Privacy Policy

1. Who is responsible for your data

Aco Online ("Platform") is operated by ACO Serviços Digitais, which is the controller of your personal data, the one who decides why and how it is used. The company's full identification is at the end of this page and is provided to any person or authority who requests it.

We have a Data Protection Officer (DPO), who is your point of contact for any privacy matter and also the channel of communication with the ANPD (Brazil's national data protection authority): [email protected] (Amanda Soares).

This Policy applies to the public site, to the client app and to the advertiser panel. It is part of the Terms of Use. We write in plain language on purpose; when a technical term is unavoidable, we explain it.

2. Our commitments

• Minimum necessary: we collect only what each feature needs.
• Discretion: a neutral name on your statement, emails and messages in neutral language, no mention of the type of service in communications.
• We never sell data and never use it for third-party advertising.
• Advertisers and clients do not see each other's data beyond what each one chooses to publish or send.
• Sensitive data with extra care: biometrics and documents are kept in a separate, encrypted vault, with restricted and logged access.
• Transparency: this page lists everything. If something changes, we tell you beforehand.

3. What data we collect

From all site visitors: IP address, date and time of access, pages visited, device and browser type, approximate city (from the IP), language, essential cookies (age confirmation, preferences). We do not use advertising cookies.

Camera age check (visitors without an account): to unlock 18+ content, you can take a selfie on the spot. The image is sent to our analysis provider (AWS Rekognition), which returns only an estimated age range; the photo is processed in memory and discarded immediately: it is not stored, is not compared with anyone and does not identify you. We keep only the result (pass/fail, estimated range) and a temporary code in your browser, valid for 12 hours. Legal basis: legal obligation (LGPD, Brazil's data protection law, art. 11, II, "a"; Lei 15.211/2025, art. 9).

From clients (account): email, password (stored irreversibly), optional phone number, age confirmation and acceptance of the Terms with date and version, favorites, history of profiles viewed, messages sent, reviews, clicks on contacts (logged anonymously, without the number dialed), Premium Content payments and top-ups (amount, date, method, provider identifier, never the full card number), devices that installed the app and notification permission.

From advertisers (account and ad): everything you publish (stage name, photos, videos, description, services, prices, cities and neighborhoods served, contacts you choose to display), ad statistics, messages, balance and withdrawals (with the PIX key and the account holder's name, which must be yours), acceptance of the Terms with date and version, notification preferences.

From advertisers, identity and age verification (sensitive data): image of the official document, proof-of-life selfie/video, facial biometric data extracted to compare the document with you and with the ad photos, and the data shown on the document (legal name, CPF, date of birth, parentage when printed). We also check CPF, name and date of birth against official databases to confirm they match.

Data about your sexual life: given the nature of the Platform, the simple fact of advertising, or of keeping a client account, favorites and conversations, can reveal information about your sexual life, which the LGPD treats as sensitive data. That is why we apply the strictest rules of the law to this service (section 5), along with the discretion described on this page.

Transaction and consumption data: purchases, top-ups and wallet movements (amounts, dates, payment method), the consent given at the time of content purchases, and the record of access to purchased content (what was accessed and when). These records exist to perform the contract, settle refunds and defend rights, yours and ours.

What we do not collect: anyone's exact location (GPS); address book contacts; the content of WhatsApp chats or calls made outside the Platform; clients' full bank details.

4. What we use each piece of data for

• Providing the service: creating and maintaining accounts, publishing and displaying ads, searches and filters, messages, favorites, notifications you turn on, payments and payouts.
• Proving age and identity of advertisers and, when required, of clients: it is a legal obligation (ECA, Brazil's child protection statute, and Lei 15.211/2025) and the foundation of trust on the Platform.
• Safety and prevention of fraud and exploitation: detecting duplicate accounts, third-party documents, manipulated images, signs of coercion or human trafficking, scams and abuse, with automated systems and human review.
• Moderating content: photos, videos, texts and messages go through automated analysis (including artificial intelligence) and, when flagged, human review, to comply with the law and our rules.
• Handling reports, removal requests and authorities: reviewing notifications, preserving evidence and responding to court orders and lawful requests.
• Statistics and service improvement: aggregated usage metrics (for example, how many visits an ad received). Whenever possible, we use anonymized data.
• Communications: service notices (approval, payments, expirations, messages received) by email, in-app notification and, if you allow it, WhatsApp. Marketing communications only with your consent, and you can cancel whenever you want.

We do not make automated decisions producing legal effects without the possibility of human review: every content or verification rejection can be contested and is reviewed by a person.

5. The legal bases we rely on

The LGPD (Brazil's data protection law) requires each use of data to have a "legal basis". Ours are:

• Performance of a contract (art. 7, V): everything necessary to provide the service you signed up for.
• Legal obligation (art. 7, II): age verification, keeping access logs for 6 months (Marco Civil da Internet, Brazil's internet framework law, art. 15), keeping tax and payment records, complying with court orders.
• Legitimate interest (art. 7, IX): safety, fraud prevention, moderation, statistics, always weighing your rights and with the possibility of objection.
• Consent (art. 7, I): WhatsApp notifications, marketing communications, non-essential cookies.

Sensitive data (biometrics, documents and information about sexual life) follows art. 11 of the LGPD and is processed on the basis of: specific, highlighted consent, requested at verification and sign-up time (you can revoke it, but without it advertising is not possible); compliance with a legal obligation (age verification); regular exercise of rights and fraud prevention and safety of the data subject (art. 11, II, "d" and "g"). We never use sensitive data for any other purpose.

6. Who we share with

We share only what is necessary with processors, companies that process data on our behalf, under contract and without being allowed to use it for other purposes:

• Payment provider (PIX and card): name, CPF and amount, required by the rules of the Central Bank of Brazil and of the provider. The statement shows only the company's neutral name.
• Identity verification and biometrics providers: the document image, selfie/video and document data, to confirm identity, proof of life and age, and to query official databases (CPF, Receita Federal, Brazil's federal revenue service).
• Hosting and cloud storage (Amazon Web Services, São Paulo region, with backups): all Platform data; verification media in a separate, encrypted vault.
• Automated moderation (image and text analysis services, including artificial intelligence, from Amazon and Anthropic): submitted photos, videos and texts are analyzed to detect forbidden content, manipulation and face comparison. These providers do not use the content to train models.
• Email, notification and WhatsApp delivery: your email, phone number (if you opt into WhatsApp) and device notification identifier, with neutral texts.
• Site protection and distribution (Cloudflare): IP address and connection data, for security and performance.

Some of these providers are located outside Brazil; international transfers are made with the safeguards of the LGPD (contractual clauses and equivalent security standards).

Payment provider: the data needed to process charges, payouts and payout sub-accounts (name, CPF, bank details of the person receiving) goes to our payment provider, which acts as a processor and also as a controller for its own obligations (for example, anti-money-laundering duties). Tax obligations: we issue the tax documents the law requires for the Platform's services, with a neutral description of the service, and transmit them to the competent bodies.

Authorities: we provide data only under a court order or a request with a legal basis, after review, and on our own initiative when the law requires us to report signs of crimes against minors, exploitation or human trafficking.

Between users: clients see only what the advertiser publishes; advertisers see only the client's display name and messages. Legal name, CPF, documents, biometrics and payment data are never shown to other users.

We do not sell, rent or hand over personal data to third-party advertisers, data brokers or advertising networks.

7. How long we keep it

• Account and ad data: for as long as the account exists. When you close it, we anonymize within 30 days (what the law requires us to keep stays in restricted storage, without public identification).
• Verification document, selfie/video and biometrics: kept in an encrypted vault while the account is active, because they are the proof that age verification was performed, a legal obligation. After closure, we keep them for the applicable limitation period (as a rule up to 5 years), then delete them irreversibly. You can request deletion earlier, and we will comply when there is no legal obligation to keep them.
• Access logs (IP, date and time): 6 months, as required by the Marco Civil da Internet (Brazil's internet framework law, art. 15), extendable by order of an authority.
• Payments, withdrawals and invoices: for the tax and limitation period (5 years).
• Reports, moderation and evidence of violations: for the period needed for investigation and defense in proceedings, under restricted access.
• Messages: for as long as the conversation exists for the parties; closed conversations are deleted after 12 months, unless there is a report or an order from an authority.
• Backups: up to 35 days after deletion, then overwritten.

Transaction records and tax documents are kept for the legal, accounting and tax periods (as a rule, 5 years or more), even after the account is closed, solely to comply with those obligations and to exercise rights in proceedings.

8. Your rights and how to exercise them

You can, at any time and free of charge: confirm whether we process your data; access it; correct incomplete or outdated data; request anonymization, blocking or deletion of data that is unnecessary or processed unlawfully; request portability; know who we share it with; revoke consents; object to processing based on legitimate interest; and request human review of automated decisions.

To do so, use the app/panel (account closure, notification cancellation, download of your data) or write to the DPO: [email protected]. We reply within 15 days. To protect you, we may ask for identity confirmation before fulfilling sensitive requests, through the same channel you signed up with, never by asking for your password.

If you believe your rights were not respected, you can complain to the Autoridade Nacional de Proteção de Dados (ANPD), Brazil's national data protection authority: gov.br/anpd.

9. Cookies and notifications

Essential cookies (no consent required): login session, protection against fraud and attacks, age confirmation, language and display preferences (for example, discreet mode). Without them the Platform does not work.

Statistics: we measure audience with Google Analytics, using aggregated data and without identifying people. It uses analytics cookies that recognise the browser across visits; we show a notice on your first visit and, by continuing to browse, you agree. You can block these cookies in your browser at any time and request deletion through the DPO channel.

App notifications: only after you turn them on. We keep a technical device identifier (not your number), which you erase by turning notifications off or removing the app.

WhatsApp: only with your consent, recorded at sign-up or in the preferences, with neutral texts and between 8 a.m. and 10 p.m. Cancel whenever you want in the panel or by replying "parar" (stop).

10. How we protect it

Encryption in transit (TLS) on all connections; encryption at rest for the verification vault (document, selfie, biometrics) and for the sensitive data in the database; separation between public media, Premium media (access only via temporary link and an active subscription) and verification media (access only by authorized staff, with logging); passwords stored irreversibly; role-based access control and two-factor authentication for the team; audit logs of all sensitive actions; periodic reviews and cloud providers with security certifications.

No system is 100% secure. If an incident occurs that could pose a relevant risk to you, we will notify you and the ANPD within the deadlines and in the manner the LGPD requires, explaining what happened and what to do.

11. Children and adolescents

The Platform is forbidden to people under 18. We do not intentionally collect data from minors. If we identify a minor (as a visitor, as a client or in any content) we block access, remove the content, preserve the records required by law and notify the competent authorities (the Estatuto da Criança e do Adolescente, Brazil's child and adolescent statute, and Lei 15.211/2025).

If you are responsible for a minor and believe they used the Platform or appear in any content, write immediately to [email protected] or use the report form. These requests have top priority.

12. Changes to this Policy

We may update this Policy to reflect changes in the law, in the services or in the providers. Relevant changes are announced at least 15 days in advance by email and in the app; the current date and version are at the top of this page. Previous versions can be requested from the DPO.

13. Contact

DPO and LGPD rights: [email protected]. Support: [email protected]. Reports and content removal: [email protected] or /report. Authorities and legal requests: [email protected]. Company identification: end of this page.