LUNIUMPrivacy Policy
1. Controller
ZANQUETA INTERMED LTDA, Brazilian company registry (CNPJ) 68.538.127/0001-00, headquartered in Americana, São Paulo, is the controller of the personal data processed at Lunium and Venda Cripto, under Brazilian Law nº 13.709/2018 (LGPD, the Brazilian data protection law). Privacy contact: contato@luniumpay.com.
When an operation arrives through a partner company's API, the partner is the controller of its end customer's data and Lunium acts as processor for settlement — without prejudice to the records the law obliges us to keep in our own name (payment identification, end-to-end identifier and operation data).
2. What data we collect
- Identification: CPF or CNPJ of the paying party (cash-in), contact email and, for partner companies, the registration data of the API key.
- Operation data: amount, asset, network, destination or refund address, receiving PIX key and the PIX end-to-end identifier (E2E).
- Technical data: IP address, browser and device information, for security and fraud prevention.
- PIX key ownership: the holder's name and tax ID, obtained from the PIX system directory when a key is given to receive funds.
We do not collect banking passwords, private keys or recovery phrases — and we will never ask for them.
3. Why we process it
- Performing the requested operation (LGPD art. 7, V).
- Compliance with legal and regulatory obligations — identification, record keeping and reporting to authorities (art. 7, II).
- Fraud prevention and security (art. 7, IX and art. 11, II, "g").
- Communication about the operation: receipt, delivery, refund, technical notices to partners.
4. Who we share it with
Only what the operation requires in order to exist: infrastructure and payment settlement providers, the partner company through whose API the operation was requested, and public authorities when required by law or court order. We do not sell personal data and we do not release it for third-party advertising.
5. How long we keep it
Operation records are kept for at least 5 (five) years, the period required by anti-money-laundering legislation. Once the legal period ends, the data is deleted or anonymized.
6. Where each piece of data lives
In our systems: the tax ID provided, the email, the data of each operation and the technical access records — IP address, browser and timestamp. On Venda Cripto, also your name and profile photo when you sign in with Google. This is what the law requires to be identified and kept, and it is what lets us evidence an operation and investigate fraud.
On your device only (Venda Cripto): the shortcut list of your recent operations, so the screen loads faster. That local copy can be erased at any time under Profile → Erase data from this device — this does not change or cancel any operation, and it does not erase the records we are required to keep.
7. PIX key confirmation
When a PIX key is given to receive funds, we confirm the name and tax ID of that key's holder with the financial institution. The source of that data is the PIX system directory, not the user — we state this in compliance with LGPD art. 9. The purpose is twofold: to ensure the money reaches exactly the party indicated, and to meet the identification required by Law nº 9.613/1998 and by Brazilian Federal Revenue Normative Instruction nº 2.291/2025.
8. Open verification
Public verification of a payment by its end-to-end identifier (E2E) confirms only that the PIX was settled by Lunium, plus the amount and date; it never exposes the PIX key, the name or the tax ID of the parties.
9. Your rights
You may request confirmation of processing, access, correction, portability, anonymization and information about sharing. Deletion is possible where there is no legal retention obligation. Just write to contato@luniumpay.com.
10. Security
We adopt technical and administrative protection measures, including encrypted transport, access control, API keys stored only as a cryptographic digest, and encrypted backups with restore testing. No system is infallible: report any suspicion immediately.