Last updated: 6 October 2026.
Who handles your data
The controller is Cena 23, CNPJ 52.078.103/0001-78, Ricardo Krug's company. As a small processing agent, Cena 23 names no data protection officer (Resolução CD/ANPD nº 2/2022, art. 11). The channel for any request about your data is contato@ricardokrug.com.br.
What data we collect
Account: name, email, the optional WhatsApp number, the consent boxes you checked, and their dates.
Forms on the automation pages: name, email, the optional WhatsApp number, company and role when the form asks, and the answers you write.
Course: the lessons marked as done and the purchases (course, price, status). Payment happens at Asaas, which keeps the payment data.
Abuse protection: a code derived from the IP address (an HMAC), never the IP itself, to limit repeated sends.
Visits: Umami counts visits with no cookies and no personal data.
Why, and on what legal basis
To deliver the course and keep your account: performance of a contract (LGPD, art. 7, V).
To answer a request from a form: steps before a contract, at your request (art. 7, V). I use WhatsApp for it only when you check the box.
To send news by email or WhatsApp: your consent (art. 7, I), which you can withdraw at any time on the account page.
To limit repeated sends and stop spam: legitimate interest (art. 7, IX).
To keep purchase records: a legal and tax obligation (art. 7, II).
Who we share it with
The processors that run the site: Vercel (hosting), Neon (database), Resend (email delivery), Asaas (payments), Mux (lesson video), and Umami (visit counts). A WhatsApp chat goes through Meta.
Vercel, Neon, Resend, Mux, Umami, and Meta process data outside Brazil. That international transfer follows Resolução CD/ANPD nº 19/2024.
I do not sell your data or hand it over for any other use.
How long we keep it
A form request is deleted automatically 12 months after it arrives.
The account stays while it exists; ask for its deletion by email.
Purchase records stay for the period tax law requires.
The abuse-protection code is deleted within two days of the last send.
Cookies
The site sets a session cookie to keep you signed in and a cookie with the language you picked. It sets no tracking cookies.
Your rights
Under the LGPD (art. 18), you can ask for: confirmation that we process your data, access to it, correction, anonymization, blocking or deletion of data we do not need, portability, information on who we share it with, and the withdrawal of consent.
Write to contato@ricardokrug.com.br. You can also petition the ANPD.