01Who is responsible
HopeAmazon Consultoria em Sustentabilidade S.A., seated in Porto Velho, State of Rondônia, Brazil, is the controller of the personal data described here — the controlador under Brazil's LGPD (Law 13.709/2018) and the controller under the EU GDPR. It is the parent company and your counterparty.
AW Hope LLC (United States) collects payments on behalf of HopeAmazon Consultoria em Sustentabilidade S.A. and acts as a processor for the payment data involved — it is the reason your card statement reads “AW Hope”. It is not a separate controller and does not use your data for its own purposes.
Data protection contact: contato@hopeamazon.com. We have not appointed a formal DPO, and we are not required to under LGPD art. 41 or GDPR art. 37 at our current scale. Requests are handled directly by the company, at the address above, within the deadlines in clause 06.
02What we collect, and why
- Account data — email address, password (stored only as a hash), and the name you give us. Needed to create and operate your account. Legal basis: performance of the contract.
- Subscription data — plan, status, billing dates, protection end date, certificate number. Legal basis: performance of the contract.
- Payment data — handled by Stripe. Card numbers never reach our servers. Stripe shares with us the billing country and address needed for tax, plus the payment status. Legal basis: performance of the contract and our legal obligation to charge the right tax.
- Waiting-list and landowner forms — name, email, phone, country, city, company, role and what you tell us in free-text fields. Legal basis: your consent, and steps taken at your request prior to entering a contract.
- Email delivery records — whether a message was sent, delivered, bounced or unsubscribed, so that we stop emailing people who asked us to stop. Legal basis: legitimate interest in running a functioning mailing system.
We do not knowingly collect data from children, we do not sell personal data, and we do not use it for automated decisions with legal effects on you.
03International transfer of your data
Where your data physically sits
Our database and authentication run on Supabase, in the us-east-1 region (United States). Payments run through Stripe, and the site is served by Vercel, both of which also process data in the United States. The controller itself is in Brazil.
So if you are in Europe, your personal data is transferred outside the EEA — to the United States and to Brazil. Brazil is not the subject of an EU adequacy decision. These transfers rely on the Standard Contractual Clauses in our processors' data processing agreements, and, for the initial subscription step, on the transfer being necessary to perform the contract you asked for.
You may request a copy of the transfer safeguards we rely on by writing to the address above.
04Who else processes it
- Supabase — database, authentication and email queue (United States).
- Stripe — payment processing and tax calculation.
- Vercel — hosting and server logs.
- AW Hope LLC (United States) — collection of payments on behalf of HopeAmazon Consultoria em Sustentabilidade S.A.
Each acts as a processor on our instructions. We do not share your data with anyone else except where the law requires it.
05How long we keep it
- Account and subscription data — while your account exists, then up to 5 years, to meet accounting and consumer-law record-keeping obligations.
- Payment records — as required by tax law in the countries involved.
- Waiting-list data — until you withdraw consent or ask for deletion.
- Unsubscribe records — kept indefinitely, because deleting them would mean emailing you again.
06Your rights
Under the GDPR (if you are in the EU/EEA or UK) you have the right of access, rectification, erasure, restriction of processing, data portability, objection to processing based on legitimate interest, and withdrawal of consent at any time. You may also lodge a complaint with the supervisory authority of your country.
Under the LGPD (if you are in Brazil) you have the rights to confirmation of processing, access, correction, anonymisation or deletion of unnecessary or excessive data, portability, information about data sharing, and revocation of consent. You may complain to the ANPD.
To exercise any of these, email contato@hopeamazon.com. We reply within 30 days at the latest, and free of charge.
07Cookies
We set only what is strictly necessary to keep you logged in, to keep the checkout secure, and to remember which language you are reading in. These are exempt from consent because the service cannot work without them.
The language cookie (hopeamazon.lang) holds a two-letter code and nothing else — no identifier, no browsing history. It exists so that the page you reach after signing in is served in the language you were already reading, and it is never used for measurement. It lasts one year, and clearing your browser's site data removes it.
We do not load analytics, advertising or third-party tracking before you have given consent. Where such cookies exist, the banner shown on your first visit lets you refuse them in a single click, and refusing is as easy as accepting. You can change your choice at any time by clearing the site's stored preference in your browser.
08Security, and being straight about it
Traffic is encrypted in transit, passwords are stored hashed, payment card data never touches our servers, and access to production data is restricted.
We will not claim a level of security we have not verified. If a breach occurs that is likely to result in a risk to your rights, we notify the competent authority and, where required, you — without undue delay.
09Changes
If we change this policy in a way that materially affects you, we notify active subscribers by email before it takes effect. See also the Terms of Service.