Privacy Policy

Hexadelic is the controller of the personal data processed to operate Wachee — registration, orders, payment and platform operation.

Our channel for data protection matters, including contact with the data protection officer, is [email protected].

Registration and contact: name and e-mail; password stored hashed, never in plain text.

Order and payment: chosen plan, extras, amount, status and transaction identifiers. Full card data is handled directly by the payment processor, not by us.

Experience content: photos, text, dates, names, dedications and music preferences you upload to build the gift.

Technical data: IP address, access logs, date and time, browser type and error events, needed for operation and security.

Preferences: language, theme and the draft saved in your browser.

Creating your account, building, publishing and hosting the experience, processing payment and providing support — performance of a contract (art. 7, V).

Issuing tax documents, complying with authorities and retaining access logs under the Brazilian Internet Civil Framework — compliance with a legal or regulatory obligation (art. 7, II).

Preventing fraud, protecting the platform and improving the product from aggregated metrics — legitimate interest (art. 7, IX), always assessed against your rights.

Sending news and marketing communications — consent (art. 7, I), which you may withdraw at any time without affecting the service you purchased.

When you build an experience about someone else, you decide what goes in it. In that relationship you are the controller and Hexadelic is the processor: we handle that content only under your instructions and as needed to deliver the service.

It is therefore up to you to obtain the necessary permissions from the people portrayed or mentioned.

Wachee is not intended for people under 18 as customers. When an experience includes a child's or adolescent's data — a family photo, for instance — processing follows the minor's best interest (LGPD, art. 14) and depends on specific consent from at least one parent or legal guardian, which you must obtain.

If we find minors' data processed without such a basis, we may remove the content.

We do not request sensitive data (racial or ethnic origin, religious belief, political opinion, union membership, health, sex life, genetic or biometric data).

If you choose to include such information in the gift content, you do so under your responsibility and with the specific, highlighted consent required by article 11 of the LGPD.

So you do not lose your work, the onboarding and editor draft is saved locally on your device (localStorage). That content does not leave your browser until you submit the order, and remains until you clear it or complete the purchase.

Payments: we share the data needed with the payment processor to complete the charge and meet tax obligations.

Infrastructure: we use hosting, file storage, database and e-mail providers, which process data as processors, under contract and with no autonomous use.

Music search: queries use public third-party services to return results and previews.

Authorities: we may share data under a court order or legal request.

We do not sell personal data and do not share it for third-party advertising.

Part of our infrastructure may be hosted outside Brazil. In those cases, transfers occur under article 33 of the LGPD, with contractual clauses and safeguards equivalent to those of Brazilian law.

Account data and experience content: while the page is active and the account exists.

Order and payment data: for the period required by tax law and for the regular exercise of rights.

Application access logs: for 6 (six) months, under article 15 of the Internet Civil Framework.

Once the period or purpose ends, data is deleted or anonymized (LGPD, arts. 15 and 16), except for backups kept for the technically necessary time.

Confirm that processing exists and access your data.

Correct incomplete, inaccurate or outdated data.

Request anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully.

Request portability to another provider and deletion of data processed on the basis of consent.

Obtain information about whom we share your data with and about the option not to consent, including the consequences of refusal.

Withdraw consent and object to processing based on legitimate interest.

Write to [email protected] describing your request. We may ask for additional information to confirm your identity — precisely so we do not hand data to the wrong person.

We reply within a reasonable time and, where the law requires, immediately or within 15 (fifteen) days.

We adopt technical and administrative measures to protect data (LGPD, art. 46): encrypted traffic, hashed passwords, access control, signed and expiring media links, and event logging.

No system is immune to incidents. If a security incident poses relevant risk to data subjects, we will notify the ANPD and the affected subjects, under article 48 of the LGPD.

We use cookies and local storage strictly necessary for operation — session, language, theme and draft.

We do not use third-party advertising cookies. You can clear this data in your browser settings, bearing in mind that some features may stop working.

If you believe your rights were not met, you may file a complaint with the Brazilian Data Protection Authority (ANPD), without prejudice to contacting us first so we can resolve it directly.

This Policy may be updated to reflect changes in the service or in the law. The update date at the top of this page indicates the version in force, and relevant changes will be announced.

Privacy and data protection matters: [email protected] or the Contact page on the site.