Privacy Policy — Voteseed
Last updated: August 15, 2026
1. Data Controller
📌 Personal Data Controller:
Personal data collected by Voteseed is controlled by Alfa Global Services, Tax ID (CNPJ) 34.419.151/0001-09, headquartered at [HEADQUARTERS ADDRESS — TO BE CONFIRMED]. We process your data striving to comply with the LGPD; this document is subject to formal legal review.
2. Data We Collect
| Data | When Collected | Purpose |
|---|---|---|
| Name, email, password (hashed) | Registration | Account creation and protection |
| Country, language | Registration | Personalize experience and Ambassador election eligibility |
| Profile photo (optional) | Profile setup | Displayed on Public Ledger (if selected by user) |
| Contribution details (amount, currency, date, method) | Upon donation | Process donation, maintain Public Ledger, and verify voting/candidacy eligibility (see Terms of Use, Section 8) |
| CPF or CNPJ of payer | Upon Pix donation | Regulatory requirement for Pix charge issuance |
| Voting data (project, vote choice, reason) | Upon voting | Record and tally public votes with integrity |
| IP address, login attempts | Authentication | Security and unauthorized access prevention |
🔒 We NEVER store full credit card data — payments are processed directly by certified secure partners (Stripe and Asaas).
3. Legal Basis for Processing (LGPD)
We process your data based on:
- Contract execution: enabling registration, voting, and contribution processing;
- Consent: specifically for public display of name/photo on the Public Ledger;
- Legal compliance: financial and tax recordkeeping requirements.
4. Public Ledger Privacy Rules
A core transparency feature of Voteseed:
- Always public for every contribution: amount, currency, country, date.
- User-controlled per donation: display of name and profile photo. Default is 'Anonymous Donor'.
- This choice is per-contribution, not permanent.
5. Service Providers & Data Sharing
We use trusted service providers to operate Voteseed, sharing only necessary data:
| Provider | Function | Shared Data |
|---|---|---|
| Stripe | Credit card processing (international) | Payment parameters required for charge (Voteseed has no access to full card numbers) |
| Asaas | Pix processing (Brazil) | Payment and identity data required for Pix charge registration |
| Resend | Transactional email delivery | Email and name for confirmation, receipts, and security alerts |
| Neon | Database storage | Account data, votes, and contribution history on secure Postgres servers |
| Vercel | Application hosting | Technical logs and encrypted navigation telemetry |
🚫 We NEVER sell user data to third parties for marketing or advertising purposes under any circumstances.
6. Your Data Rights (LGPD)
You may at any time: access your data; correct inaccuracies; request account deletion (available directly in Profile); request data portability; and revoke consent for public name/photo display on future donations.
Important notice regarding account deletion:
For Public Ledger integrity and financial auditability, contribution amounts and dates remain in the public record after account deletion, rendered anonymously as 'Anonymous Donor'.
7. Data Retention
Account data is kept while active. Contribution and voting records are retained indefinitely in aggregated/public form to uphold transparency commitments.
8. Security Measures
Passwords are stored using secure cryptographic hashes. All telemetry uses HTTPS/TLS encryption. Verification tokens are single-use and expire automatically. Administrative accounts require two-factor authentication (2FA). We also implement technical measures to prevent fraudulent accounts and voting manipulation.
9. Minors
Voteseed is restricted to individuals 18 years of age or older. We do not intentionally collect data from minors.
10. Policy Amendments
Policy updates will be announced via email or platform notification prior to taking effect.
11. Contact & Data Protection Officer
Privacy inquiries may be directed to [email protected]. [email protected].
12. California & US State Privacy Rights (CCPA / CPRA)
If you reside in California, Colorado, Virginia, or other US states with consumer privacy statutes, you have specific rights under the CCPA/CPRA, including: (1) Right to Know and Access personal information collected; (2) Right to Request Deletion; (3) Right to Correct inaccurate data; and (4) Right to Non-Discrimination for exercising privacy rights.
• Do Not Sell or Share My Personal Information: Voteseed DOES NOT sell, rent, or share personal information with third parties for monetary consideration or cross-context behavioral advertising.
13. European Union & UK Data Protection Rights (GDPR)
For individuals located in the European Economic Area (EEA) and the United Kingdom, processing of personal data is governed by Regulation (EU) 2016/679 (GDPR). Data subjects enjoy rights of access (Art. 15), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection (Art. 21). You may lodge a complaint with your local EU Data Protection Supervisory Authority.
14. International Data Transfers & Standard Contractual Clauses (SCCs)
Because Voteseed is a global platform, personal information may be stored and processed in server infrastructures located in Brazil, the United States, and the European Union. All cross-border transfers comply with Standard Contractual Clauses (SCCs) approved by the European Commission, SOC2 Type II cloud hosting protocols, and end-to-end TLS 1.3 encryption.