1. Who is responsible for your data
Your data is controlled by Neutraza International LLC (Delaware, United States). Our data protection officer (LGPD art. 41; GDPR arts. 37–39) can be reached at contact@neutraza.com.
Laws covered by this policy: in the United States, the California Consumer Privacy Act as amended by the CPRA (Cal. Civ. Code §1798.100 et seq.), CalOPPA, COPPA and state privacy laws such as those of Virginia, Colorado, Connecticut and Texas; in Brazil, Law 13,709/2018 (LGPD) and Law 12,965/2014 (Internet Civil Framework); in Spain, Regulation (EU) 2016/679 (GDPR), Organic Law 3/2018 (LOPDGDD) and Law 34/2002 (LSSI-CE).
2. What data we process
- Account: name, email, phone, Brazilian CPF or CNPJ (or an equivalent ID), nationality and profile (Holder or Guardian).
- Guardians: property and CAR details, reserve location and payout details.
- Purchases: adopted FRUs, amounts and status. Payment happens on Stripe; we never receive your full card number.
- Site use: access records (IP address, date and time), pages visited and browser details.
- Communications: the messages you send us.
We do not ask for sensitive data such as health, religion, racial origin or biometrics. Your ID number, which some U.S. laws treat as sensitive personal information, is used only to issue the certificate and meet tax obligations.
3. Why we use it and our legal basis
- Creating and running your account, processing purchases, issuing certificates and paying Guardians: performance of a contract (LGPD art. 7, V; GDPR art. 6.1.b).
- Keeping tax, accounting and access records: legal obligation (LGPD art. 7, II; GDPR art. 6.1.c).
- Preventing fraud, keeping the site secure and improving the service: legitimate interest, taking into account the need for the processing and its impact on your rights (LGPD art. 7, IX; GDPR art. 6.1.f).
- Opening the site in your country’s language, estimated from your IP: legitimate interest.
- Suggesting the reserve nearest to you and sending news by email: only with your consent, which you can withdraw at any time (LGPD art. 7, I; GDPR art. 6.1.a). Every newsletter includes an unsubscribe link (CAN-SPAM Act).
We do not make decisions about you based solely on automated processing.
5. Who we share it with
- Stripe: processes payments and payouts.
- Independent auditor (NU Carbon): receives the reserve and Guardian data needed for the audit.
- Infrastructure providers (hosting, email and satellite imagery): process data only on our instructions and under contract.
- Authorities: when the law or a court order requires it.
We do not sell your personal information or share it for cross-context behavioral advertising, and we have not done so in the past 12 months (as “sale” and “sharing” are defined in the CCPA).
For environmental transparency, each reserve’s public page shows its location, area, satellite imagery and the farm’s name. The Holder’s name appears on the certificate, which you choose whether to share.
6. International transfers
Because we operate in the United States and Brazil and use global providers, your data may be processed outside your country. When that happens, we use the safeguards the law requires, such as standard contractual clauses (LGPD art. 33; GDPR arts. 44–49).
7. How long we keep it
- Account: for as long as it exists. When you close it, we delete or anonymize what we do not need to keep.
- Access records: 6 months, as required by Brazil’s Internet Civil Framework (art. 15).
- Tax and accounting records: for the period set by the applicable law (in Brazil, generally 5 years).
- Issued certificates: for as long as needed to prove the preservation contract, comply with the law and defend legal claims (LGPD art. 16; GDPR art. 17.3).
8. Security
We use encrypted connections, hashed passwords, role-based access and logging of sensitive operations. If a security incident puts you at risk, we notify you and the authorities within the legal deadlines (LGPD art. 48; GDPR arts. 33 and 34, within 72 hours; and U.S. state breach notification laws).
9. Your rights
Wherever you are, we give everyone the same rights:
- to know whether we process your data, to access it and to get a copy in a portable format;
- to correct incomplete or inaccurate data;
- to ask for deletion, anonymization or blocking of unnecessary data;
- to object to processing or ask us to restrict it;
- to withdraw consent at any time;
- to know who we share your data with;
- to opt out of the sale or sharing of your data (which we already do not do);
- not to be discriminated against for exercising these rights.
To exercise them, write to contact@neutraza.com. We may ask you to confirm your identity. We answer within 15 days, which fits the deadlines of the CCPA (45 days), the GDPR (1 month) and the LGPD (art. 19). You may use an authorized agent and, if we deny a request, you can appeal through the same channel.
You can also complain to a data protection authority: in the United States, the California Privacy Protection Agency or your state attorney general; in Brazil, the ANPD; in Spain, the Agencia Española de Protección de Datos (AEPD).
10. Children
Neutraza is not intended for anyone under 18. We do not knowingly collect data from children under 13 (COPPA), under 14 (LOPDGDD art. 7) or from children and teenagers without the consent the law requires (LGPD art. 14). If we find such an account, we delete the data.
11. Changes to this policy
If we make a material change, we will tell you by email or on the site before it takes effect. The date of the last update is shown at the top of this page.
12. Contact
Data protection officer: contact@neutraza.com.