities: [email protected].

The Platform employs machine learning and AI for predictive churn analysis and hyper-personalization of retention offers. Article 20 of the LGPD guarantees data subjects the right to request review of decisions made solely by automated processing.

While customer retention strategies rarely produce discriminatory effects (e.g., offering a discount to prevent a corporate subscription cancellation), the Platform's design internalizes Privacy by Design and Privacy by Default principles — only meta-information strictly necessary for churn probability calculation is ingested.

ChurnDefense is a B2B software platform intended for business professionals. We do not knowingly collect personal information from individuals under 18. If we become aware that a minor has provided data, we will delete it immediately. Contact [email protected] to report.

We may update this Privacy Policy periodically. Material changes will be notified via email at least 30 days before taking effect, with the "Last updated" date revised at the top of this page. Continued use constitutes acceptance.

For questions, rights requests, or concerns regarding this Privacy Policy: