Privacy Policy

1. Data Controller

Filtra Labs, Creative Coffee Hub
CNPJ: 63.231.364/0001-00
Av. Brigadeiro Faria Lima, 1811 — São Paulo, SP, Brasil
Email: hub@filtralabs.com
Phone: +55 16 99646-2369

The Data Protection Officer (DPO) can be reached at hub@filtralabs.com.

2. About This Policy

This Privacy Policy describes how Coffee Ready to Go, operated by Filtra Labs, collects, uses, stores, and protects your personal data in accordance with the Brazilian General Data Protection Law (Lei Geral de Proteção de Dados — LGPD, Law No. 13.709/2018).

3. Personal Data We Collect

We collect the following personal data when you use our platform:

• Name — to identify you within the platform
• WhatsApp number — to enable delivery coordination between parties
• Email address — to send transactional notifications about delivery matches

We do not collect sensitive personal data, financial information, or payment details. The platform does not process payments of any kind.

4. Purpose of Data Processing

Your personal data is processed for the following purposes:

• Creating and managing your user profile
• Connecting coffee hosts, buyers, and travelers for delivery coordination
• Sending email notifications about match status updates (proposed, confirmed, delivered)
• Generating WhatsApp deep links for direct communication between matched parties
• Displaying contact information to matched parties for delivery coordination

5. Legal Basis for Processing

We process your data based on the following legal grounds under LGPD (Art. 7):

• Consent (Art. 7, I) — By providing your personal data and creating a profile, you consent to its processing for the purposes described in this policy.
• Contract performance (Art. 7, V) — Processing is necessary to provide the delivery coordination service you requested.
• Legitimate interest (Art. 7, IX) — To improve our platform and ensure proper functioning of the matching system.

6. Data Sharing with Third Parties

We share personal data with the following third parties strictly for service operation:

• Resend (email service provider) — Your email address is shared with Resend to deliver transactional notifications. Resend processes data under their own privacy policy and applicable data protection agreements.
• Matched parties — When a delivery match is created, your name and WhatsApp number are shared with the other parties involved (host, buyer, and/or traveler) to enable direct coordination.

We do not sell, rent, or trade your personal data. We do not share data with advertisers or marketing platforms.

7. Data Storage and Retention

Your personal data is stored in secure databases hosted by our infrastructure provider. Data is retained for as long as your account is active and necessary to provide our services. Upon account deletion or withdrawal of consent, your personal data will be deleted within 30 days, unless retention is required by legal obligation.

8. Cookies and Session Data

We use essential cookies to maintain your session and identify your account. These cookies are strictly necessary for the platform to function and do not track your activity across other websites. We do not use analytics cookies, advertising cookies, or third-party tracking technologies.

9. Your Rights Under LGPD

Under the LGPD (Art. 18), you have the following rights regarding your personal data:

• Confirmation — Confirm whether your data is being processed
• Access — Request access to your personal data
• Correction — Request correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion — Request anonymization or deletion of unnecessary or excessive data
• Portability — Request the transfer of your data to another service provider
• Deletion — Request deletion of data processed with your consent
• Information about sharing — Know which entities your data has been shared with
• Consent withdrawal — Withdraw your consent at any time
• Opposition — Object to processing that does not comply with the LGPD

To exercise any of these rights, contact us at hub@filtralabs.com. We will respond within 15 business days.

10. International Data Transfer

Your data may be processed by service providers located outside of Brazil (such as email and hosting infrastructure). In such cases, we ensure that adequate data protection measures are in place, in compliance with LGPD requirements for international data transfers (Art. 33).

11. Data Security

We implement appropriate technical and organizational security measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These include encrypted sessions, secure database access controls, and environment-based secret management.

12. Children and Minors

Coffee Ready to Go is not intended for use by children under 18 years of age. We do not knowingly collect personal data from minors. If we become aware that data from a minor has been collected, it will be promptly deleted.

13. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the platform after changes constitutes acceptance of the updated policy.

14. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to file a complaint with the Brazilian National Data Protection Authority (ANPD — Autoridade Nacional de Proteção de Dados) at www.gov.br/anpd.