Privacy Policy

1. Who we are and our roles

Tamino is a white-label payments platform operated by TAMINO TECNOLOGIA, SERVIÇOS E PAGAMENTOS EIRELI, Brazilian company registry (CNPJ) No. 35.067.829/0001-96, and used by companies (tenants), their merchants and sales managers.

We are the controller of the data of people who have an account on the platform (tenants, merchants and managers) and of website visitors. For the data of buyers who pay our customers, we act as a processor on behalf of the tenant or merchant, who is the controller and is responsible for the relationship with the buyer.

2. Data we collect

• Account data: name, email, role, linked company, password (stored only as a hash) and the two-step verification secret.
• Usage and security data: IP address, device and browser type, access logs and an audit trail of actions taken.
• App data: the device's notification token, platform (iOS or Android) and chosen language. Biometrics (Face ID, Touch ID or fingerprint) are checked by the phone itself — we never receive or store your fingerprint or face image.
• Payment data: transaction amounts, dates and identifiers, the payer's name and CPF/CNPJ entered in the charge, Pix keys used for payouts and data needed to handle disputes (MED). Card data is tokenized by payment providers; we do not store full card numbers.
• Sales contact: data you send through the website contact form.

3. Why we use data and legal bases

• To provide the contracted service: process charges, payouts, statements, balances and sale notifications (performance of contract).
• To comply with legal and regulatory obligations: anti-money-laundering and fraud prevention, and requests from the Central Bank of Brazil, payment institutions and authorities (legal obligation).
• To protect the platform and its users: authentication, two-step verification, abuse detection and auditing (legitimate interest and fraud prevention).
• To send sale push notifications in the app (consent, which you can withdraw at any time in your phone settings).
• To answer sales and support contacts (legitimate interest or pre-contractual steps).

4. Who we share data with

We do not sell personal data.

• Partner payment institutions, banks and acquirers that process Pix, cards and boletos.
• Infrastructure providers acting on our behalf: cloud hosting, email delivery and push notification delivery (Expo, Apple and Google services).
• The tenant or merchant responsible for the transaction, for buyer data.
• Public authorities, when required by law, regulation or court order.

5. International transfers

Some providers (for example, hosting and push notifications) may process data outside Brazil. In these cases we adopt the safeguards provided for in the LGPD, such as contractual clauses and providers with adequate protection standards.

6. How long we keep data

We keep account data while the account is active. Transaction, payout and audit records are kept for the periods required by financial, anti-money-laundering and litigation-defense laws. After that, data is deleted or anonymized.

7. How we protect data

• Encrypted communication (TLS) between the app, the browser and our servers.
• Passwords stored as hashes and two-step verification for sensitive operations such as payouts.
• Revocable sessions, the app token kept in the device's secure storage and biometric unlock.
• Role-based access control and an audit trail of administrative actions.

8. Your rights

Under article 18 of the LGPD, you may request confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, withdrawal of consent and deletion of your account. Some data may need to be kept to meet legal obligations, even after deletion.

Buyers who paid one of our customers should first contact the responsible tenant or merchant; we will support the request when needed.

9. Children and teenagers

Our services are intended for businesses and people over 18. We do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy. The last update date is shown at the top of the page; relevant changes will be communicated through our channels.

11. Contact

To exercise your rights or ask privacy questions, reach us through the contact page.