Privacy Policy

1. Who is responsible for your data

The controller of the data processed on this site is Conn2Flow LTDA, tax ID (CNPJ) 62.890.167/0001-22. Privacy requests are received at contact@conn2flow.com, the channel of the data protection officer.

This policy applies to the conn2flow.com site, the store, the subscriptions and the customer area. It does not apply to installations of the Conn2Flow software made by third parties: whoever installs the software on their own server is the controller of the data in that installation.

The site is operated from Brazil and follows the Brazilian General Data Protection Law (LGPD, Law 13,709/2018).

2. Which data we process

When	Data	What for	Legal basis (LGPD)
You create an account	Name, e-mail, password (stored as a hash) and, if you enable it, the second authentication factor	To identify you and protect access	Performance of a contract
You buy or subscribe	Items, amounts, billing data, address and postal code for delivery of physical products	To process the order, deliver, issue tax documents and provide support	Performance of a contract and legal obligation
You pay	The payment is processed by Stripe. We neither receive nor store the card number: we store the transaction identifier and the result	To charge, confirm and refund payments	Performance of a contract
You hire hosting	Domain, user and settings of the hosting account	To create and run your hosting	Performance of a contract
You send a form	Name, e-mail and the message	To answer your contact	Pre-contractual steps or legitimate interest
You arrive through an affiliate link and allow marketing cookies	The referral code, in a cookie	To credit the commission to whoever referred you	Consent
You allow statistics	Pages visited, time on page, device, approximate location and Google Analytics identifiers	To measure how the site is used and what to improve	Consent
You browse	IP address, browser, pages accessed and security records	To keep the site running and prevent fraud and abuse	Legitimate interest and legal obligation (Brazilian Internet Civil Framework)

We do not process sensitive personal data and we make no automated decisions that produce legal effects on you.

3. Cookies

A cookie is a small file the site stores in your browser. The necessary ones do not depend on consent; the others are used only if you allow them. You choose in the cookie notice and can change your mind at any time in Cookie preferences.

Cookie	Category	What for	Duration
`_C2FSID_*`	Necessary	Session: keeps the cart, the form in progress and the protection against forged requests	3 hours
`_C2FCVID_*`	Necessary	Browser verification, used in session security	Browser session
`_C2FCID_*`	Necessary	Keeps you signed in after login	15 days, renewed on use
`_C2FCP_*`	Necessary	Account profile, to serve the right layout	15 days
`_C2FCL_*`	Necessary	Chosen language	While the choice lasts
`c2f_consent`	Necessary	Stores your cookie choice	180 days
`c2f_hestia_access_domain_pref`	Necessary	Access preference for the hosting panel, in the customer area	1 year
`_ga`, `_ga_*`	Statistics	Google Analytics 4: tell visitors and sessions apart to measure site usage. They exist only if you allow the category	2 years
`c2f_ref`	Marketing	Code of the affiliate who referred your visit. It is stored only when you arrive through a referral link and allow marketing cookies; if you withdraw the permission, it is deleted	60 days

To measure site usage we use Google Tag Manager and Google Analytics 4, from Google. They are loaded only after you allow the "Statistics" category in the cookie notice: without permission, the site makes no request to these services. With permission, Google Analytics stores the _ga and _ga_* cookies and receives browsing data, such as pages visited, time on page, device type and approximate location. Advertising tools, when used, fall under the "Marketing" category, under the same rule.

Third-party services that appear at specific moments may store their own cookies: Stripe, on the payment page, to prevent fraud; and the anti-bot verification service (Google reCAPTCHA or Cloudflare Turnstile, depending on the configuration), on forms.

4. Who we share with

Only with those who need the data for the service to work, and to the extent necessary:

Stripe: payment processing and fraud prevention.
Google: Google Tag Manager and Google Analytics 4, to measure site usage, only after your permission in the cookie notice.
Infrastructure providers: server hosting and delivery of transactional e-mails.
Anti-bot service: Google reCAPTCHA or Cloudflare Turnstile, in form validation.
GitHub: the download pages query the public GitHub API from your browser to show the latest version; GitHub receives your IP address in that query.
Carriers and postal service: name and address, when a physical product is delivered.
Authorities: when the law or a court order requires it.

We do not sell personal data. Some of these providers operate outside Brazil; in those cases the transfer follows the grounds of article 33 of the LGPD.

5. How long we keep it

Account data: while the account exists. After it is closed, the minimum needed to meet legal obligations.
Orders, charges and tax documents: for the period required by tax law and by the Brazilian Consumer Protection Code.
Access records: at least 6 months, as required by the Brazilian Internet Civil Framework.
Contact messages: for the time needed to answer and follow up on the matter.

6. Your rights

The LGPD guarantees that you can, at any time:

confirm whether we process data about you and access it;
correct incomplete, inaccurate or outdated data;
request anonymization, blocking or deletion of data that is unnecessary or processed against the law;
request portability;
request deletion of the data processed on the basis of your consent;
know who the data was shared with;
withdraw consent, which for cookies is done in Cookie preferences;
object to processing based on legitimate interest.

To exercise any of them, use the contact page. We answer within the legal deadline. You may also complain to the Brazilian National Data Protection Authority (ANPD).

7. Security

We use an encrypted connection (HTTPS), passwords stored as hashes, optional two-factor authentication, protection against forged requests, session management and logging of security events. No system is infallible: if an incident may cause relevant risk or harm, we will notify you and the ANPD, as the law requires.

8. Children and teenagers

The site is not aimed at people under 18 and does not intentionally collect their data.

9. Changes to this policy

When this policy changes, the date at the top changes with it. If the change affects cookies or purposes, the cookie notice appears again for you to decide once more.