Privacy Policy

1. Who processes your data

Controller: ELIRA VESPERA TAROT E ENERGIA LTDA, CNPJ 54.810.385/0001-81, Rua Flávio Marques Lisboa, 511, Barreiro, Belo Horizonte – MG, CEP 30640-050, Brazil (“DAZO”). DAZO is a small-scale processing agent under Resolution CD/ANPD 2/2022.

Data protection officer (DPO): not appointed; as a small-scale agent, DAZO keeps the channel below (Resolution CD/ANPD 2/2022, art. 11). DPO channel: privacy@dazoplayer.app. That is where you exercise your rights and ask questions about this Policy.

2. What stays only on your TV

This data is stored only on your device and never goes to our server or to the website:

• your IPTV playlist: the provider’s address, username and password, the channels, the movies and the shows;
• what you watch, your favorites and your history;
• the profiles, including the Kids profile, and the parents' password (PIN) that protects them;
• the app settings.

In Redefinir app (Reset app), on the TV, you erase all of it from that device. DAZO has no copy.

3. What goes to your DAZO account and why

Only what the account and Premium need. The list below gives the data, what it is for, the legal basis and how long it is kept.

• E-mail and password (the password is stored only in protected form, with no possibility of reading it): so you can sign in and recover access. Legal basis: performance of the contract (LGPD, art. 7, V). Kept until you delete the account.
• Language, country and, if you want, your name: to talk to you in your language, show the right currency and address you by name. Basis: performance of the contract. Until the account is deleted.
• Devices linked to the account: a code generated by the app (in the format DAZO-XXXX-XXXX-XXXX), the name you gave it, the type (Android TV, Google TV or Fire TV), how the app was installed and the date of the last access. It lets Premium work on up to 5 devices and lets you see and disconnect each one. Basis: performance of the contract. Until you disconnect the device or delete the account.
• Plan and purchases: the plan, the start and end dates, whether it renews, where it came from (website, Google Play or Amazon) and the identifier the store or Stripe gives the purchase. Used to unlock Premium and prove the payment. Basis: performance of the contract (art. 7, V) and compliance with legal and tax obligations (art. 7, II). Receipts are kept for 6 years, the term of tax obligations; after the account is deleted, the purchase record remains with no link to you.
• Payments on the website: date, plan, amount, currency, the receipt link and the customer identifier at Stripe. Card and Pix details stay only with Stripe: DAZO neither sees nor stores them. Basis: performance of the contract and tax obligation. 6 years.
• Access logs: the date and time, the IP address and the source port of each access to the account functions, as required by the Brazilian Internet Civil Rights Framework (Law 12.965/2014, art. 15) and Decree 12.975/2026. Basis: legal obligation (art. 7, II). Kept for 6 months and deleted automatically afterwards, with restricted access.
• E-mail verification codes: when you confirm the e-mail, reset the password or recover the parents' password, we generate a code, stored in protected form while it is valid and deleted up to 1 day after it expires; the sending record (e-mail and time) is kept for 2 days, to limit the number of e-mails. Basis: performance of the contract and security (art. 7, V and IX).
• Server failure and security logs: errors of our functions, with none of your content, to keep the service running and secure. Basis: legitimate interest in security (art. 7, IX). Up to 6 months.
• Your message to support: when you write through the website, we keep the text, your e-mail, the language and the IP address of the sender (against abuse) in order to reply. Basis: performance of the contract and security (art. 7, V and IX). Up to 2 years after it is received.

We do not request or process sensitive data, children’s data or precise location. There is no consumer profiling, advertising or sale of data, under any circumstances.

4. Who else processes data for DAZO (processors)

For the service to work, these companies process data on our behalf, only with what they need and under contract:

• Supabase (database, sign-in and server functions): account, device, plan data and access logs. The servers are in São Paulo, Brazil; the provider’s authentication infrastructure and some of its functions use resources in the United States.
• Vercel (website hosting): receives the IP address of website visitors to deliver the pages and protect the service. United States.
• Stripe (payments on the website): e-mail, name, country and the payment details you type on their page. Stripe is the controller of card and Pix data. United States and Brazil.
• Resend (sending the account e-mails): your e-mail and the content of the e-mails we send, with no open or click tracking. United States.
• Cloudflare (DNS and domain e-mail): technical network data. United States.

When you buy through Google Play or the Amazon Appstore, the store collects and processes the payment data directly, as a controller, under its own privacy policy. DAZO receives only the purchase identifier and the status (active, cancelled, refunded), to unlock Premium.

5. International transfers

Some processors are located or have infrastructure outside Brazil (United States). The transfer takes place to perform the contract with you (LGPD, art. 33, IX) and with the safeguards set out in Resolution CD/ANPD 19/2024: the provider’s contractual clauses and security measures (encryption in transit and at rest, restricted access).

For people in Europe or the United Kingdom: the transfer to Brazil and to the United States relies on the European Commission’s standard contractual clauses and, where they exist, on adequacy decisions.

6. How long we keep data

• Account, devices and preferences: until you delete the account.
• Payment receipts and tax records: 6 years.
• Access logs (IP, date and time): 6 months.
• Verification codes: up to 1 day after they expire (sending records, 2 days).
• Sign-in audit log (sign-in, password change and session renewal events, with IP): 6 months, deleted automatically.
• Security incident records: 5 years (Resolution CD/ANPD 15/2024).
• Messages to support: 2 years after they are received.

When you delete the account, the e-mail, password, name, language, country and devices are erased from our systems right away, the e-mail is removed from your messages to support and your customer record at Stripe is deleted. What the law requires us to keep (receipts, access logs and the sign-in audit log) stays for the periods above, with no link to you beyond what is needed to meet the obligation; receipts also stay at Stripe for its legal retention periods.

7. Your rights

At any time and at no cost, you can:

• confirm whether we process your data and access it;
• correct incomplete or outdated data (language, country and name in My account; the e-mail in My account › Account);
• request the anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
• request the portability of your data;
• delete the whole account, through the website (dazoplayer.app/en/delete-account) or by e-mail;
• know with whom we share your data (section 4);
• withdraw consent, where consent is the basis;
• lodge a complaint with the Brazilian National Data Protection Authority (ANPD) or, in Europe, with your local authority.

Ask through the DPO channel, privacy@dazoplayer.app, from the account’s e-mail. We reply within 15 days; in exceptional cases, with justification, the period may double, under Resolution CD/ANPD 2/2022 for small-scale agents.

8. Security

We use encryption in transit (HTTPS) and at rest, passwords stored only in protected form, per-account access control in the database (each person sees only their own data), limits against brute-force attempts, protection against known leaked passwords and audit logs with restricted access. No system is infallible; if a security incident occurs that may cause you relevant risk or harm, we will notify the ANPD and the affected people within 3 business days, as required by Resolution CD/ANPD 15/2024.

9. Storage in your browser

The website stores in your browser only what it needs to work: your session (so you stay signed in), the chosen language and the country you chose to see prices in the right currency. On the first visit, the country comes from the approximate location of your IP address, calculated by Vercel (only the country; the address is not stored). We use no advertising cookies and no third-party analytics. That is why the website shows no cookie banner: what stays in your browser is only what is essential for the service you asked for.

10. Children

DAZO does not create accounts for people under 18 and does not collect children’s data. The Kids profile is created and managed by the adult inside the TV, and nothing from it goes to the server. If we discover an account created by a minor, it will be closed and the data erased.

11. Error reports and “Help improve”

Today the app does not send error reports or usage data to us, even with the “Help improve” option turned on. If that changes, the reports will be anonymous, will never include your playlist, and this Policy and the app will be updated beforehand.

12. Changes to this Policy

Each version has a number and a date. Relevant changes are announced on the website, in the app and by e-mail before they take effect, and we ask for your acceptance again. The current version is always at dazoplayer.app/en/privacy.

13. Contact us

DPO and requests about data: privacy@dazoplayer.app. Support: support@dazoplayer.app. To delete the account: dazoplayer.app/en/delete-account.