Privacy Policy

The penAtlas operator acts as the controller of personal data processed to operate the catalog, the editorial area, accounts, and community features. This policy applies to visitors, collectors, and administrators who use the site.

External services accessed via ad links, sharing, or marketplaces have their own controllers and policies. penAtlas does not control the processing carried out in these environments.

When creating and maintaining an account, we process name, username, email, password stored securely via hash, profile photo, temporary codes, pending registration changes, and information necessary for authenticated sessions.

When posting an ad, we process related model, description, price, condition, characteristics, photos, external link, and, when provided, phone and WhatsApp. The account email may be displayed in the ad only when the collector themselves enables this option.

We also process questions, answers, favorites, followed models, reports, moderation reasons, and other interactions sent by the user. The general contact form does not yet send data to the backend; while disabled, the content typed into it is not received or stored by penAtlas.

The infrastructure may generate technical records necessary for availability and security, such as date and time, IP address, accessed route, browser agent, server responses, and error events. The extent of these records depends on the hosting and production configuration.

The site uses browser local storage to maintain authentication tokens, cookie preference, state of administrative filters, return after login, and model selection for comparison. These data remain on the device until they expire, are replaced, removed by the site, or deleted by the user.

We process data to register and authenticate users, protect accounts, post ads and profiles, allow favorites, subscriptions, questions, answers, and reports, send operational communications, moderate content, prevent abuse, investigate failures, and maintain service security.

As per the operation, the processing may rely on the execution of services requested by the user, procedures related to contracting, compliance with legal or regulatory obligations, exercise of regular rights, protection against fraud, legitimate interest assessed under LGPD, or consent, when this is the appropriate basis.

When the processing depends on consent, refusal or revocation may only prevent the related functionality. Revocation does not invalidate operations carried out lawfully before the request.

Name, username, profile picture, active ads and allowed questions and answers can be displayed publicly. Photos and descriptions published can also contain information inserted by the user themselves.

Email, phone and WhatsApp only appear in the ad according to the options selected by the advertiser. When enabling contact, consider that it may be viewed, copied and shared by third parties outside the control of penAtlas.

Articles, models and collections are editorial content and, in general, do not require visitor identification. Public search and pagination use the provided terms to display results and do not, by themselves, create a personal profile of the visitor.

penAtlas does not sell personal data. Information may be processed by necessary providers for hosting, database, image storage, email sending, queues, security, monitoring and technical support, always according to the purpose of the service and applicable safeguards.

Data may also be provided to authorities or third parties when there is a legal obligation, valid order, need to protect rights or investigation of fraud and abuse. If providers process data outside of Brazil, the applicable international transfer mechanisms provided by legislation will be adopted.

When opening a marketplace, WhatsApp, social network or other external link, the user begins to interact directly with that service. penAtlas does not process payments, deliveries or transactions made outside the platform.

The data is kept while the account is active and for the time necessary for the stated purposes, security, compliance with obligations and the regular exercise of rights. Specific periods may vary according to the data category and the final production configuration.

Content subject to soft delete, such as models, articles, questions and answers, may remain in restricted access for restoration, auditing and moderation. Records necessary for the prevention of abuse or defense of rights may also be preserved for the applicable period.

When confirming account deletion, name, username and email are anonymized; credentials and codes are revoked; photo, favorites and subscriptions are removed; and ads are disabled with removal of photos, links and contacts. Questions, answers and reports may remain associated with the anonymous identity "Deleted Account" to preserve conversations, moderation, prevention of fraud and the regular exercise of rights.

We adopt technical and administrative measures proportional to the service, including hashed passwords, protected tokens, two-factor verification, input validation, parameterized queries, access control, moderation and session revocation. No service connected to the internet can guarantee absolute security.

Confirmed incidents involving personal data will be assessed according to the risk. When required by LGPD and ANPD regulation, the controller will carry out the necessary communications to the authority and affected data subjects.

The user must keep password and codes confidential, avoid sharing tokens, distrust links and report any suspicion of unauthorized access.

The privacy notice records the choice between "Only essentials" and "Accept cookies" in local storage. Currently, penAtlas uses essential resources for session, security and preferences and does not declare the activation of behavioral advertising.

The user can delete cookies and local storage in browser settings. This may end sessions, clear comparisons and preferences and require new authentication.

Under LGPD, the data subject may request, as applicable, confirmation of processing, access, correction, anonymization, blocking or deletion of unnecessary or irregular data, portability, information about sharing, opposition, review of automated decisions and revocation of consent.

The identity of the requester may be verified to prevent data from being delivered or altered by third parties. Some requests may be limited when there is another legal basis for retention, applicable obligation, protection against fraud or need for the regular exercise of rights.

The data subject may also file a petition with the National Data Protection Authority, following official procedures, especially after trying to exercise the right directly with the controller.

penAtlas is not directed at children. Accounts and ads assume the capacity to accept Terms of Use and participate in relationships related to collectible items. If inappropriate handling of children's or adolescents' data is identified, measures compatible with legislation and the best interest of the data subject will be adopted.

This policy may be updated to reflect changes in the product, providers, data processing practices or legislation. The current version and the date of the last update will remain available on this page.