1. Controller and Data Protection Officer (DPO)
The controller of your personal data is the company responsible for comoimigrar. The Data Protection Officer (DPO), as required by LGPD Art. 41, can be reached at:
DPO contact: dpo@comoimigrar.com
2. Data Collected
We collect: name and email (registration), professional profile (onboarding), USCIS receipt number (case tracking), payment data processed by Stripe, notification preferences, and service usage data (analytics).
3. Lawful Bases (LGPD Art. 7)
Processing of your data is grounded in: (a) explicit consent for optional features; (b) contract performance for service delivery; (c) legitimate interest for security, fraud prevention, and product improvement; (d) legal obligation when required.
4. Sub-processors
We share personal data only with the sub-processors necessary to deliver the service:
- Supabase Inc. (banco de dados e autenticação)
- Stripe Inc. (pagamentos)
- PostHog Inc. (analytics)
- Functional Software Inc. / Sentry (monitoramento de erros)
- Expo / Expo Go (notificações push móvel)
5. Your Rights (LGPD Art. 18)
You have the right to: confirmation of processing, access to your data, correction, anonymization or deletion, portability, withdrawal of consent, and information about sharing. Exercise your rights in Settings > Privacy or by contacting the DPO.
6. Data Retention
We retain your data while your account is active and for up to 5 years after closure to fulfill legal obligations. Analytics data is anonymized after 12 months.
7. International Transfers
Your data may be transferred to servers in the United States (Supabase, Stripe, PostHog, Sentry, Expo). These transfers take place with processors that maintain adequate safeguards as required by LGPD Art. 33.
8. Contact
To exercise your rights or ask questions about privacy, contact our DPO at: dpo@comoimigrar.com