Version v4_2026-06-a — in effect since June 6, 2026
TrocaFigurinhas is a digital platform for trading collectible stickers, operated by its maintainers, reachable at privacidade@trocafigurinhas.com. We are the controller of the personal data collected on this platform, under the LGPD (Law No. 13,709/2018).
| Category | Data | Legal basis |
|---|---|---|
| Registration | Name, email, username, password (hash) | Contract performance (Art. 7, V) |
| Profile | Avatar photo, city, state | Legitimate interest / consent |
| Contact | Phone, alternate email | Consent (Art. 7, I) |
| Address | ZIP code, street, neighborhood, city, state | Contract performance — required for trades |
| Personal data | Date of birth, gender | Consent (Art. 7, I) |
| Communication | Email preferences (newsletter, trades, ratings) | Consent (Art. 7, I) |
| Activity | Trades, stickers, ratings, messages | Contract performance (Art. 7, V) |
| Technical | Access IP, date/time, session logs | Legitimate interest — security (Art. 7, IX) |
| Measurement with consent | Pages and detailed interactions via Google Analytics 4, with cookies, when you consent | Consent (Art. 7, I) |
| Anonymous aggregate measurement | Aggregate page-visit count via Google Consent Mode — without cookies and without a persistent identifier, even when you decline. The IP address is used only in transmission and discarded by Google, and is not stored by us or by Google to identify you | Legitimate interest — aggregate metrics (Art. 7, IX) |
| OAuth | Google ID, access token (via NextAuth) | Contract performance — login with Google |
| Category | Retention period |
|---|---|
| Active account | As long as the account exists |
| Closed account (anonymized) | Username and trade history kept for the reputation integrity of other users; PII removed immediately |
| Access/security logs | 90 days |
| Private messages | Deleted when the account is closed |
| Payment data | As required by tax law (5 years) |
To exercise any right or clarify questions, contact us: privacidade@trocafigurinhas.com. We'll respond within 15 days.
We adopt technical and organizational measures to protect your data: passwords stored with bcrypt hashing, communication via HTTPS, database isolated on an internal network, and access restricted by API key. In the event of an incident affecting your rights, we'll notify the ANPD within 72 hours and affected users as soon as possible.
We use essential session cookies to keep you authenticated (via NextAuth). If you accept, we also use Google Analytics 4 cookies and similar technologies for detailed audience measurement.
If you decline, no measurement cookie is stored. We still, however, collect aggregate and anonymous audience statistics via Google Consent Mode: signals are sent without cookies and without a persistent identifier, which don't allow you to be individually identified. The IP address is used only in transmission and discarded by Google, and isn't stored for identification purposes. This aggregate measurement relies on legitimate interest (Art. 7, IX of the LGPD).
You can change your choice at any time via the notice shown on the site or in My Account → Privacy.
Any updates will be published on this page with a new version date. For significant changes, we'll notify you by email or a notice on the platform.
Questions, requests, or complaints related to data privacy: privacidade@trocafigurinhas.com
You can also file complaints with the ANPD — Brazilian National Data Protection Authority.