EN
Contact us

Regulatory · LGPD

Privacy Policy and Terms of Use

This document explains how Cumbuca Instituição de Pagamento LTDA. collects, processes, stores and protects user data. It applies to all Cumbuca services and governs the rights and duties of users and of the institution, in accordance with Brazilian Law No. 13,709/2018 (LGPD).

Version
1.0
Last updated
August 2025
Published
21 Apr 2026

Courtesy translation. The Portuguese version is the legally binding document.

About Cumbuca

Cumbuca is a payment institution regulated by the Central Bank of Brazil, acting as a payment initiator in the Open Finance ecosystem. For the purposes of this policy, the controller's contact and registration details are:

Legal name
CUMBUCA INSTITUIÇÃO DE PAGAMENTO LTDA.
CNPJ (tax ID)
44.353.942/0001-29
Privacy
privacidade@cumbuca.com
Support
suporte@cumbuca.com
Ombudsman
ouvidoria@cumbuca.com · 0800 715 8075

Data collected

Cumbuca collects the following categories of data, always tied to a specific purpose described in the next section:

Personal data (individuals)

Full name, CPF, ID document, date of birth, address, email, phone, professional data, nationality and parental data.

Business data (legal entities)

Legal name, CNPJ, NIRE, incorporation date, legal representatives' data, revenue and asset information.

Financial data

Bank balances, transaction history, credit card data, investment records, credit operations and foreign exchange operations, always under specific consent.

Technical data

IP address, device characteristics, cookies, geolocation, browser information, FIDO2 signatures and device identifiers.

Behavioral data

Transaction patterns, usage logs, authentication attempts and risk signals used for fraud prevention and account protection.

Purposes of processing

Data is processed exclusively for the following purposes:

  • User identification and authentication
  • Provision of payment initiation services (Pix, scheduled, recurring, Pix Automático)
  • Data sharing via Open Finance, only with explicit consent
  • Fraud prevention and security monitoring
  • Compliance with legal and regulatory obligations
  • Service improvement and personalization
  • Credit analysis and risk assessment, where applicable
  • Communication about services and updates

Data sharing

Data may be shared only when necessary to provide the contracted services or to comply with a regulatory obligation.

Internal sharing

Companies in the economic group, subsidiaries and contractually authorized business partners.

External sharing

Financial institutions, payment processors, infrastructure providers (Amazon Web Services), analytics platforms (Google Analytics) and competent regulatory authorities, such as the Central Bank of Brazil (BCB) and the National Data Protection Authority (ANPD), among others.

Condition

Sharing only takes place when necessary for the activities and products offered, with prior notice to the user where legally required.

Storage and security

Data is stored on Amazon Web Services (AWS) cloud infrastructure, with access controls restricted to authorized personnel who undergo periodic cybersecurity training.

Technical measures

  • TLS/SSL encryption on all communications
  • Mandatory HTTPS for access to the platforms
  • Advanced encryption for banking credentials and private keys
  • FIDO2 and OpenID Certified standards for authentication
  • Information security policies reviewed periodically

Retention

Data is retained for the period necessary to fulfil the stated purposes or to comply with a specific legal or regulatory obligation.

Data subject rights (LGPD)

In accordance with Law No. 13,709/2018, the data subject may exercise the following rights:

  1. Confirmation of the existence of data processing
  2. Access to the data processed
  3. Correction of incomplete, inaccurate or outdated data
  4. Anonymization, blocking or deletion of unnecessary data, subject to legal obligations
  5. Portability to another provider, except for content protected by trade secrets
  6. Withdrawal of consent at any time
  7. Information about sharing with public and private entities
  8. Explanation of the consequences of granting or denying consent

Any of these rights can be exercised by written request to privacidade@cumbuca.com or through the Customer Portal. Cumbuca responds within 10 business days.

Consent and withdrawal

Cumbuca operates on three types of consent:

  • LGPD consent, authorization to process personal data under Law 13,709/2018
  • Open Finance consent, specific approval to share financial data between institutions
  • Payment authorization, permission to initiate Pix transactions (one-off, scheduled or recurring)

Withdrawal is allowed at any time, through the Customer Portal or the same channel used to grant it. Withdrawal takes immediate effect on future transactions, with no retroactive effect on transactions already initiated.

Special categories

FIDO2 data

Collected and processed for users of biometric Pix, contactless Pix and the Redirect-free Journey (JSR), used exclusively for authentication and fraud prevention.

Credit data (SCR)

Information from the Central Bank's credit registry may be shared upon explicit consent, for personalized credit product offers.

Employee data

Employer name and job title collected for profile analysis and identity verification.

Minors' data

Processed only when the minor is a dependent or beneficiary, in the best interest of the child and never for marketing purposes.

Prohibited uses

Users must not:

  • Violate applicable laws or regulations
  • Assume a false identity
  • Share illegal, offensive or harmful content
  • Infringe intellectual property rights
  • Transmit malware or disruptive code
  • Carry out financial activities without the required regulatory authorization
  • Use the service for money laundering or terrorism financing
  • Attempt to circumvent security mechanisms

Non-compliance authorizes Cumbuca to suspend or block access without prior notice, notifying the competent authorities where applicable.

Governing law and jurisdiction

This document is governed by the laws of the Federative Republic of Brazil. The courts of the District of São Paulo, SP are chosen to settle any disputes, without prejudice to the consumer's right to file suit in the courts of their own domicile, under the Consumer Protection Code.

Contact

Privacy / LGPD rights
privacidade@cumbuca.com
Technical support
suporte@cumbuca.com
Address
São Paulo, SP, Brazil

Changes to this policy

Cumbuca may modify this policy at any time. Updates are published with an explicit modification date. Continued use of the services after publication of the new version constitutes acceptance of the new terms, with no retroactive effect on consents already granted.