Privacy policy

1. Who processes the data

Clubbo is operated by Carbono Tecnologia & Instituição de Pagamento Ltda (CarbonoTech), CNPJ 30.037.007/0001-49, Rua José Vedovatto, 2010, Sala 01, Jardim Bom Retiro, Sumaré/SP, CEP 13181-680. The data protection officer (LGPD, art. 41) is Yuri Santos, at privacidade@clubbo.com.br.

2. Three groups of people, two roles

• Visitors to this site (clubbo.com.br): Clubbo is the controller.
• Stores that hire Clubbo (person in charge and team): Clubbo is the controller.
• Store customers, who take part in each store’s club: the store is the controller and Clubbo is the processor, handling the data only to run that store’s program, following its instructions (LGPD, art. 39). Requests about this data go first to the store, through the privacy contact shown in its club.

3. Site visitors

This site does not use ad pixels or browsing analytics tools. Your browser only keeps:

• a clubbo-tema cookie with your choice of light or dark theme (a preference that does not identify you);
• a clubbo-idioma cookie with the language you chose (Portuguese, English or Spanish), so the site does not switch languages on your next visit. It is needed for the site to work the way you asked, does not identify you and lasts 12 months;
• the h-utm entry, saved by the support chat (see below) in the browser’s local storage only when you arrive through a campaign link (with tags such as utm, gclid or fbclid) or from another website. It keeps that origin and the time you arrived, is only used for up to 30 minutes after you arrive (a period we renew while you stay on the site) and stays in the browser until it is replaced or you clear the site’s data;
• a start-of-visit marker (h-inicio-visita), which disappears when you close the tab and is only used to tell whether the origin belongs to this visit.

The server keeps technical logs (IP address, date, page requested), for security and under the Marco Civil da Internet (art. 15).

Support chat

The "Talk to us" button opens the support chat of Dyamante CRM, a company in the same group, which runs on the WTS platform (wts.chat). Once the page finishes loading, the site fetches the chat program from WTS servers; at that point WTS receives, as with any website, your IP address and your browser’s technical data. The chat window itself is only set up when you get close to the button (hover over it, tap it or reach it with the keyboard) or click it.

In the chat we process what you write, the data you provide (such as name and phone number), the page you were on, your browser’s technical data and the origin of the visit (the campaign or website you came from). The purpose is to answer you, present Clubbo and, where applicable, prepare the subscription.

Legal bases: for the conversation and your contact details, preliminary steps toward a contract taken at your request (LGPD, art. 7º, V), since you are the one who opens the chat and asks to be contacted; for recording which campaign or website the contact came from, Clubbo’s legitimate interest in knowing which promotions bring in customers (LGPD, art. 7º, IX, and art. 10), using only the origin already present in the link and without building a browsing profile. You can object: clear the site’s data before opening the chat or write to privacidade@clubbo.com.br.

Conversations and contact details are kept in Dyamante CRM while the support lasts. If you subscribe to Clubbo, they follow the store rules in this policy; if you do not, they are deleted within 12 months after the last contact.

The first reply in the chat comes from a virtual assistant powered by artificial intelligence, which uses third party AI models (such as OpenAI models) to understand and answer your messages; a person from our team takes over when you ask or when the assistant cannot answer. The assistant does not make decisions that affect you: it only answers questions and routes the conversation.

The conversation may continue on WhatsApp. If the chat does not load (because of a blocker, a company network or a failure), the button opens WhatsApp directly. We use what you write to reply and, where applicable, to prepare the subscription (LGPD, art. 7º, V). The conversation is also subject to the rules of WhatsApp, a Meta service.

4. Stores: sign-up and use of the dashboard

To prevent abuse, sign-up on the website limits attempts per IP address and checks whether the CNPJ and email already have an account.

5. Store customers (as processor)

Name, phone, date of birth, email and CPF when provided, how the customer arrived at sign-up (club, store website, link, QR code or counter), and the program history: purchases, receipts sent, balance, stamps, tier, gift cards, referrals, satisfaction survey answers and the tags the store adds. Each store’s data is kept separate: a customer does not appear in another store’s club, even with the same phone number.

The store, as controller, chooses the legal bases. Clubbo was designed to work like this:

Receipts by QR code

When the customer sends an NFC-e through the club, the receipt’s access key is checked with SEFAZ through Infosimples to verify the amount, date, issuer and whether the receipt was canceled. If the store turned on automatic approval, the receipt may be approved automatically (the CPF on the receipt matches the one registered) or rejected automatically (different amount, canceled receipt, from another store or too old), always with the reason shown on the customer’s screen. The CPF on the receipt is compared and discarded: we keep only whether it matched, plus the access key, the issuer’s CNPJ, number, series, date and amount.

The customer may ask the store to review any automated decision and explain the criteria used (LGPD, art. 20).

Receipts by photo

If the QR code won’t scan, the customer can send a photo of the receipt. The photo is re-saved without location data, stored encrypted and without a public link, and read by artificial intelligence (Anthropic) only to extract the access key, CNPJ, number, series, date and amount; the reading does not transcribe the CPF, name or items. The decision is always made by the store, viewing the photo in the dashboard.

The receipt photo is deleted 90 days after the store’s decision (approved or rejected). This period covers disputes over the decision; after that, the purpose has ended and the photo is deleted (LGPD, arts. 7º, VI, 15 and 16). If the customer deletes their account, their photos are deleted in the next run, without waiting for the period.

WhatsApp and email messages

Messages are sent through WhatsApp, via Meta’s official API, in two types. Account notifications (balance earned, balance about to expire, tier change, stamp earned, gift card about to expire and the satisfaction survey invitation) are part of the program: they are on by default, the customer is told at sign-up and can turn them off at any time. Promotions (birthday, campaigns, come-back invitations, card completed, gift card received) are sent only to those who opted in; we record when and where consent was given. Email campaigns have their own consent, separate from WhatsApp, and every email has an unsubscribe link. The club access code is sent through WhatsApp because the customer asks for it. To stop, just reply SAIR, turn it off in the profile or use the link in the email. Notifications to stores (welcome, billing, weekly summary) are sent by email, through the merchant app and, when enabled, through the platform’s WhatsApp.

Satisfaction survey

If the store turns it on, after a purchase the customer receives, along with account notifications, a link to give a score from 0 to 10 and, optionally, a comment. Answering is optional. The score and comment stay with the store to improve its service; the comment is not included in notifications or technical logs. Customers who turn off notifications or reply SAIR do not receive the survey.

Tags and groups

The store can tag customers and create groups based on purchase history (new, frequent, at risk, birthdays and others) to choose who receives a campaign. This does not change balances or program rules, and campaigns still go only to those who opted in to promotions. Tags with sensitive data (health, religion, racial origin, sex life, political opinion) are rejected by the dashboard.

Store predictions (consumption profile)

Every night Clubbo calculates, for each store and only from purchases made there (dates and amounts), each customer’s likelihood of returning, the probable window for their next purchase and the expected value over 12 months, as well as projections for the store itself (revenue, best time to send messages). One store’s data never enters another store’s calculations. The purpose is for the store to invite customers back, thank them and offer benefits; the prediction is never used to worsen conditions, balances, tiers, benefits or service, nothing is done automatically because of it and it is not used in draws. Age and sensitive data are not criteria. The criteria are explained in the store’s dashboard, and the customer can ask to know them, request a review and ask not to be profiled (LGPD, art. 20): in the club, through the "Store predictions" switch in the profile, or through the store’s privacy contact. A request not to be profiled deletes the estimates immediately. If the store turns on the artificial intelligence text summary (Anthropic), only the store’s totals and counts are sent, with no customer names, phone numbers, CPFs or purchases.

Minimum age

The club is only for people aged 18 or over. In the club, the date of birth is mandatory; at the counter, the store confirms the customer’s age before signing them up. Clubbo must not process data of children or adolescents (LGPD, art. 14).

6. Who we share data with

We do not sell data and we do not use store customers’ data for our own purposes. The suppliers below receive only what is necessary:

7. International transfer

The servers are hosted by DigitalOcean, in New York (United States), and other suppliers on the list also process data outside Brazil. The LGPD only allows such transfers under one of the mechanisms in art. 33. The mechanism chosen by Clubbo is the ANPD standard contractual clauses (art. 33, II, b; Resolução CD/ANPD nº 19/2024), which we are formalizing with each supplier. To learn the status of each one, write to privacidade@clubbo.com.br.

8. How long we keep data

Anonymizing, here, means changing the data in a way that cannot be reversed: an encrypted or scrambled code is still personal data and does not count as anonymization.

9. Security

Encrypted traffic, passwords stored as hashes, encrypted WhatsApp tokens and receipt photos, role-based dashboard access and logging of sensitive actions. No system is immune to incidents; if one affects your data, we will notify you and, when the law requires, the ANPD (Resolução CD/ANPD nº 15/2024).

10. Your rights

You may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, information about the consequences of not giving consent and withdrawal of consent (LGPD, art. 18), as well as review of automated decisions (art. 20). Full access requests are answered within 15 days (art. 19, II). In the club, customers edit, download and delete their own data from their profile. For anything else, write to privacidade@clubbo.com.br. If you are a store’s customer, the request can also go to the store’s privacy contact, since the store is the controller. You may also file a complaint with the ANPD.

11. Changes to this policy

When we change this policy, the update date at the top of the page changes. If the change requires a new acceptance, the effective date changes too. Changes relevant to stores are announced in the dashboard.

See also the Terms of use.