Your privacy is part of the product. This Policy explains what personal data we process when you use the website, open an account, get paid or pay through TchinPay, and what your rights are under Brazil's General Data Protection Law (Law 13,709/2018, LGPD).
This is a translation for convenience. If there is any conflict, the Portuguese version prevails.
1. Who looks after your data
TchinPay ("TchinPay", "we", "us") provides a technology platform to accept and make payments by Pix and credit card.
For account holders and website visitors, TchinPay is the controller. For Buyers who pay a merchant through TchinPay, the merchant is also a controller, and TchinPay processes that data to run the payment, prevent fraud and comply with the law.
The name of our data protection officer (DPO) will be published on this page.
2. What data we process
2.1 Sign-up
- Individuals: name, CPF, date of birth, email, phone, address and ID document.
- Companies: legal name, CNPJ, business activity, address, partners and legal representatives.
2.2 Biometrics
During identity verification we may ask for a selfie and compare it with your ID photo. Biometrics are sensitive personal data and are used only to confirm it is you and to prevent fraud.
2.3 Financial data
- Payment requests, payments, Pix sent and received, Pix keys, balances, withdrawals and statements.
- For card sales: cardholder name, card network, issuing country, last 4 digits and authorization result. Full card numbers and security codes are handled only by PCI DSS certified partners. TchinPay does not store them.
2.4 Buyer data
When someone pays a merchant through TchinPay, we receive the data needed for the payment, such as name, ID number, email, country and transaction details.
2.5 Access and device
IP address, date and time of access, browser and device type, operating system and authentication logs. This data helps protect the account and is required by Brazil's Internet Civil Framework (Marco Civil da Internet).
2.6 Support
Messages, files and information you send us when asking for help.
3. What we use it for, and on what legal basis
| Purpose | Legal basis (LGPD) |
|---|---|
| Open and maintain your account, carry out payments | Performance of a contract (art. 7, V) |
| Verify identity and prevent money laundering | Legal or regulatory obligation (art. 7, II) |
| Confirm identity with biometrics | Fraud prevention and data subject security (art. 11, II, g) |
| Detect fraud and protect the account | Legitimate interest (art. 7, IX) and credit protection (art. 7, X) |
| Keep access logs | Legal obligation, Marco Civil da Internet (art. 7, II) |
| Respond to authorities and defend rights | Legal obligation and exercise of rights (art. 7, II and VI) |
| Improve the product using aggregated data | Legitimate interest (art. 7, IX) |
| Send news and offers | Consent (art. 7, I), which you can withdraw at any time |
We do not sell your personal data.
5. International transfers
Some partners, such as card networks and cloud providers, may process data outside Brazil. In those cases we apply the safeguards set out in the LGPD, such as contractual clauses and partners in countries with adequate protection. For sales to Buyers abroad, the transfer is also necessary to carry out the payment.
7. How we protect it
- Encryption of data in transit and at rest;
- Two-step verification and extra confirmation for sensitive actions;
- Internal access limited to those who need it, with access logs;
- Continuous monitoring against fraud and unauthorized access.
No system is 100% immune. If a security incident may cause relevant risk or harm, we will notify you and Brazil's National Data Protection Authority (ANPD), as required by law.
8. How long we keep it
- While your account is active, we keep the data needed to provide the service.
- Access logs are kept for at least 6 months, as required by the Marco Civil da Internet.
- Sign-up and transaction data are kept for the minimum period required by anti-money-laundering and tax rules, even after the account is closed.
- After these periods, data is deleted or anonymized.
9. Your rights
Under the LGPD (art. 18), you may ask at any time for:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
- portability to another provider;
- information about who we share it with;
- withdrawal of consent, where consent is the legal basis;
- review of automated decisions that affect your interests, such as declined sign-ups or risk blocks (art. 20).
Some requests may be limited where the law requires us to keep the data.
10. How to delete your account
You can close your account from the dashboard. Withdraw your available balance first. After closure, we delete or anonymize data we no longer need and keep only what the law requires, for the required period.
11. Children and teenagers
TchinPay accounts are for people aged 18 or over only. We do not knowingly collect data from minors. If we find out this has happened, we will delete the data unless the law requires otherwise.
12. Contact and ANPD
To exercise your rights or ask about privacy, contact us through support inside your account dashboard or the official channels listed on the website. If you are not satisfied with our answer, you can also contact Brazil's National Data Protection Authority (ANPD).
13. Changes to this Policy
We may update this Policy. The version and effective date are always shown at the top of the page, and relevant changes will be announced in the dashboard or by email.