Privacy Policy

1. Controller

ZANQUETA INTERMED LTDA, Brazilian company registry (CNPJ) 68.538.127/0001-00, headquartered in Americana, São Paulo, is the controller of the personal data processed at Lunium and Venda Cripto, under Brazilian Law nº 13.709/2018 (LGPD, the Brazilian data protection law). Privacy contact: contato@luniumpay.com.

When an operation arrives through a partner company's API, the partner is the controller of its end customer's data and Lunium acts as processor for settlement — without prejudice to the records the law obliges us to keep in our own name (payment identification, end-to-end identifier and operation data).

2. What data we collect

• Identification: CPF or CNPJ of the paying party (cash-in), contact email and, for partner companies, the registration data of the API key.
• Operation data: amount, asset, network, destination or refund address, receiving PIX key and the PIX end-to-end identifier (E2E).
• Technical data: IP address, browser and device information, for security and fraud prevention.
• Business contact: name, company, email, optional WhatsApp, use case, volume range, timeline, product stage and how you found out about Lunium, when you send the integration form.
• Attribution and navigation: the page you landed on, the UTM parameters in the address (utm_source, utm_medium, utm_campaign, utm_content, utm_term), the external site that brought you (referer), the source you declare in the form and a random per-tab identifier — no advertising cookie and no ad network. This is what we call the first touch, and it is stored in your browser: section 6 says where, for how long and how to erase it.
• PIX key ownership: the holder's name and tax ID, obtained from the PIX system directory when a key is given to receive funds.

We do not collect banking passwords, private keys or recovery phrases — and we will never ask for them.

3. Why we process it

• Performing the requested operation (LGPD art. 7, V).
• Compliance with legal and regulatory obligations — identification, record keeping and reporting to authorities (art. 7, II).
• Fraud prevention and security (art. 7, IX and art. 11, II, "g").
• Communication about the operation: receipt, delivery, refund, technical notices to partners.
• Answering integration requests, qualifying the case presented, releasing the sandbox you asked for and organizing commercial follow-up.
• Measuring how well our pages and acquisition channels work, with technical events that carry no name, email, tax ID, PIX key, wallet or transaction amount. When you send the form or create a key, however, that first touch travels together with your contact and is stored in the same record — that is how we know which path brought you here.

4. Who we share it with

Only what the operation requires in order to exist: infrastructure and payment settlement providers, the partner company through whose API the operation was requested, and public authorities when required by law or court order. We do not sell personal data and we do not release it for third-party advertising.

Being specific about the form, because "infrastructure provider" does not describe this well: when a new contact arrives, our bot relays the email, the message and the other fields you submitted to the internal support chat on Telegram — the messaging tool our operations team works in. This happens whether or not the technical-contact box is ticked: it is what makes someone read and answer. The destination is a private team chat, not an open group or a public channel, and Telegram acts there as the provider carrying the message.

5. How long we keep it

Operation records are kept for at least 5 (five) years, the period required by anti-money-laundering legislation. Once the legal period ends, the data is deleted or anonymized.

Data sent through the business form is kept for as long as it is needed to reply, follow a possible integration and record the contact authorization. It is reviewed periodically and may be deleted or anonymized when there is no active relationship, legal obligation or need to defend our rights. You can ask for deletion through the channel in section 9.

5.1. Contact prioritization

The form may compute a priority using only the information you sent — volume range, timeline, product stage, use case, company and reply channel. That ranking only orders the support queue: it does not approve production, set pricing, grant credit or refuse a contract. You can ask for an explanation or a review at the privacy address.

5.2. Technical-contact authorization

Ticking "I authorize technical contact about this integration" is optional and the screen says so: your message arrives and gets answered either way. What the authorization changes is that we record the date and time it was given and, if you create an API key on the same screen, we link that contact to the key created. The link is made through a single-use code your browser receives, uses immediately and stores nowhere; on our side only the cryptographic digest of that code is kept. The link tells us who to talk to about that key's integration — it does not change pricing, limits, approval or any condition of the key.

Two things we would rather state than hide. First: unticking the box on a later submission does not erase the authorization already recorded — the timestamp stays until we remove it. Second: we do not keep a copy of the exact wording that was on screen when you ticked it, only the timestamp. To revoke, write to contato@luniumpay.com; revocation is done by hand by our team, and the message itself remains subject to the retention in this section.

6. Where each piece of data lives

In our systems: the tax ID provided, the email, the data of each operation and the technical access records — IP address, browser and timestamp. On Venda Cripto, also your name and profile photo when you sign in with Google. This is what the law requires to be identified and kept, and it is what lets us evidence an operation and investigate fraud.

On your device only (Venda Cripto): the shortcut list of your recent operations, so the screen loads faster. That local copy can be erased at any time under Profile → Erase data from this device — this does not change or cancel any operation, and it does not erase the records we are required to keep.

On your device only (luniumpay.com): the first touch, in the browser's local storage, under the key lunium.origem.v1. It holds the UTM parameters, the external site that brought you, the page you landed on and the date. Correcting what this policy said until September 8, 2026: that record is not per tab and does not die when you close the browser — it stays on that device until erased, so that someone who arrived through one channel and came back weeks later is still credited to that channel. We never store a name, email, tax ID, PIX key, wallet or amount there.

Also on your device only (luniumpay.com): the tab identifier, a random number drawn on the spot, tied to nothing about you and to no other site. It exists only so we can tell that the steps we observe came from the same tab — without it, one person opening three pages would look like three people. It sits in the browser's session storage, under the key lun_sid, and dies when you close the tab — unlike the first touch in lunium.origem.v1, which sits in local storage and stays on that device until erased.

How to erase it: clear your browser's site data for luniumpay.com and docs.luniumpay.com (usually Settings → Privacy → Site data and permissions). A private window keeps nothing between sessions. Erasing cancels no operation, invalidates no key and removes nothing already stored on our side.

That first touch leaves your device in three situations, and only those. When you click from luniumpay.com to docs.luniumpay.com: the parameters travel in the link address, because local storage is not shared across subdomains and the origin would otherwise be lost in the jump. When you send the form or create an API key: then it is sent along with your contact and stored in the record, subject to the retention in section 5. And, without you clicking anything, on every visit to a page of the site that measures the funnel: as it loads, the page tells our own server that the visit happened, and that notice carries four fields and nothing beyond them — the step observed (ev), the page path (pg), the first-touch source (src) and the tab identifier (sid). The steps observed are things like opening the page, reading to the end of it, clicking through to the documentation or the sandbox, and submitting the form.

That measurement is ours, and only ours: the notice goes to an address on the site itself (/e), which answers empty and has no database or analytics service behind it — what remains is a line in the server's access log, just like for any other page opened. There is no cookie, no ad network and no third party receiving this. Name, email, tax ID, PIX key, wallet and amount never go into that notice.

7. PIX key confirmation

When a PIX key is given to receive funds, we confirm the name and tax ID of that key's holder with the financial institution. The source of that data is the PIX system directory, not the user — we state this in compliance with LGPD art. 9. The purpose is twofold: to ensure the money reaches exactly the party indicated, and to meet the identification required by Law nº 9.613/1998 and by Brazilian Federal Revenue Normative Instruction nº 2.291/2025.

8. Open verification

Public verification of a payment by its end-to-end identifier (E2E) confirms only that the PIX was settled by Lunium, plus the amount and date; it never exposes the PIX key, the name or the tax ID of the parties.

9. Your rights

You may request confirmation of processing, access, correction, portability, anonymization, information about sharing, and revocation of the technical-contact authorization. Deletion is possible where there is no legal retention obligation.

How to ask, in practice:

• Where to write: contato@luniumpay.com — the same address in this site's footer. It is our privacy channel; we do not handle data subject requests through social media or messaging groups.
• What we ask to confirm it is you: write from the same email address you used with us and say what you want (access, correction, deletion, revoking technical contact). If the request concerns an operation, give the end-to-end identifier (E2E) or the date and amount. If we still cannot match the request to a record, we ask for one extra detail only the data subject would know — never a password, private key or recovery phrase.
• Deadline: we reply to the same email address, following LGPD art. 19: up to 15 days for the full declaration about your data.
• What you erase yourself: the first touch stored in your browser (section 6) is erased by you, in your browser settings, without talking to us.
• If the answer is no: we tell you which legal obligation prevents deletion and for how long it applies. You may also complain to the ANPD, the Brazilian data protection authority.

10. Security

We adopt technical and administrative protection measures, including encrypted transport, access control, API keys stored only as a cryptographic digest, and encrypted backups with restore testing. No system is infallible: report any suspicion immediately.