Privacy Policy

1. Who is responsible and how to contact us

FLUXO is a specialty coffee brand operated by CodeAustral LLC, a company formed in the United States with its registered office at 1309 Coffeen Ave Ste 1200, Sheridan, WY 82801-5777, USA, and operations in Brazil at Rua do Kalifa 522, Canasvieiras, Florianópolis, SC, 88054-130.

To exercise your rights, ask questions or contact us about privacy, email [email protected] with the subject Privacy and Personal Data, or call +55 48 99986-5474.

This is our privacy channel. We will respond within a reasonable period and, where required by law, within 15 days.

2. Data we may collect

We collect only what is necessary to sell, deliver and support your coffee. The categories include:

• Identity and contact: name, email, phone/WhatsApp, country, language and communication preferences.
• Order and delivery: products, quantity, grind, address, postcode, city, state, country, carrier, tracking code and order history.
• Payment: amount, currency, status, transaction ID, method (Pix or card) and tax information where required. We do not store the full card number; payment is processed by Stripe.
• Subscription: plan, billing cycle, status, cancellations and card updates. Card data remains with Stripe.
• Support: messages, attachments, photos and information you voluntarily send by email, WhatsApp or forms.
• Technical data: IP address, date and time, browser, device, pages visited, security logs, cookies and similar identifiers.
• Attribution and consent: visit source, campaign parameters, cookie choices and consent records.

We do not request health data, biometrics, political opinions, religion or other sensitive data. Please avoid sending them by WhatsApp or email.

3. How we use data

We use data to:

• create and protect your account, where one exists;
• process orders, payments, refunds and reconciliations;
• pick, roast/grind where applicable, pack and ship the coffee;
• manage the FLUXO Monthly subscription, recurring charges and cancellations;
• provide support, answer questions and resolve delivery issues;
• prevent fraud, abuse, security incidents and breaches of these terms;
• comply with legal, tax and regulatory obligations and exercise rights in proceedings;
• measure how the site works and improve the experience;
• send promotional communications and measure campaigns where we have consent or another adequate legal basis, with an opt-out.

We do not use your data for solely automated decisions that significantly affect your interests. Coffee curation and support involve human review.

4. Legal bases

Under Brazil's General Data Protection Law (LGPD), we rely on the applicable basis: performance of a contract and preliminary procedures; compliance with a legal or regulatory obligation; regular exercise of rights; credit protection and fraud prevention where applicable; legitimate interest, preceded by a necessity and impact assessment; and consent, which may be withdrawn at any time.

Where consent is the legal basis, you may withdraw it without affecting the lawfulness of processing already carried out. You can opt out of promotional communications in every email and through our privacy channel.

5. Cookies, analytics and advertising

Strictly necessary cookies keep security, session, cart, country, currency, language and consent preferences working. Optional analytics or advertising cookies are used only according to the choice recorded in the consent banner and applicable law.

You can review your choice through the Cookie preferences link in the footer or through your browser. Blocking essential cookies may prevent parts of the shop from working. The full list of cookies, purposes and durations is in the Cookie Policy.

The site also uses an pseudonymous presence identifier, generated in the browser without a cookie, to show how many people are in the virtual cafés. It is not used for advertising and does not identify you.

6. Who we may share data with

We share only what is necessary with suppliers bound by security and confidentiality obligations, including:

• Stripe, for payments, Pix, cards, subscriptions, fraud prevention, refunds and transaction support;
• hosting, CDN, database, storage, security, email and support providers;
• Correios and carriers, for delivery and tracking;
• support and communication tools, such as email and WhatsApp;
• analytics and advertising providers, only where permitted by your consent choice and the applicable legal basis;
• authorities, public bodies, advisers and parties to proceedings, where legally required or necessary to exercise rights.

We do not sell personal data. We also do not share data with third parties for their own commercial purposes.

7. International transfers

Some suppliers and CodeAustral LLC may operate outside Brazil, including in the United States and the European Union. In those cases, data may be processed in other countries with appropriate contractual, technical and organisational measures and the mechanisms provided by the LGPD and the Brazilian Data Protection Authority (ANPD).

Where necessary, we use contractual clauses, impact assessments and access controls to protect transferred data.

8. How long we keep data

We keep data for as long as necessary for the stated purposes, the service, legal and tax deadlines, fraud prevention and the exercise of rights. As a rule, order and tax records are kept for up to 5 years after the transaction, unless a longer legal period applies.

Marketing data is kept until you opt out or while a legal basis exists. Analytics data is kept according to the provider's configuration and limited to what is necessary. Once the purpose ends, data is deleted, anonymised or kept only in cases authorised by law.

9. Security

We adopt controls proportionate to the risks, such as encryption in transit, access management, security logs, updates, backups and data minimisation. No system is infallible; relevant incidents will be handled and reported to data subjects and the ANPD where required.

Never send your password, security code or full card number by email or WhatsApp. FLUXO does not request this information through those channels.

10. Your rights

Under article 18 of the LGPD, you may request, as applicable: confirmation of processing; access; correction; anonymisation, blocking or deletion of unnecessary or irregular data; portability; information about sharing; deletion of data processed with consent, subject to legal exceptions; information about the possibility of refusing consent; withdrawal of consent; objection; and review of solely automated decisions affecting your interests.

Send your request to [email protected]. To prevent fraud, we may confirm your identity proportionately. Exercising your rights is free. If a request cannot be fully met, we will explain the legal reason. You may also contact consumer protection bodies and the ANPD.

11. Children and adolescents

Products are sold to people aged 18 or over. We do not intentionally collect data from children for registration or purchase. If an adolescent uses the service, their legal guardian must take part in the purchase and the exercise of rights, under applicable law and the best interests of the minor.

12. Links and third-party services

The site uses third-party services such as Stripe (payments), Cloudflare (security and CDN), Google Fonts (fonts), ViaCEP (postcode lookup), Correios/carriers (delivery) and analytics providers. Each third party has its own privacy policy and may process data as an independent controller.

External links do not mean unrestricted endorsement of their content. We recommend reading those services' policies before providing data outside FLUXO domains.

13. Changes to this Policy

We may update this Policy due to legal, technological or operational changes. The new version and its date will be published on this page. Material changes will be communicated through an appropriate channel, such as email or a notice on the site, where required.

14. Privacy channel

For questions, complaints or to exercise your rights, contact [email protected] or +55 48 99986-5474. Include only the data needed to locate your relationship with FLUXO and never send your password or full card number.

If you are not satisfied with our response, you may contact consumer protection bodies, the consumidor.gov.br portal and the Brazilian Data Protection Authority (ANPD).