Privacy Policy — IGotYou!

1. Data controller

The controller of the data processed in IGotYou! is MONOBIT (Brazilian company ID/CNPJ 59.794.566/0001-85). To exercise your rights or ask about privacy, contact our data protection officer at info@monobit.com.br. We process personal data under Brazil's General Data Protection Law (Law No. 13,709/2018 — LGPD).

2. Data we collect

• From the organizer (account): name, email, password (stored only as a hash), phone (optional), preferred language and, if enabled, the two-factor authentication secret.
• From participants (provided by the organizer): name, email and/or phone. Participants do not create an account.
• Content created in use: wish lists, anonymous messages, wall posts and the chosen emoji.
• Technical data: IP address, browser information (user-agent), access and error logs, and strictly necessary cookies.

3. Why we use it and on what legal basis

• Provide the service (create groups, run draws, deliver personal links): performance of the contract with the organizer and legitimate interest in operating the service.
• Send transactional emails (verification, invitations, "scratch to see who you drew", notices): service operation.
• Security and abuse prevention (rate limiting, fraud protection): legitimate interest.
• Keep proof of consent (acceptance of these documents, with date, version and IP): compliance with legal obligation and exercise of rights (LGPD Art. 7, II and VI).
• Comply with legal obligations where applicable.

4. Participant data

Participant data is provided by the organizer, who represents having a lawful basis to include it. We process it only to deliver the Secret Santa (invitation, personal link, draw, notices) on the organizer's behalf, and for no other purpose. A participant may request removal by contacting the organizer or us at info@monobit.com.br.

5. Blind organizer

By design and architecture, the draw result (who drew whom) is never shown to the organizer on any screen: it is revealed only on each participant's personal page, protected by a token that exists only in the link that was sent.

6. Who we share with

We do not sell your data. We share it only with providers who help us operate the service, as needed: hosting (Vercel), database (Neon), email delivery (Amazon SES), DNS and network protection (Cloudflare) and error monitoring (Sentry). Some of these providers are outside Brazil, which involves an international data transfer (LGPD Art. 33) carried out with appropriate safeguards. We may also disclose data to comply with the law or a competent authority's order.

7. Cookies

We use only necessary cookies: the session cookie (keeps you logged in), the draft cookie (holds a group being created before the account) and the language cookie. We currently use no advertising cookies. If that changes, we will update this Policy and request renewed acceptance where required.

8. How long we keep data

• Groups and their data: up to 90 days after the event date, then automatically deleted.
• Account-less group drafts: 24 hours.
• Deleted accounts and groups: a 24-hour grace period, then permanent deletion.
• Records of acceptance of these documents: preserved even after account deletion, as proof of consent (LGPD Art. 8) and for as long as needed to exercise rights.

9. Your rights (LGPD Art. 18)

You may request: confirmation of and access to your data; correction; anonymization, blocking or deletion of unnecessary data; portability; information about sharing; and withdrawal of consent. The organizer can delete their own account (and all its groups) in Settings. For other requests, contact info@monobit.com.br.

10. Security

We take reasonable technical and organizational measures: passwords stored only as hashes; the participant token stored as a hash (plus a reversible cipher whose key lives outside the database); HTTPS traffic; and rate limiting. No system is 100% secure, but we work to protect your data.

11. Minors

The service is intended for people aged 18 and over. We do not knowingly collect data from children or adolescents without the appropriate consent.

12. Changes to this Policy

We may update this Policy. When we publish a new version, we will request renewed acceptance where applicable, and the previous record is preserved.

13. Contact and DPO

Data protection officer (DPO): info@monobit.com.br.