Privacy Policy
Last updated: June 21, 2026
1. Introduction
This Privacy Policy explains how Bob Payments collects, uses, shares, and protects personal data when you use our payment orchestration platform, website, and app. Bob Payments acts as controller for its own users' data and as processor when it handles data submitted by a merchant about that merchant's customers.
2. Data We Collect
2.1 Account data
- Name and company name
- Email address and phone number
- CPF or CNPJ, where required
- Business profile and intended use provided during registration
- Social-login identifiers and profile photo when you use those providers
2.2 Authentication and device data
- One-time codes sent by email
- IP address, browser information, activity date, and login method
- Passkey/WebAuthn public key and device identifier, never biometric data
- Push-notification tokens when you enable app notifications
2.3 Merchant customer data
When processing payments, we may handle the name, CPF/CNPJ, email, phone number, address, IP address, and transaction origin domain collected by the merchant.
2.4 Transaction and usage data
- Amounts, status, PIX codes, and transaction dates
- Account, gateway, routing, and notification settings
- Activity records, fraud events, and audit logs
- Billing and subscription data handled by our payment processor
3. Purposes and Legal Bases
We process personal data to:
- Perform the contract: operate the platform, process transactions, and manage accounts
- Protect legitimate interests: security, fraud prevention, analytics, and service improvement
- Comply with legal obligations, including tax and regulatory requirements
- Obtain consent for non-essential cookies and marketing communications when required
5. International Transfers
Some providers may process data outside Brazil. When that happens, we use the safeguards required by applicable data-protection law and share only the information needed for the relevant service.
6. Images and Files
You may upload checkout branding, images, and data lists. You are responsible for having the rights and legal basis required for that content. We use it only to provide the features you configure and to maintain the platform.
7. Security
We use technical and organizational safeguards, including:
- Encryption in transit through HTTPS/TLS
- Encrypted and isolated gateway credentials
- Access controls and tenant separation
- Audit logs, monitoring, and fraud-prevention controls
8. Retention and Deletion
We retain data for as long as needed to provide the service, meet legal and regulatory obligations, resolve disputes, enforce agreements, and protect the platform. When retention is no longer required, data is deleted or anonymized when reasonably possible.
9. Your Rights
Subject to applicable law, you may request:
- Confirmation and access to your data
- Correction of incomplete or inaccurate data
- Deletion, anonymization, or blocking where applicable
- Portability and information about sharing
- Review of decisions based solely on automated processing, when applicable
11. Children
Bob Payments is intended for businesses and users aged 18 or older. We do not knowingly collect personal data from children.
12. Changes
We may update this policy from time to time. The latest version and revision date will always be published on this page.
13. Data Protection Officer
Requests and questions for our data-protection contact can be sent to dpo@bob.company.
14. Contact
For privacy questions, contact privacy@bob.company or contato@payments.bob.company. See also our Terms of Use.