397655: Privacy Policy and Data Protection
This page explains how the domain 397655.com handles personal data in the web environment identified as /privacidade/. The text below was structured for quick reading, with a focus on transparency, LGPD, and practical site use. Where verifiable facts were missing, the point was marked for review.
Short read for those who want to get straight to the point
The site brings together entry routes, game areas, promotions, FAQ, and contact. In operations such as registration, account access, deposits via PIX, withdrawals, VIP, rebate, and campaigns, some personal data may be processed for authentication, account operation, fraud prevention, support, and compliance with legal obligations.
One should not assume automatic collection of CPF, bank details, date of birth, or documents without a basis in the actual form. Here, what was actually confirmed is what counts. What did not appear in the material remains pending.
Useful site routes
The pages below help the user understand the operation and locate additional information without leaving the domain.
What this policy covers
The policy exists to explain, in plain language, which data enters the site flow, why it is used, and with whom it may be shared. It also organizes what happens in cases of registration, browsing, coupon use, sending a message to support, PIX operations, and access to internal account areas.
It does not replace the Terms of Use. The two pages work together: the terms deal with the rules of the experience, while the privacy policy deals with data processing.
Which personal data may be collected
The form and site routes indicate use of +55 for phone, password, and password confirmation in registration. From there, processing may vary depending on whether the user logs in, deposits, withdraws, participates in campaigns, or contacts support.
| Category | Verified or plausible examples in the site flow | Typical purpose | Status in the material |
|---|---|---|---|
| Registration and login | Phone with +55, password, password confirmation, account identifiers | Create account, authenticate access, recover session, prevent unauthorized access | Partially confirmed |
| Account and operation | Profile, balance, deposit, withdrawal, transaction history | Execute account features and track transactions | Confirmed as product area |
| PIX and payments | PIX-1 to PIX-4 flows, amounts displayed between R$ 10 and R$ 50,000 | Process a deposit or withdrawal and validate the operation | Confirmed as interface |
| Promotions and VIP | Participation in bonuses, rebate, referral, seven VIP levels, and associated benefits | Manage eligibility, unlock benefits, and record offer usage | Confirmed as business functionality |
| Support and contact | Messages sent to the official channel, service records, user feedback | Respond to requests and resolve incidents | Dependent on the official channel |
| Technical data | IP, date/time, browser, device, cookies, and logs | Security, auditing, stability, and usage analysis | Not detailed in the input |
If CPF, identity document, proof of ownership, PIX key, address, or e-mail are collected, this must appear explicitly in the form or in the official policy. Without this confirmation, do not invent it.
How the data is used in practice
Sign in and authenticate
Phone number, password, and technical signals help open the account, maintain access, and reduce unauthorized login attempts.
Manage balance and PIX
Deposit, withdrawal, and movement require operational validation. The system needs to record the request and status.
Support and audit
Support messages, campaign history, and logs can be used to resolve tickets and review inconsistencies.
Most common cases
- create and manage the account;
- unlock internal features, such as balance, withdrawal, and profile;
- process promotions, bonuses, rebate, VIP, and referrals;
- comply with legal, regulatory, or fraud prevention requirements;
- respond to requests on the official support channel.
Legal bases for processing
Not every use of data depends on consent. In account operations and security, other bases may apply. When the purpose is unknown or has not yet been confirmed in the official text, the passage must be marked for review.
| Processing | Potentially applicable legal basis | Note |
|---|---|---|
| Registration and authentication | Performance of a contract or preliminary procedures | Depends on the final policy and the actual account creation flow. |
| User support | Performance of a contract and legitimate interest, as applicable | It is necessary to align with the support channel used. |
| PIX and financial operations | Performance of a contract, legal/regulatory obligation, and fraud prevention | The payment provider was not provided in the received material. |
| Promotions, bonuses, and VIP | Performance of a contract, legitimate interest, or consent, depending on the campaign | Offer and opt-in need to be described precisely. |
| Cookies and measurement | Consent for non-essential cookies, if there is a banner or manager | A preferences panel was not proven in the input. |
Information security, retention, and deletion
The submitted material did not confirm measures such as specific encryption, 2FA, backup policy, or profile-based access control. Therefore, it is only safe to state that the site must adopt technical and organizational measures compatible with the risk of processing.
In practice, it is common to keep records for a period compatible with operations, support, anti-fraud, and legal requirements. If there is a retention obligation, it takes precedence over an immediate deletion request. The data subject may request deletion when the legal basis allows it, but not everything can be removed right away.
- keep the password in a private environment;
- always check the domain before entering data;
- avoid resending receipts through unofficial channels;
- use trusted devices for PIX and login.
Data subject rights under the LGPD
The user may request confirmation of processing, access, correction, anonymization, blocking, deletion when applicable, portability within the limits of the law, information about sharing, and review of automated decisions, if any exist.
It is also possible to withdraw consent when that basis was used. This does not automatically erase data that must be kept due to a legal obligation, fraud prevention, or defense in legal proceedings.
Identify the request
Explain whether you want access, correction, deletion, information about sharing, or withdrawal of consent.
Use the official channel
The request must follow the contact actually published on the institutional page or in the support area.
Wait for analysis
Some data may require identity validation and verification of legal obligations before any final response.
Cookies and similar technologies
Browsing the domain may use cookies, pixels, or technical records to remember the session, measure stability, and understand usage. The input did not confirm a consent manager, so the final text must reflect what actually appears on the page /cookies/.
- Essential: allow login, browsing, and session maintenance;
- Operational: help with account, balance, withdrawal, and internal routes;
- Analytical: measure accessed pages and performance, if enabled;
- Marketing: may be used in campaigns and promotions, if there is a basis and proper notice.
If the visitor wants to review preferences, the cookies page should concentrate that guidance. Without that panel, the user needs clear instructions in the text itself.
Data sharing with third parties
The submitted material did not list specific providers. Therefore, it is not correct to name payment, hosting, analytics, or anti-fraud companies without proof. What can be said is that sharing, when it occurs, usually serves to process payment, maintain the infrastructure, provide support, or comply with the law.
If the user uses PIX, the journey may involve participating institutions in the payment arrangement. If there is an external communication tool, it must also be informed. All of this needs to appear concretely in the final text.
Storage, retention, and international transfer
The retention period was not informed in the received material. The effective text must indicate how long each data group is kept or what criterion defines deletion. Without that, the reader has no practical reference.
There was also no confirmation of international transfer. If there are servers, tools, or providers outside Brazil, the policy must declare the flow and the basis used for that transfer, with the appropriate protection.
Minors, policy changes, and contact
Protection of minors
If the site is not intended for minors, this must be stated expressly. If there is accidental collection, the review procedure needs to be described in the official text, without promising automatic blocking that does not exist.
Changes to this policy
This page may be updated to reflect changes in product, providers, payment methods, support, or legal requirements. The effective date must appear in the published version.
Privacy contact
Use only the contact channel that is actually confirmed for the domain. If there is a specific support or contact page, it must guide the submission of privacy requests. When there is a data protection officer, the name and official contact method must be inserted based on documentary evidence.
Frequently Asked Questions
What data does the site actually ask for during sign-up?
Based on what was confirmed in the material, the sign-up flow uses a phone number in +55 format, a password, and password confirmation. Other fields, such as CPF or date of birth, should not be assumed unless they appear in the actual form.
What can be used for deposit and withdrawal?
The interface shows operations related to balance, deposit, withdrawal, and PIX, including value ranges displayed between R$ 10 and R$ 50.000. This describes the site journey, but it does not authorize inventing which institutions process the money.
Does user data go into promotions and VIP?
It can, if the offer mechanics require eligibility, usage history, or participation in campaigns. The final text should say which data is used for each bonus, rebate, referral, or VIP level.
Can I request access to or correction of my data?
Yes. The LGPD provides for access, correction, and other similar requests. The request must follow the official channel published by the domain and may require identity confirmation before a response.
Are all cookies mandatory?
Not necessarily. In general, essential cookies keep the session and access active. Analytics or marketing cookies depend on what was actually installed and on the notice shown to the user.
Does the deletion request erase everything right away?
No. Deletion may be limited by legal obligation, defense of rights, fraud prevention, or minimum record retention. What can be removed immediately must be defined case by case.
How do I get in touch about privacy?
Use the domain's official contact page or the channel indicated in support. Without this confirmed data, it is not correct to publish an invented email or phone number in the policy.
Does the site handle data on mobile the same way?
Data handling on mobile follows the same logic as the site, but there may be differences if there is an app, PWA, or native permissions. Since this detail was not confirmed, the final text should separate mobile web from app, if necessary.
Here is the version for final review
This structure prioritizes clarity, LGPD, and quick reading. Before publishing, confirm the controller, the official privacy contact, the update date, the providers involved in PIX and cookies, and the actual retention periods. Without this check, the page remains an operational draft.