Fieli Club Privacy Policy
This English version is provided for convenience; the Portuguese version prevails.
Fieli Club is a loyalty program platform for small and medium businesses: points, cashback and digital stamps, with WhatsApp campaigns and an app where consumers follow their programs. The product is in Beta.
Fieli Tecnologia LtdaCNPJ 67.265.180/0001-04
Rua Angelita Oliveira de Souza, 111 · Centro · Delmiro Gouveia/AL · CEP 57480-000, Brazil
(82) 99817-4910 · WhatsApp · contato@fieli.app
Our three roles
- As controller, we process the merchant’s account data and its users’ data.
- As processor, we process the data of each merchant’s customers — registration, balances and transactions — only on the merchant’s instructions; the merchant is the controller of this data.
- As controller of the app account, we process the data of consumers who create a Fieli Club app account to bring together the programs they take part in.
Data we process as controller
| Operation | Data subjects | Data | Purpose | Legal basis | Fieli's role | Retention |
|---|---|---|---|---|---|---|
| Customer account | customer users | name, e-mail, credentials, session and security logs | create and maintain the account, authenticate and provide support | performance of a contract (art. 7, V) | controller | while the account exists; deleted or anonymized within 90 days after closure, except access logs (6 months) and a minimal record of the contract (5 years, to exercise legal rights) |
| Consumer app account | consumers using the app | phone, e-mail, CPF, name and birth date | bring together the programs the person takes part in | performance of a contract (art. 7, V) | controller | until the account is deleted, with anonymization |
| Children and adolescents | underage consumers | none: the app is for people aged 18 or over only; accounts of minors are blocked and deleted | protect children and adolescents (ECA Digital) | LGPD art. 14 and Law 15,211/2025 | controller | not applicable |
Data we process as processor
| Operation | Data subjects | Data | Purpose | Legal basis | Fieli's role | Retention |
|---|---|---|---|---|---|---|
| Merchant customers | merchants' customers | name, phone, e-mail, CPF, birth date and address | run the merchant's loyalty program | defined by the merchant, who is the controller | processor | while enrolled in the program; deletion or anonymization upon request |
| Balances and transactions | merchants' customers | points, cashback, stamps, purchases and rewards | compute balances and release rewards | defined by the merchant, who is the controller | processor | while the program exists |
Loyalty programs
Each merchant chooses its program’s mechanics — points, cashback, stamps or a combination — and the earning and redemption rules. To do so, we record the purchases reported by the merchant, the balances and the rewards released. This data belongs to the merchant’s program and is processed on the merchant’s instructions.
Consumer app
The Fieli Club app is intended only for people aged 18 or over. We ask for the date of birth at sign-up; if we identify an account belonging to a minor, it is blocked and its data is deleted.
In the app, usage statistics, crash reports and notifications depend on your consent, requested on a dedicated screen with separate options per purpose. You can change these choices at any time in the app settings. The account can be deleted from within the app; deletion is done with anonymization.
Children and adolescents
Fieli Club is not intended for children and adolescents. In line with article 14 of the LGPD and the Digital Statute of Children and Adolescents (Law No. 15,211/2025), Fieli does not profile minors for advertising, and merchants are prohibited from targeting campaigns at minors (see the Acceptable Use Policy).
Segmentation and automated decisions
The merchant may segment program participants by purchase frequency, value and recency to target offers — for example, inviting back someone who has not visited for a while. This consumer profiling does not restrict access to the program’s basic rules. Participants may ask the merchant for information about the criteria used and for review of decisions made solely on the basis of automated processing (LGPD, art. 20), and Fieli supports that request.
Connected platforms
Meta (Facebook, Instagram and WhatsApp Business Platform)
- What we access
- Page and professional account IDs and names, access tokens, content you choose to publish, comments and basic insights; for WhatsApp, the business phone number, message templates and messages exchanged through the WhatsApp Business Platform.
- What for
- Only to publish, send and show results of what you configured in the product.
- Sharing
- We do not sell this data, do not use it for advertising and do not share it without your consent.
- Retention
- While the account is connected; tokens and cached data are deleted when you disconnect or request deletion.
- How to revoke
- Remove the app in Facebook Settings > Apps and websites or Instagram Settings > Apps and websites, and see the Data Deletion page (/en/data-deletion).
Subprocessors and international transfers
| Provider | Role | Data | Country | Transfer basis | Status |
|---|---|---|---|---|---|
| Magalu Cloud Ltda. | hosting and database | all service data | Brazil | — | being onboarded |
| Railway | API hosting | service data | United States | LGPD art. 33: provider's contractual clauses, until the migration to Brazil is complete | being phased out |
| Vercel | web dashboard hosting | service data | United States | LGPD art. 33: provider's contractual clauses, until the migration to Brazil is complete | being phased out |
| Neon | database | service data | United States | LGPD art. 33: provider's contractual clauses, until the migration to Brazil is complete | being phased out |
| Resend | e-mail delivery | service data | United States | LGPD art. 33: provider's contractual clauses, until the migration to Brazil is complete | being phased out |
| Cloudflare R2 | file storage | service data | United States | LGPD art. 33: provider's contractual clauses, until the migration to Brazil is complete | being phased out |
| Google (Firebase) | app notifications, usage statistics and crash reports | device identifiers and usage events, with consent | United States | art. 33, II, b: ANPD standard contractual clauses offered by Google Cloud | in use |
| Meta Platforms (WhatsApp Business Platform) | sending and receiving WhatsApp messages through the official API | phone number, profile name and message content | United States and others (Meta infrastructure) | art. 33, II, b: standard contractual clauses, through the WhatsApp Business Data Transfer Addendum | in use |
Our main hosting is in Brazil. Personal data leaves the country only in the situations disclosedon this page: network edge, e-mail, channels chosen by the customer, artificial intelligence providers and providers still being migrated, always with the basis for each transfer.
Fieli Club is migrating its infrastructure to Magalu Cloud, in Brazil. Until the migration is complete, part of the data is still processed by the providers marked “being phased out” in the table, outside Brazil, and we disclose that here. The full text of the applicable clauses can be requested from the Data Protection Officer and will be sent within 15 days (ANPD Resolution No. 19/2024, art. 17).
Cookies and storage in the app
| Name | Purpose | Essential |
|---|---|---|
consentimento (app) | store your privacy choices in the app | Yes |
Retention and deletion
- How to delete
- in the app, under Account > Delete account (with anonymization); merchants delete customers in the dashboard
- Deadline
- within 15 days
- What we keep by law
- access logs for 6 months (Brazilian Internet Civil Framework, art. 15) and data needed to comply with legal obligations or to exercise rights (LGPD, art. 16)
See also the data deletion page.
Security
- encrypted connections (TLS) everywhere
- per-merchant data isolation and staff action logs
If an incident affects data processed on behalf of a merchant, we notify the merchant within 48 hours after becoming aware of it. Where we are the controller — as with the app account — we notify the ANPD and the affected people within 3 business days (ANPD Resolution No. 15/2024).
Your rights
Data subjects have the rights of article 18 of the LGPD, with a reply within 15 days, and may petition Brazil’s National Data Protection Agency (ANPD) and consumer protection bodies. See the Privacy Policy.
Data Protection Officer
José Tenório Abs Jr. · dpo@fieli.app
Channel for data subjects and for Brazil's National Data Protection Agency (ANPD).
Changes
Changes to this policy are published here with a new version and effective date. Relevant changes are notified 30 days in advance and, when they change the purpose of processing, communicated to consumers before they take effect.