Privacy policy
This policy follows the EU General Data Protection Regulation (GDPR), the UK GDPR and, for California residents, the CCPA, written here in plain language.
Who is responsible
The service is operated by Pathelle. For anything about your data, write to our team through the "Contact us" page.
What data we collect
- Name and email.
- Order data: items, amount, payment method (Pix or card) and payment status. We do not store your card number, expiry date or security code: they go straight to the payment provider, which sends us back only a charge identifier.
- Technical data: language, country, IP address, browser and ad parameters (UTMs, fbclid), plus Meta Pixel identifiers (_fbp and _fbc).
What we use it for
We use your data to deliver what you bought, handle support and refunds, measure our ads and protect the service from fraud. We do not sell your data.
If you ask to be notified when a product opens, we keep your email and the date of your consent only to send that single notice.
Legal basis
We process your data to deliver what you bought (contract), to meet legal obligations such as financial records, to protect the service against fraud (legitimate interest) and, where the law requires it, with your consent (for example, the opening notice).
Who we share it with
With the payment provider (card), to charge you; and with Meta, which receives purchase events through the Conversions API: email, first name and country in hashed form, purchase amount, IP address, browser and Pixel identifiers, when you arrive from an ad.
Cookies and pixel
We use essential cookies to remember your language and session. We also use the Meta Pixel, with ad parameters (UTMs, fbclid), to measure whether our ads work. You can block cookies in your browser or adjust your ad preferences on Meta.
Site measurement (no personal data)
To learn where people drop off and whether the site is fast, we record anonymous events from your visit: pages viewed, how far the page was scrolled, clicks on the buy button, steps of the form and of the test, payment opened, payment method chosen (Pix or card), purchase completed, delivery opened and download. Each visit gets a random code that stays only in the browser tab (sessionStorage) and disappears when you close it. It travels with the ad source (src and utm), the language, the device type (phone, tablet or computer) and the country. These events do not record your name, email or IP address, or what you type. We also measure the real speed of the pages (LCP, INP, CLS, TTFB and FCP) and check our own pages every day with Google PageSpeed Insights. These records are kept for 90 days. In the European Union, the European Economic Area, the United Kingdom and Switzerland, measurement only starts after you accept in the cookie notice. This brand also uses Google Analytics 4 to measure visits and purchases in aggregate; it only loads after your acceptance where the law requires it.
International transfers
Our providers (payment, hosting, email and Meta) may process data in other countries. When that happens, we require protection consistent with this policy and with the applicable law, such as standard contractual clauses.
How long we keep it
Retention periods. Access data (IP and browser) and ad identifiers are kept for 12 months, the same time your access link works, and are then anonymized. The order, name and email of the purchase are kept for 5 years, as tax law requires, and are then anonymized too. If you sign up and do not buy, your data is anonymized after 12 months. The email for the opening notice is deleted 30 days after the notice (or after 12 months, if the product does not open). An automatic routine of the service applies these periods.
Your rights
You can ask for access, correction, deletion, portability and to object to processing, and withdraw consent at any time, by writing to our team through the "Contact us" page. California residents can also ask what we collect, ask us to correct or delete it, opt out of sharing for advertising, and will not be treated worse for doing so. We do not sell your personal data for money. When you ask for deletion, we erase the data you sent us and end your access to the content, keeping only the financial record required by law.
To ask for deletion, open your access link and add /delete at the end of the address. We delete your access data and end your access; only the order and the email of the purchase remain, which tax law requires us to keep for 5 years.
You can also complain to your local data protection authority (in the UK, the Information Commissioner's Office).
Controller and data protection contact
The contact for data subjects and data protection matters is our team through the "Contact us" page.
Changes
If this policy changes, the version in force is always on this page.