LGPD Compliance#

Brazil's General Data Protection Law (LGPD / Lei 13.709/2018) governs how personal data is collected and processed. The Evolu Integrators API enforces consent at the schema level: every entry must carry a valid consent object.

Joint responsibility

As the party collecting the participant's data and consent, you are a data processor under LGPD. You must obtain informed consent before submitting an entry and keep a verifiable record of it. Evolu stores the consent snapshot you send; it does not collect consent on your behalf.

granted_atstring<date-time>required

A full ISO 8601 timestamp with timezone of when the participant granted consent — e.g. 2026-04-30T14:30:00Z. Partial values like 2026 or a bare date are rejected.

ip_addressstringrequired

The IPv4 or IPv6 address of the consenting user. Validated as a real IP address.

user_agentstringrequired

The browser/client User-Agent string captured at consent time. Accepted at any length; stored values longer than 1024 characters are truncated.

term_versionstringrequired

The identifier of the terms the participant accepted, e.g. v2.1. Keep this aligned with the terms versions configured on the campaign.

Beyond the four required fields, you can record the participant's per-category consent choices with an optional consents array. Each item is a { consent_type, granted } pair:

consentsarray

The participant's per-type consent choices. Optional — omit it if the campaign only needs the core consent record. Each entry is recorded as the participant's explicit choice.

consents[].consent_typestringrequired

The consent category. One of: marketing (marketing communications), data_sharing (sharing data with third parties), image_use (use of image/voice), regulation (promotion rules), privacy_policy, transactional (operational messages), or other.

consents[].grantedbooleanrequired

Whether the participant granted (true) or denied (false) this consent.

Implicit consents

The regulation, privacy_policy, and transactional consents are always recorded for an entry, even when you don't send them — submitting an entry implies the participant accepted the promotion's rules and operational messaging. Send them explicitly in consents only when you need to record an actual false. A flag you submit always overrides the implicit default.

Example#

{  "consent": {    "granted_at": "2026-04-30T14:30:00Z",    "ip_address": "189.50.12.34",    "user_agent": "Mozilla/5.0 (Linux; Android 14) Mobile Safari/605.1.15",    "term_version": "v2.1",    "consents": [      { "consent_type": "marketing", "granted": true },      { "consent_type": "data_sharing", "granted": false }    ]  }}

What Evolu does with it#

The consent snapshot is attached to the entry and the campaign enrollment. The granted_at and term_version are persisted as the enrollment's consent record and refreshed on every accepted submission for that participant.

Your obligations#

  • Collect consent first. Never fabricate a granted_at — it must reflect a real, informed opt-in.
  • Store your own record. Keep proof of consent in your systems for audit.
  • Honour data-subject requests. Participants may request access to or deletion of their data (LGPD Arts. 7–10, 18).
  • Secure the transport. API keys carry PII — protect them as described in Authentication.