LGPD Compliance#
Brazil's General Data Protection Law (LGPD / Lei 13.709/2018) governs how personal data is collected and processed. The Evolu Integrators API enforces consent at the schema level: every entry must carry a valid consent object.
Joint responsibility
As the party collecting the participant's data and consent, you are a data processor under LGPD. You must obtain informed consent before submitting an entry and keep a verifiable record of it. Evolu stores the consent snapshot you send; it does not collect consent on your behalf.
The consent object#
granted_atstring<date-time>requiredA full ISO 8601 timestamp with timezone of when the participant granted consent — e.g. 2026-04-30T14:30:00Z. Partial values like 2026 or a bare date are rejected.
ip_addressstringrequiredThe IPv4 or IPv6 address of the consenting user. Validated as a real IP address.
user_agentstringrequiredThe browser/client User-Agent string captured at consent time. Accepted at any length; stored values longer than 1024 characters are truncated.
term_versionstringrequiredThe identifier of the terms the participant accepted, e.g. v2.1. Keep this aligned with the terms versions configured on the campaign.
Consent flags#
Beyond the four required fields, you can record the participant's per-category consent choices with an optional consents array. Each item is a { consent_type, granted } pair:
consentsarrayThe participant's per-type consent choices. Optional — omit it if the campaign only needs the core consent record. Each entry is recorded as the participant's explicit choice.
consents[].consent_typestringrequiredThe consent category. One of: marketing (marketing communications), data_sharing (sharing data with third parties), image_use (use of image/voice), regulation (promotion rules), privacy_policy, transactional (operational messages), or other.
consents[].grantedbooleanrequiredWhether the participant granted (true) or denied (false) this consent.
Implicit consents
The regulation, privacy_policy, and transactional consents are always recorded for an entry, even when you don't send them — submitting an entry implies the participant accepted the promotion's rules and operational messaging. Send them explicitly in consents only when you need to record an actual false. A flag you submit always overrides the implicit default.
Example#
{ "consent": { "granted_at": "2026-04-30T14:30:00Z", "ip_address": "189.50.12.34", "user_agent": "Mozilla/5.0 (Linux; Android 14) Mobile Safari/605.1.15", "term_version": "v2.1", "consents": [ { "consent_type": "marketing", "granted": true }, { "consent_type": "data_sharing", "granted": false } ] }}What Evolu does with it#
The consent snapshot is attached to the entry and the campaign enrollment. The granted_at and term_version are persisted as the enrollment's consent record and refreshed on every accepted submission for that participant.
Your obligations#
- Collect consent first. Never fabricate a
granted_at— it must reflect a real, informed opt-in. - Store your own record. Keep proof of consent in your systems for audit.
- Honour data-subject requests. Participants may request access to or deletion of their data (LGPD Arts. 7–10, 18).
- Secure the transport. API keys carry PII — protect them as described in Authentication.