Privacy Policy

1. Scope

This policy describes how Diamond Pay (a brand of Double Diamond Serviços de Tecnologia Ltda., CNPJ 43.634.190/0001-01, São Paulo, SP, Brazil, the data controller) handles personal data on its institutional website and on the merchant candidacy portal (account creation, sign-in and the sign-up steps).

Creating an account does not start payment processing or a sub-merchant relationship with our acquirers. Collection starts only after approval and a separate commercial agreement.

2. Data we collect

Account signup: your name, email, phone, how you sell (your own products or services, or a platform whose sellers each sign up as their own merchant), CNPJ or CPF, legal company name (or the CPF holder’s full name), brand name, website, what you sell, business profile and the other countries where your group operates, and estimated monthly sales. We record that you accepted these terms and the privacy policy, and which version you accepted.

Public registry lookup: when you enter a CNPJ at signup, our server sends only that CNPJ number to services that publish the Brazilian Federal Revenue Service’s public CNPJ registry (BrasilAPI, CNPJ.ws or ReceitaWS), to offer the company’s legal name, trade name, main activity, city and registration status. In the portal, for your own CNPJ only, the same services also return the company’s address, legal nature, opening date and the partners’ names with partly masked CPFs, which we use to fill in and check your answers. We never look up CPF numbers. Registry data is still verified during the review.

Address lookup: when you type a CEP in the portal, our server sends only that CEP to ViaCEP, OpenCEP or BrasilAPI to fill in the street, neighborhood, city and state.

Unsent signup drafts stay only in your browser, on your device, for up to 72 hours. A CPF is never saved in a draft, and neither is your acceptance of the terms.

Portal sign-up (after sign-in): the company’s registry details (legal name, legal nature, main activity, opening date), brand name and address; for each owner and signer, full name, CPF, date of birth, role, ownership share and whether they are a politically exposed person; extra contacts you add (name, email, phone); what you sell, how you deliver, your average sale, monthly sales range, website and the payment methods you want; the bank account you receive in (bank, branch, account number and type); and the date, time and IP address of the declarations you make when you send your sign-up for review.

Documents: files you upload in the portal (for example articles of association, photo ID and proof of address), in PDF, JPG or PNG, up to 4 MB each. Photos are reduced in your browser before they are sent. File content is stored in object storage; we keep the file name, type, size and document category in our database.

Authentication: we send magic-link emails to your registered address. Link tokens are stored only as cryptographic hashes and expire after 15 minutes. Active sessions use an HttpOnly cookie (`dp_session`) backed by a hashed token in our database, typically for up to 30 days or until you sign out.

We do not use third-party analytics on this site. We do not collect payment card data or live transaction data through this portal.

3. How we use your data

We use account and sign-up data to evaluate your candidacy, register your business with the acquirers that process your payments, communicate about your application, and keep an audit trail of the sign-up steps.

We use your email address to deliver transactional messages (magic-link sign-in and related account notices) through Resend, our email delivery provider.

We use session data solely to keep you signed in to the portal and to authorize API requests on your behalf.

4. Infrastructure and processors

We host the site and application on Netlify. Structured account and sign-up data are stored in Netlify Database (managed PostgreSQL). Uploaded documents are stored in Netlify Blobs under the `merchant-documents` store.

Resend delivers outbound email on our behalf. These providers process data under our instructions and appropriate contractual safeguards. We do not authorize them to use your data for their own marketing.

CNPJ lookups go to BrasilAPI, CNPJ.ws or ReceitaWS, which receive only the CNPJ number being looked up. CEP lookups go to ViaCEP, OpenCEP or BrasilAPI, which receive only the CEP.

5. Retention

We keep sign-up data and documents while your application is open and while you sell with us, and afterwards for the periods that anti-money-laundering, tax and card-network rules require, even if the application is closed. Magic-link tokens are short-lived and removed when used or expired. You may request deletion subject to those limits (section 7).

6. Sharing and sale of data

We do not sell your personal data or share it for anyone’s marketing. To register your business as a merchant, we share your sign-up data and documents with the acquirers and payment institutions authorized by the Central Bank of Brazil that process your payments; they use them for their own customer-identification and anti-money-laundering checks. We may also disclose data when required by law, to protect rights and safety, or to professional advisers under confidentiality duties.

7. Your rights and contact

Depending on applicable law, you may request access, correction, portability, or deletion of your personal data, or object to certain processing. To exercise these rights or ask questions about this policy, email privacy@doublediamond.tech.

privacy@doublediamond.tech is also the channel to our data protection officer (encarregado, under Brazil’s LGPD, art. 41).

If you have an account, you may also sign out at any time, which invalidates your current session cookie.

8. Security

We use HTTPS, HttpOnly session cookies, and hashed tokens for authentication. Document uploads are scoped to your merchant account. No security measure is perfect; please protect access to your email inbox because magic links grant account access.