Privacy and personal data
Baccaria Privacy Policy
Last updated: October 7, 2026.
This policy describes Baccaria's handling of personal data on its website and platform. Baccaria is an early-stage project and is not yet formally incorporated. For privacy requests, contact [email protected]; requests are routed to the person responsible for the relevant processing.
Roles
The Baccaria operation determines the purposes for account, authentication, security, billing, and direct support data. For customer and order data a merchant enters into its workspace, that merchant is the controller and Baccaria processes the data to provide the platform under the merchant's instructions and settings. Merchants are responsible for informing their customers and responding to requests concerning data they control.
Data we process
- Account and access details, including name, email, password hash, role, verification status, and session records.
- Merchant business details, product catalog, prices, inventory, batches, orders, and operating settings.
- Merchant-customer details when provided, such as name, phone, email, birthday, notes, order items, fulfillment details, and payment status.
- Subscription and connected-payment identifiers and status. Payment card details are handled by the payment provider; Baccaria does not need the full card number to run the integration.
- When a merchant enables electronic invoicing, business and tax details and credentials needed for that feature. Stored A1 certificate files and passwords are encrypted by the application.
- A browser local-storage preference may remember the website's light or dark theme.
Purposes and legal grounds
Data is used to create and secure accounts, provide subscribed features, organize orders, process subscriptions and payments, enable invoicing requested by a merchant, provide support, prevent abuse, and comply with legal obligations. Depending on the context, processing may rely on contract performance or pre-contract steps, legal obligations, exercise of rights, assessed legitimate interests, or consent where required.
Service providers and international processing
Delivery of the service may involve infrastructure and database hosting, email delivery, payment processing, and tax-document providers, as well as tax authorities when a merchant requests an invoice. Providers receive data needed for their service and may act as processors or independent controllers under their own services. Some providers or infrastructure may process data outside Brazil. Where international transfer applies, Baccaria will use a transfer mechanism permitted by Brazil's LGPD and applicable ANPD rules. Information about relevant providers and transfers can be requested at the contact above.
Retention and security
Data is kept as needed to provide the platform, secure accounts, meet legal and tax obligations, resolve disputes, and exercise legal rights. Retention periods depend on the record and circumstances; some records may remain after account closure where law requires or permits. Controls include hashed passwords, access controls, and encryption of stored tax credentials. No internet-connected service can guarantee zero risk.
Your rights and requests
Under Brazil's LGPD, individuals may request confirmation and access, correction, anonymization, blocking or deletion where applicable, portability where regulated, information about sharing and consent, withdrawal of consent, and review of automated decisions where applicable. Email [email protected]. If a merchant controls the data, contact that merchant as well; Baccaria will assist the merchant as needed.
Children, updates, and official references
The platform is intended for businesses and is not designed to collect children's data. We may update this policy as the product or law changes and will post the current version here with its revision date.