This is a courtesy translation. If there is any difference between versions, the Portuguese version prevails.
Legal document
Privacy Policy
Summary
- Today we only collect your e-mail, to let you know when Circua opens.
- We don't sell your data, and we don't use private posts, circles or messages to choose ads.
- You decide: you can request access to, correction or deletion of your data at any time at contato@circua.com.
1. Who we are
Circua is a social network in its pre-launch phase, available at circua.com. The controller of personal data, that is, whoever decides how it is processed, is:
- Legal name
- Circua
- Address
- Brazil - Curitiba / PR
- Contact
- contato@circua.com
This policy follows the Lei Geral de Proteção de Dados Pessoais (Lei nº 13.709/2018, the LGPD, Brazil's General Data Protection Law) and the Marco Civil da Internet (Lei nº 12.965/2014, Brazil's Internet Civil Framework).
2. Terms used
- Personal data
- Information that identifies you or makes it possible to identify you, such as your name, e-mail or IP address.
- Data subject
- You, the person the data refers to.
- Processing
- Any operation performed on data: collection, use, storage, sharing, deletion.
- Controller
- Whoever makes the decisions about processing. Here, Circua.
- Processor
- A company that processes data on Circua's behalf, such as the hosting service.
- Data Protection Officer (DPO)
- The person appointed to communicate with you and with the ANPD about personal data.
- ANPD
- Autoridade Nacional de Proteção de Dados (Brazil's National Data Protection Authority), the body that enforces the LGPD.
3. What data we process
Now, on the waitlist
- E-mail you provide in the form.
- Date and time of sign-up and the source page of the registration.
- Access logs for the website: IP address, date and time, as required by the Marco Civil da Internet.
Once the network is live
- Registration data: name, username, e-mail, date of birth and password (stored irreversibly).
- Profile: photo, bio, city and anything else you decide to show.
- Content: posts, comments, replies, reactions, photos, stickers, topics and participation in communities.
- Circles: who you put in each circle. These names and lists are visible only to you.
- Connected accounts: if you connect YouTube, Facebook, Instagram or X, we receive only what you authorize on that network's own screen.
- Technical data: device type, browser, operating system, access and security logs.
- Region: the city and state you enter in your profile, if you choose to. Without this information, we use the approximate city calculated from your IP address at the time of access, using a database kept on our own servers and without storing location history. We never use GPS.
We do not ask for sensitive data, such as religion, health or political opinion. If you yourself post something like that or join a community about these topics, only the audience you chose can see it, and the communities showcase on your profile can be hidden.
4. What we use it for and on what legal basis
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Notify you about the launch and send the invitation | Consent (Art. 7, I) | |
| Create and maintain your account and deliver posts to the audience you chose | Registration, profile, content, circles | Performance of a contract (Art. 7, V) |
| Keep access logs | IP, date and time | Legal obligation (Art. 7, II; Marco Civil, Art. 15) |
| Prevent fraud, spam and abuse, and protect accounts | Technical and security data | Legitimate interest (Art. 7, IX) and protection of credit and security |
| Moderate content and comply with orders from authorities | Reported content, account data | Legal obligation and regular exercise of rights (Art. 7, II and VI) |
| Show contextual and regional ads | Page topic; city and state from your profile or approximated from your IP | Legitimate interest (Art. 7, IX). Never private posts, circles or messages |
| Improve the service with statistics | Aggregated or anonymized usage data | Legitimate interest (Art. 7, IX) |
You can turn off the use of your city and state for ads at any time in your profile. Advertisers never receive your location: they see only totals by region, and they cannot target regions with fewer than 1,000 people.
We do not make automated decisions that affect your rights without the possibility of review by a person. The feed is chronological and is not ranked by behavioral profile.
5. Who we share it with
We do not sell or rent personal data. We share it only when necessary:
- Processors that provide services to Circua: hosting, e-mail delivery, file storage and security. They may only use the data to serve us, under contract.
- Networks you connect, within the limits you authorize.
- Authorities, when there is a court order or legal obligation.
- In a corporate reorganization, such as a merger or sale, with the safeguards of this policy maintained.
Current list of processors: Hostinger International Ltd. (website hosting, waitlist storage and e-mail service). This list will be updated whenever a new processor starts processing personal data.
6. International transfer
Some providers may store data outside Brazil. When this happens, we will use only the mechanisms permitted by the LGPD (Art. 33), such as standard contractual clauses approved by the ANPD, and we will require a level of protection equivalent to Brazil's.
7. How long we keep it
- Waitlist e-mail: until you ask to be removed or until 12 months after launch, whichever comes first.
- Access logs: 6 months, as required by the Marco Civil da Internet, or longer if there is a court order.
- Account and content: for as long as the account is active. After deletion, we erase them within 30 days, except for what the law requires us to keep.
At the end of the retention period, the data is deleted or anonymized.
8. Security
We adopt technical and administrative measures to protect your data, including: encrypted connection (HTTPS), passwords stored using hashing algorithms, server-side permission checks before showing each post, internal access control based on the principle of least privilege, audit logs, and security testing before each release.
No system is completely immune to failures. If an incident occurs that may pose a relevant risk or harm, we will notify the ANPD and the affected people, as required by Art. 48 of the LGPD.
10. Your rights
Under the LGPD (Art. 18), you may request at any time:
- Confirmation that we process your data
- Access to the data
- Correction of incomplete or inaccurate data
- Anonymization, blocking or deletion of unnecessary data
- Portability to another service
- Deletion of data processed based on consent
- Information about who we share it with
- Withdrawal of consent
- Review of automated decisions
- Objection to unlawful processing
To exercise any right, write to contato@circua.com with the subject "Privacy". We may ask for identity confirmation to protect you. We reply within 15 days. To leave the waitlist, just ask at the same e-mail or use the unsubscribe link in our messages.
If you are not satisfied, you can file a complaint with the ANPD at gov.br/anpd.
11. Children and adolescents
Circua is intended for people 18 years of age or older. We do not knowingly collect data from minors. If you are the parent or guardian of a child or adolescent who has signed up, write to contato@circua.com and we will delete the data.
If Circua accepts adolescents in the future, we will follow Art. 14 of the LGPD and Lei nº 15.211/2025 (ECA Digital, Brazil's Digital Statute of Children and Adolescents), with age verification, linkage to a parent or guardian, and maximum privacy by default.
12. Changes to this policy
We may update this policy. The version date is shown at the top of the page. If a change is material, we will notify you by e-mail or within Circua before it takes effect.
13. Data Protection Officer and contact
- Data Protection Officer (DPO)
- Omar Passos
- contato@circua.com (subject "Privacy")
See also the Terms of Use and the Contact page.