Last updated: 6 October 2026.
Who handles your data
The controller is Cena 23, CNPJ 52.078.103/0001-78, Ricardo Krug's company. As a small processing agent, Cena 23 names no data protection officer (Resolução CD/ANPD nº 2/2022, art. 11). The channel for any request about your data is contato@ricardokrug.com.br.
What data we collect
Account: name, email, the optional WhatsApp number, the consent boxes you checked, and their dates.
Forms on the automation pages: name, email, the optional WhatsApp number, company and role when the form asks, and the answers you write.
Course: the lessons marked as done and the purchases (course, price, status). Payment happens at Asaas, which keeps the payment data.
Business client: the client name, the billing email, the kind of order, the amounts, and the payments received. The billing email gets the payment link. You give the CPF or CNPJ only at Asaas.
Abuse protection: a code derived from the IP address (an HMAC), never the IP itself, to limit repeated sends.
Visits: Umami counts visits with no cookies and no personal data.
Product use, with your consent: PostHog records the pages you open, your clicks, errors, and a recording of the session with every field you type in masked. While you are signed in, it links them to your account id, email, and name.
Why, and on what legal basis
To deliver the course and keep your account: performance of a contract (LGPD, art. 7, V).
To answer a request from a form: steps before a contract, at your request (art. 7, V). I use WhatsApp for it only when you check the box.
To send news by email or WhatsApp: your consent (art. 7, I), which you can withdraw at any time on the account page.
To measure how the site is used, with PostHog: your consent (art. 7, I). Withdraw it at any time through "Analytics preferences" in the footer or on the account page.
To limit repeated sends and stop spam: legitimate interest (art. 7, IX).
To keep purchase and order records: a legal and tax obligation (art. 7, II).
Who we share it with
The processors that run the site: Vercel (hosting), Neon (database), Resend (email delivery), Asaas (payments), Mux (lesson video), Umami (visit counts), and PostHog (product analytics, with your consent). A WhatsApp chat goes through Meta.
Vercel, Neon, Resend, Mux, Umami, PostHog, and Meta process data outside Brazil. That international transfer follows Resolução CD/ANPD nº 19/2024.
I do not sell your data or hand it over for any other use.
How long we keep it
A form request is deleted automatically 12 months after it arrives.
The account stays while it exists; ask for its deletion by email.
Purchase and order records stay for the period tax law requires.
The abuse-protection code is deleted within two days of the last send.
Cookies
The site sets a session cookie to keep you signed in and a cookie with the language you picked.
A referral link sets the referral cookie. It holds only the referral code, so the checkout can fill in the code field, and it lasts 90 days.
If you accept analytics, PostHog sets its own cookie and local storage to recognize the browser. If you accept analytics while signed in, every browser where you sign in uses that choice until you sign out. If you decline, it stores only that choice. The site sets no other tracking cookies.
Your rights
Under the LGPD (art. 18), you can ask for: confirmation that we process your data, access to it, correction, anonymization, blocking or deletion of data we do not need, portability, information on who we share it with, and the withdrawal of consent.
Write to contato@ricardokrug.com.br. You can also petition the ANPD.