Legal

Privacy policy

Last updated: February 2026 Nepfy Propostas LTDA · CNPJ 61.292.782/0001-74

This English version is a translation provided for convenience. The original Portuguese version, available at nepfy.com/pt-br/politica-de-privacidade, prevails in case of any discrepancy.

1. Introduction

Nepfy Propostas LTDA ("Nepfy"), CNPJ 61.292.782/0001-74, presents this Privacy Policy to explain how we collect, use, store and protect personal data through the nepfy.com platform (the "Platform").

By using the Platform, you declare that you have read and understood this Policy and consent to the processing of your data as described here.

2. Data controller

Controller of User data: Nepfy Propostas LTDA, CNPJ 61.292.782/0001-74.

For third-party data entered by Users (clients, recipients): the User is the Controller and Nepfy acts as Processor.

3. Personal data collected

3.1. Data provided by the User

  • Identification and contact data (name, email, profile photo).
  • Professional data (areas of work, specialties).
  • Authentication credentials (stored encrypted).
  • Configuration and personalization preferences.
  • Payment data (processed by third parties; we do not store card data).

3.2. Third-party data entered by the User

The User may enter data about their clients. The User is the Controller of that data and is responsible for ensuring a legal basis for the processing.

3.3. Data collected automatically

  • Technical data (IP address, browser type, operating system).
  • Usage and browsing data (pages visited, features used, session duration).
  • Analytics and performance data (via third-party tools).
  • Access data for published Proposals (views, engagement, interactions).
  • Usage data for AI features (usage volume and consumption metrics).
  • Any other data necessary to operate and improve the Platform.

4. Purposes and legal bases

4.1. Performance of the contract (Art. 7, V, LGPD)

Create and manage accounts; process payments; provide features; send transactional emails; deliver support; enable the publication of proposals.

4.2. Legitimate interest (Art. 7, IX, LGPD)

Analyze usage patterns and improve the Platform; prevent fraud and abuse; generate statistics and analytics; monitor performance and errors; provide engagement metrics; develop and improve algorithms, artificial intelligence models and features; personalize the experience; carry out research and development of new services.

4.3. Consent (Art. 7, I, LGPD)

Send marketing communications; use a name or use case as a commercial reference.

4.4. Compliance with legal obligations (Art. 7, II, LGPD)

Respond to requests from authorities; meet tax obligations; keep legal records.

4.5. Anonymized and aggregated data

Anonymized and aggregated data is not considered personal data under the LGPD (Art. 12). Nepfy may use anonymized and aggregated data for any purpose, including training artificial intelligence models, generating market insights, benchmarks, developing new products and services and any other commercial or operational purposes, without restriction and without the need for consent.

5. Data sharing

Nepfy may share personal data with third-party service providers needed to operate the Platform, including without limitation: infrastructure and hosting providers, payment processors, artificial intelligence providers, analytics and monitoring tools, email and communication services, image banks and any other integrated services. Nepfy reserves the right to change, add or replace providers at any time.

These providers may be located outside Brazil, including in the United States and the European Union. International transfers are carried out with adequate safeguards under applicable law.

Nepfy may also share data: with authorities when required by law; in corporate reorganizations, mergers or acquisitions; or when the User authorizes it.

Nepfy does not sell identified personal data to third parties for direct marketing purposes.

6. Storage and retention

Data is stored on secure servers with encryption in transit and at rest.

Nepfy will retain personal data for as long as necessary to fulfill the purposes of this Policy, meet legal and regulatory obligations, resolve disputes and exercise rights. After an account is closed, data may be retained for a reasonable period to comply with legal obligations, after which it may be deleted or anonymized at Nepfy's discretion.

7. Security

Nepfy adopts technical and organizational measures consistent with industry standards to protect personal data. No system is completely immune to vulnerabilities. In the event of a material security incident, Nepfy will take the appropriate measures under applicable law.

8. Cookies

The Platform uses cookies and similar technologies for authentication, security, analytics and improving the experience. The User can manage preferences through their browser.

9. Data subject rights

In accordance with the LGPD (Art. 18), the data subject may exercise rights to: confirmation of processing, access, correction, anonymization, blocking, deletion, portability, information about sharing, withdrawal of consent and objection.

To exercise these rights: privacidade@nepfy.com. Requests will be answered within a reasonable time under applicable law.

Nepfy may request identity verification before responding to requests and may refuse requests that are manifestly unfounded, excessive or that conflict with legal obligations or Nepfy's legitimate interests.

10. Minors

The Platform is not intended for anyone under 18 years old.

11. Artificial intelligence

The Platform uses artificial intelligence technologies for content generation. Data sent to AI features is processed by third-party providers.

Nepfy may use usage data from AI features, in anonymized, aggregated or de-identified form, to improve services, train and refine models, develop new features and for any other legitimate purposes, as set out in Section 4.5 of this Policy.

12. Changes

Nepfy may update this Policy at any time. Changes take effect once published. Continued use after publication constitutes acceptance.

13. Governing law and jurisdiction

This Policy is governed by the laws of Brazil. Jurisdiction: the judicial district of Curitiba/PR.

14. Contact

The data subject may also file a complaint with the ANPD, Brazil's data protection authority (www.gov.br/anpd).