Privacy Policy

1. Information we collect

With your explicit consent:

• Name and phone (WhatsApp) for the VIP Club and for orders
• Name, phone and e-mail when creating an account or completing a purchase
• Data voluntarily provided in contact forms
• Only if you accept analytics cookies: pages visited, device and browser type, access date and time, and where the visit came from (for example, a campaign or partner link)
• Only if you accept marketing cookies: ad click identifiers (such as Meta's fbclid and Google's gclid) and, when you complete a purchase or submit the business form, the IP address and browser used

2. How we use your data

We use collected data exclusively to:

• Process orders and payments made on the site
• Send weekly menus and offers to VIP Club members
• Reply to contact requests and custom orders
• Analyze navigation to improve our products and the site
• With your marketing consent, measure the results of our Facebook and Instagram ads: learn which ads led to purchases and show ads to people more likely to be interested
• Avoid showing new-customer acquisition ads to people who already buy from us
• Important: we never sell, rent or share your personal data with third parties for commercial purposes.

3. Cookies and technologies

We use cookies and similar technologies for:

• Essential (always on): site operation — session, cart, theme preference and your cookie choice
• Analytics (only with your consent): usage metrics collected by our own site and sent, from our servers, to PostHog, a product analytics tool. You are identified by a random code, without name, phone or e-mail
• Marketing (only with your consent): the Meta Pixel, by Meta Platforms (Facebook and Instagram), loaded in your browser only after you accept. It records pages and products viewed, items added to the cart, checkout starts, clicks to WhatsApp and completed purchases (value and products), and may use Meta's own cookies
• Marketing (only with your consent): the Google Ads tag, by Google, loaded in your browser only after you accept. It records items added to the cart, checkout starts, clicks to WhatsApp, business forms submitted and completed purchases (value), and may use Google's own cookies
• You choose in the cookie notice and can change your mind at any time through the “Cookie preferences” link in the site footer. Declining does not prevent you from buying.
• You can also delete or block cookies in your browser settings, but features like the cart may be affected.

4. Data sharing

Your data may be shared only with processors required to provide the service:

• Payment processors (Stripe for cards; Efí/OpenPix for Pix), which receive only what is required to process the transaction
• WhatsApp (Meta): communication with VIP Club members
• PostHog: usage metrics, only with your analytics consent, without name, phone or e-mail
• Meta Platforms (Pixel and Conversions API), only with your marketing consent: when a purchase is paid, we send Meta the value, the products and identifiers protected by irreversible encryption (SHA-256 hash) of your phone, city and ZIP code, plus the IP address and browser used at checkout. Meta uses this data to match the purchase to an ad, measure results and keep current customers out of acquisition campaigns; its processing is also governed by Meta's Privacy Policy
• Google (Google Ads), only with your marketing consent: when a purchase is paid or a business form is submitted, we send Google the value and your e-mail and phone protected by SHA-256 hash, plus the ad click identifier, when there is one. Google uses this data to match the conversion to an ad and measure results; its processing is also governed by Google's Privacy Policy
• Meta Platforms, on the business form and only with your marketing consent: the form submission is reported to Meta with your e-mail and phone as a SHA-256 hash, plus the IP address and browser used
• Meta Platforms (customer lists): we may send Meta the list of phone numbers of existing customers, always as a SHA-256 hash — Meta does not receive the number itself, only a code that lets it recognize accounts it already knows. We use this to measure ad results and to avoid showing acquisition ads to people who are already customers. To stay off these lists, write to sac@santopane.com.br
• Infrastructure providers for secure data storage
• Some of these providers (such as PostHog, Meta and Google) process data outside Brazil, with the safeguards required by the LGPD.
• All processors are bound to confidentiality and security obligations.

5. Your rights (LGPD)

Under the Brazilian General Data Protection Law (Law 13,709/2018), you have the right to:

• Confirmation: know whether we process your personal data
• Access: obtain a copy of your data, available self-service in your account (data export)
• Correction: request updates to incomplete or incorrect data
• Anonymization/Blocking: request anonymization or blocking of unnecessary data
• Deletion: request erasure of data processed with your consent
• Portability: request transfer of your data to another provider
• Revocation: withdraw consent at any time — for analytics and marketing cookies, through the “Cookie preferences” link in the footer
• Objection to advertising use: decline marketing cookies in the cookie notice (or later, in “Cookie preferences”) and ask to be removed from the customer lists sent to Meta by e-mail at sac@santopane.com.br
• To exercise your rights, use the export in your account or contact us on WhatsApp +5511984807000 or by e-mail at sac@santopane.com.br.

6. Data security

We implement technical and organizational measures to protect your data:

• Encrypted communication (HTTPS/TLS)
• Database with restricted, authenticated access
• Regular, secure backups
• Continuous security monitoring

7. Data retention

We keep your data only for as long as necessary:

• VIP registration: until you request removal or after 2 years of inactivity
• Account and orders: while the account exists and for legally required fiscal periods (including the checkout IP address and browser, when collected)
• Navigation data: 90 days
• Server logs: 30 days

8. Changes to this policy

We may update this policy periodically. For significant changes we will notify VIP Club members and update the date at the top of this page.

9. Contact

For questions, requests or to exercise your personal data rights:

• WHEAT LILY & COMPANY LTDA
• WhatsApp: +5511984807000 (https://wa.me/5511984807000)
• E-mail: sac@santopane.com.br
• Instagram: @santopaneoficial (https://instagram.com/santopaneoficial)