Privacy Policy#

Last updated: July 28, 2026 · Effective date: July 28, 2026

This Privacy Policy explains how personal data is collected, used, shared, stored, and protected when you interact with the Evolu platform — including our web application and our official WhatsApp and Telegram chatbots — to register for and take part in promotional campaigns.

Evolu is a product operated by ZRP Aplicações Informáticas LTDA, a company incorporated under the laws of Brazil, enrolled under CNPJ 23.172.493/0001-42 (referred to here as "Evolu", "we", "us", or "our"). We process personal data in accordance with the Brazilian General Data Protection Law (LGPD — Lei nº 13.709/2018) and applicable regulations of the Secretaria de Prêmios e Apostas (SPA), which governs promotional campaigns in Brazil.

Controller and operator

Evolu provides its platform to businesses ("Campaign Organizers") that run promotional campaigns. For the personal data processed within a given campaign, the Campaign Organizer is generally the data controller and Evolu acts as the data operator (processor), processing data on the Organizer's behalf under written instructions. Where Evolu independently determines the purposes of processing — for example, platform security and fraud prevention — Evolu acts as controller for those activities. This Policy describes both roles.

Who this Policy applies to#

This Policy applies to participants and visitors who register or interact with the Evolu platform through any channel — our website, the WhatsApp chatbot, or the Telegram chatbot. If you reached us through a specific brand's campaign, the Campaign Organizer's own privacy notice may also apply; where the two differ for data the Organizer controls, the Organizer's notice prevails.

Personal data we process#

Depending on the campaign and the channel you use, we may process:

  • Identification and contact data — full name, CPF (Brazilian taxpayer ID), date of birth, email address, and phone number.
  • Messaging identifiers — your WhatsApp phone number and WhatsApp profile name, or your Telegram user ID, username, and display name, used to identify your conversation and deliver messages.
  • Message and media content — the messages you send to our chatbots and any media you upload, such as photos or PDFs of fiscal documents (tax coupons / invoices — NF-e, NFC-e, SAT, and similar) submitted to validate a participation.
  • Fiscal and participation data — the fiscal document access key (chave de acesso), purchase and product details extracted from your documents, entries, eligibility results, lucky numbers, and prize/award records.
  • Consent records — the terms you accepted, the version accepted, and the timestamp, IP address, and user agent captured at the moment of consent.
  • Technical and device data — IP address, device and browser identifiers, user agent, and approximate location derived from a store address you provide, collected to operate the service and detect fraud.

We do not intentionally collect sensitive personal data (as defined by the LGPD) and ask that you do not send it to us.

How and why we use your data#

We process personal data for the following purposes and legal bases under the LGPD:

  • Register and authenticate you — to create your enrollment and verify your identity via one-time codes sent to your email. (Legal basis: performance of a contract; your request.)
  • Validate participations — to read, verify, and score submitted fiscal documents, confirm purchase eligibility, and prevent duplicate or invalid entries. (Legal basis: contract; legal obligation; legitimate interest.)
  • Determine eligibility and award prizes — to run campaign mechanics (instant-win, lucky numbers, draws, collect-and-trade) and deliver prizes. (Legal basis: contract.)
  • Prevent fraud and abuse — to detect fraudulent documents, coordinated abuse, and misuse of the platform, protecting participants and Organizers. (Legal basis: legitimate interest; legal obligation.)
  • Communicate with you — to send transactional and service messages about your participation through the channel you used (web, WhatsApp, or Telegram). (Legal basis: contract; consent for marketing, where applicable.)
  • Comply with legal and regulatory duties — including SPA promotional-campaign rules and tax and audit obligations. (Legal basis: legal and regulatory obligation.)
  • Operate, secure, and improve the platform. (Legal basis: legitimate interest.)

Messaging channels — WhatsApp and Telegram#

When you interact with us on WhatsApp, messages are delivered through the WhatsApp Business Platform operated by Meta Platforms, Inc., and are also subject to WhatsApp's own terms and privacy policy. When you interact on Telegram, messages are delivered through Telegram Messenger and are subject to Telegram's terms. We use these channels only to serve the conversation you started and campaign-related messaging you are entitled to receive; we do not send unsolicited marketing outside the platforms' policies. You can end your session at any time by tapping Sair or sending /sair (or /menu), and stop receiving messages entirely by blocking the bot.

How we share data#

We share personal data only as needed to operate the service and comply with the law:

  • With the Campaign Organizer whose promotion you entered, so they can manage the campaign, verify participations, and deliver prizes.
  • With service providers (operators/subprocessors) who process data on our behalf under contract and confidentiality obligations — including cloud infrastructure and hosting providers, the messaging platforms above (Meta/WhatsApp and Telegram), document-processing (OCR) services, fiscal-document and taxpayer validation providers (including Brazilian tax authorities' public services), email delivery, prize-fulfillment partners, and monitoring/analytics tools. A current list of subprocessors is available on request from the contact below.
  • With public authorities and regulators — including the SPA and tax authorities — when required to comply with the law, a regulation, or a lawful request, or to establish, exercise, or defend legal rights.

We do not sell your personal data.

International data transfers#

Some of our providers process data on infrastructure located outside Brazil. When personal data is transferred internationally, we do so in accordance with the LGPD, relying on adequate safeguards such as contractual clauses and providers that commit to equivalent protection standards.

Data retention#

We keep personal data only for as long as necessary to fulfil the purposes described above, including the duration of the campaign and any period required to comply with legal, regulatory, tax, and SPA obligations, or to exercise or defend legal rights. When data is no longer needed, it is deleted or anonymized. See Data Deletion to request early deletion.

How we protect your data#

We apply technical and organizational security measures appropriate to the risk, including encryption of data in transit and at rest, envelope encryption of sensitive credentials via managed key services, access controls on a need-to-know basis, and monitoring. No method of transmission or storage is completely secure, but we work continuously to protect your information.

Your rights under the LGPD#

Subject to the LGPD (Art. 18), you have the right to request:

  • Confirmation that we process your data, and access to it;
  • Correction of incomplete, inaccurate, or outdated data;
  • Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in non-compliance with the law;
  • Portability of your data to another provider;
  • Information about the entities with which we shared your data;
  • Information about the possibility of not providing consent and the consequences;
  • Withdrawal of consent and deletion of data processed based on consent; and
  • Review of decisions taken solely on the basis of automated processing that affect your interests.

To exercise any of these rights, contact our Data Protection Officer at dpo@evolu.dev.br. We respond within the timeframe required by the LGPD. Note that some data may be retained where the law requires it, even after a deletion request.

Data deletion#

You can ask us to delete your personal data at any time. Full, step-by-step instructions are on the dedicated Data Deletion page. The fastest route is to email dpo@evolu.dev.br from your registered email address.

Children and minors#

Our campaigns are generally intended for adults (18+), and specific campaigns may set their own age requirements. We do not knowingly process the personal data of minors without the appropriate consent of a parent or legal guardian, as required by the LGPD. If you believe a minor has provided us data without such consent, contact us so we can address it.

Cookies#

Our web application uses strictly necessary cookies to keep you signed in and to operate the service securely. It does not rely on third-party advertising cookies.

Changes to this Policy#

We may update this Policy from time to time. When we make material changes, we will update the "Last updated" date above and, where appropriate, notify you through the platform. Continued use of the service after an update means you acknowledge the revised Policy.

Contact us#

Data Protection Officer (Encarregado / DPO): dpo@evolu.dev.br

Controller of the platform: ZRP Aplicações Informáticas LTDA — CNPJ 23.172.493/0001-42 — operating the Evolu platform, Brazil.