1. Introduction
Fabricio Pereira Rabelo Ltda. (CNPJ 66.906.466/0001-69), headquartered at Av. Cristovao Colombo, 2144, Suite 408, 3rd floor, Floresta, Porto Alegre, RS, Brazil, ZIP 90560-001, owner of the Mega Coderz brand and operator of the Mega Voltz platform (megavoltz.com.br), processes personal data under Brazil's LGPD (Law 13.709/2018).
This Policy describes processing for drivers (app), CPO operators (/cpo panel), and visitors (site and /cadastro).
Registration requires explicit acceptance recorded with policy version (policyVersion). See also the Terms of Use.
2. Definitions
Key terms used in this Policy:
- Personal data: information related to an identified or identifiable natural person
- Data subject: the person whose data is processed
- Controller: Fabricio Pereira Rabelo Ltda. (Mega Coderz / Mega Voltz)
- Processor: third party or CPO processing data on instructions or local operation
- Tenant/CPO: charging network operator provisioned after approval
3. Who processes your data
Controller: Fabricio Pereira Rabelo Ltda. (Mega Coderz / Mega Voltz) — [email protected] · DPO: [email protected].
Partner CPOs process station operational data. Sub-processors include Mercado Pago, Google (Maps), Google FCM, Apple APNs, Resend, and AWS S3 (logos, no PII).
4. Data — Drivers
We collect the following data to operate your account and charging sessions:
Data
Name, email, password (hash)
Purpose
Account and authentication
Data
CPF (Brazilian tax ID)
Purpose
Unique registration, billing, legal obligations
Data
Phone (optional), address
Purpose
Contact, profile and billing
Data
Date of birth and gender (optional)
Purpose
Driver profile
Data
Vehicle (make/model/battery)
Purpose
Estimated pre-authorization
Data
Mercado Pago tokens
Purpose
Payment — never PAN/CVV
Data
Prepaid credits
Purpose
Internal wallet
Data
One-time geolocation
Purpose
Nearby stations — no persisted history
Data
Push token
Purpose
Session notifications
| Data | Purpose |
|---|---|
| Name, email, password (hash) | Account and authentication |
| CPF (Brazilian tax ID) | Unique registration, billing, legal obligations |
| Phone (optional), address | Contact, profile and billing |
| Date of birth and gender (optional) | Driver profile |
| Vehicle (make/model/battery) | Estimated pre-authorization |
| Mercado Pago tokens | Payment — never PAN/CVV |
| Prepaid credits | Internal wallet |
| One-time geolocation | Nearby stations — no persisted history |
| Push token | Session notifications |
5. Data — CPO operators
Business and team data:
Data
CNPJ, legal name, contact
Purpose
Pre-registration and contract
Data
Staff (name, email)
Purpose
/cpo panel and RBAC
Data
Mercado Pago OAuth
Purpose
Payment payouts to CPO
Data
Station address
Purpose
Map and OCPP operation
| Data | Purpose |
|---|---|
| CNPJ, legal name, contact | Pre-registration and contract |
| Staff (name, email) | /cpo panel and RBAC |
| Mercado Pago OAuth | Payment payouts to CPO |
| Station address | Map and OCPP operation |
6. Data — Visitors
Technical and session cookies for web auth; IP and user-agent for security; /cadastro form data for CPO pre-registration.
7. Purposes and legal bases
Purpose
Account, auth, sessions
Legal basis
Contract performance
Purpose
Payments and billing
Legal basis
Contract / legal obligation
Purpose
Geolocation and push
Legal basis
Consent
Purpose
CPO pre-registration
Legal basis
Pre-contract / legitimate interest
Purpose
Security (IP, audit)
Legal basis
Legitimate interest
| Purpose | Legal basis |
|---|---|
| Account, auth, sessions | Contract performance |
| Payments and billing | Contract / legal obligation |
| Geolocation and push | Consent |
| CPO pre-registration | Pre-contract / legitimate interest |
| Security (IP, audit) | Legitimate interest |
8. Sharing
We share data only with necessary sub-processors:
- Mercado Pago — tokenized payments and marketplace
- Google Maps — map display
- Google FCM / Apple APNs — push notifications
- Resend — CPO operational email
- AWS S3 — tenant logos (no PII)
9. International transfer
Some sub-processors may process data outside Brazil. We prefer national infrastructure (Magalu Cloud) in production when applicable.
10. Retention
Category
Active account
Period
While contractual relationship lasts
Category
Invoices and sessions
Period
Up to 5 years (tax)
Category
Audit log
Period
Minimum 1 year
Category
Rejected CPO pre-registration
Period
6 months or anonymization
Category
Application logs
Period
90 days, no PII
| Category | Period |
|---|---|
| Active account | While contractual relationship lasts |
| Invoices and sessions | Up to 5 years (tax) |
| Audit log | Minimum 1 year |
| Rejected CPO pre-registration | 6 months or anonymization |
| Application logs | 90 days, no PII |
11. Data subject rights
Under LGPD Art. 18, you may request:
- Confirmation and access
- Correction of incomplete or outdated data
- Anonymization, blocking, or deletion
- Portability (post-MVP backlog)
- Consent withdrawal
- Information on sharing
12. Account deletion
Drivers may request deletion via app (Profile) or support. Flow: soft delete, anonymize CPF/phone/address, remove push tokens, retain anonymized fiscal records as required by law.
13. Security
- TLS in transit
- CPF encrypted at rest (AES-256)
- JWT without PII
- Tokenized payments — no PAN/CVV
- RBAC and audit log for sensitive actions
14. Children and teens
Service for users 18+. We do not intentionally collect data from minors.
15. Changes
We may update this Policy. Material changes will be communicated in-app or by email. New version updates policyVersion; re-consent when applicable.
16. Contact and ANPD
Privacy: [email protected] · DPO: [email protected] · Support: [email protected] · ANPD: www.gov.br/anpd