Courtesy translation. In case of any discrepancy, the Portuguese version prevails.
Last Updated: August 20, 2026 (Version 3.0)
PRIVACY POLICY, Compra Rápida
Hello! Welcome to Compra Rápida.
Compra Rápida Checkout provides high-performance checkout and sales recovery solutions for e-commerce stores (“Platform”). Through the Platform, you (“User”) purchase products and/or services directly from our Partners’ stores using a fast, secure, and transparent payment process (“Services”), as described in the Terms of Use (“Terms”).
At Compra Rápida, transparency with you is essential. In order to provide the Services, we need to collect some of your Personal Data while you use the Platform. Compra Rápida follows best security practices to protect and store your Personal Data and will not use it in any way that conflicts with this Privacy Policy, the Terms of Use, or applicable laws.
1. Definitions
"Platform": Compra Rápida's suite of Checkout and sales recovery solutions, integrated with Partners' online stores.
"Partners": e-commerce businesses (retailers) that use Compra Rápida's solutions in their online stores.
"Personal Data": any information relating to an identified or identifiable natural person, as defined by the LGPD.
"LGPD": Law No. 13,709, dated August 14, 2018 (General Personal Data Protection Law).
"Data Subject": the individual to whom the Personal Data refers.
2. Who We Are and How to Contact Us
COMPRA RAPIDA INTERMEDIACAO DE NEGOCIOS LTDA.
CNPJ No. 43.776.754/0001-40
Rua Cardeal Arcoverde, No. 2365, Suite 33, Pinheiros
, São Paulo, SP, ZIP Code 05407-003
Data Protection Officer (DPO): Konrad Doern
Email: privacidade@comprarapida.co
If, after reading this Policy, you have any questions or need to address issues involving your Personal Data, please contact us through the channel listed above.
3. Data on individuals under 18 years of age
We do not collect or knowingly request Personal Data from individuals under the age of 18. If we become aware that we have collected Personal Data from an individual under the age of 18, we will delete the Personal Data, though we may retain minimal identification information about the minor solely to prevent another attempt to register.
4. What data do we collect and process?
Compra Rápida processes the following categories of Personal Data:
(A) Identification and contact information: name, CPF, email address, phone number, and shipping and billing addresses, as provided by you during checkout;
(B) Payment data: payment method, transaction amount and items, and card data used to process the payment. Card data is securely captured and tokenized by a PCI-DSS-certified payment provider (currently, Tuna), Compra Rápida does not store the full card number (PAN) or the security code (CVV) in its databases; it retains only the token and the non-sensitive data necessary for the transaction (such as the last few digits and the card brand). Compra Rápida does not collect checking or payment account numbers, account balances, PIX keys, or any banking information from the User or third parties;
(C) Browsing and device data: IP address, browser, operating system, session identifiers, and data collected by cookies and similar technologies, used for operational purposes, security, and fraud prevention;
(D) Communications data: records of messages exchanged with Compra Rápida through customer service and order recovery channels (for example, email and WhatsApp), when you use these channels;
(E) Data received from Partners: information regarding orders and shopping carts at Partners’ stores, necessary for the provision of the Services (for example, items in the shopping cart and order status).
5. What do we use the data for?
- Process the checkout and complete transactions with Partners and payment providers;
- To prevent fraud and ensure the security of the Platform and its Users;
- Send transactional communications regarding the order (confirmations, status updates, and delivery);
- Resume unfinished purchases by sending a notification via email or WhatsApp, where applicable and provided that the opt-out option is respected;
- Comply with legal and regulatory obligations;
- Improve the Platform and Services through statistical and performance analysis;
- Provide support and customer service;
- Regularly exercise Compra Rápida rights, including in judicial and administrative proceedings.
6. Legal Basis
We process Personal Data based on the legal grounds set forth in the LGPD, including: the performance of a contract and preliminary procedures (Art. 7, V); compliance with a legal or regulatory obligation (Art. 7, II); the legitimate interests of Compra Rápida or third parties, while respecting their fundamental rights and freedoms (Art. 7, IX); fraud prevention and ensuring the Data Subject’s security (Art. 11, II, “g,” when applicable); and consent, when necessary (Art. 7, I).
7. Cookies
We use cookies and similar technologies to recognize the User, enable essential checkout features, ensure security, and personalize the experience. Certain features are only available through cookies; if the User disables them, use of the Platform may be limited.
8. With whom do we share the data?
Partners (retailers): to facilitate order fulfillment, product delivery, and after-sales service;
Payment and anti-fraud providers: to process transactions securely and prevent fraud;
Infrastructure and technology providers: cloud and database services (e.g., AWS and MongoDB Atlas) and monitoring and observability tools, under contracts that require security and confidentiality standards;
Messaging providers: for sending transactional and purchase recovery communications (e.g., WhatsApp Business);
Judicial or government authorities: to comply with legal or regulatory obligations or court orders.
We require that third parties with access to Personal Data adhere to standards of confidentiality, security, and data protection consistent with this Policy and the LGPD.
9. International Transfers
Personal Data is stored on servers located in Brazil and the United States (cloud infrastructure). When international transfers occur, we will take the measures required by the LGPD to ensure that Personal Data remains protected.
10. How long do we retain the data?
We retain Personal Data only for as long as necessary to fulfill the purposes of this Policy, to comply with legal and regulatory obligations (for example, transaction records and access logs required by law), to exercise rights, or for another legitimate reason, in accordance with Compra Rápida’s Data Retention Schedule. At the end of the applicable retention periods, the data is securely deleted in accordance with the Data Disposal Policy.
11. What are your rights?
Under the LGPD, you have the right to: confirmation of the existence of data processing; access to your data; correction of incomplete, inaccurate, or outdated data; anonymization, blocking, or deletion of unnecessary, excessive, or improperly processed data; portability, subject to ANPD regulations; erasure of data processed with consent, except where retention is required by law; information regarding data sharing; information regarding the option to withhold consent and its consequences; withdrawal of consent; and the right to object to processing that does not comply with the LGPD.
To exercise your rights, please send an email to privacidade@comprarapida.co. Before we can process your request, we may ask you to provide information to verify your identity.
12. How We Protect Your Data
We have implemented technical and administrative security measures in line with industry best practices, including: encryption of communications (TLS/HTTPS) and data at rest; access control with the principle of least privilege and multi-factor authentication; continuous security monitoring; and internal policies on information security, vulnerability management, and incident response. In the event of a security incident that could pose a significant risk or cause significant harm to Data Subjects, we will notify the ANPD and the affected Data Subjects, in accordance with Article 48 of the LGPD.
13. Changes to This Policy
This Policy may be updated at any time, provided that such updates comply with legal requirements. Material changes will be highlighted through notices on the Platform and/or email notifications.
14. Governing Law
This Privacy Policy is governed by and interpreted in accordance with the laws of the Federative Republic of Brazil.