Skip to content
PontoFato
EN

Privacy

What PontoFato keeps about the people who use it, for how long, which infrastructure it shares, and how to request access or deletion.

Who processes the data

PontoFato is run by the same house as the other products listed in the footer. Requests about personal data go to contato@pontofato.com and are answered by e-mail.

What this product keeps

  • Postal code, coordinate and neighbourhood lookups are not recorded: the answer goes out and there is no history of what you searched, with or without an account.
  • Daily usage counters per route, only the number, without identifying who used it.
  • Pay-per-call payments (x402) settle on the Base network, which is public by design; here we keep the transaction reference and the amount for reconciliation and accounting.
  • Prepaid credit: the token is stored only as a SHA-256 hash with its balance and movements; whoever holds the token holds the credit, and it cannot be recovered by e-mail.
  • Contact: your message, the e-mail you give and the reply go through Amazon SES to the product mailbox.

For how long

  • Nothing per lookup; only the day's counter.
  • Per-network rate-limit counters (guest, contact, sign-in code) expire on their own within minutes or hours.
  • Payment and credit records stay as long as accounting requires.

Infrastructure and third parties

  • Servers we operate run the service and store your data. Cloudflare provides DNS only.
  • Amazon Web Services (SES) sends transactional e-mail on behalf of the product.
  • Interface libraries (Bootstrap) are served from the product's own domain, not from a third-party CDN.
  • Google Analytics 4 measures pages and events only after the first interaction (tap, click or key), with ad storage denied and no sale or sharing for advertising.
  • PayAI (x402 facilitator) verifies and settles payments on the Base network; the paying wallet is yours, and its address is public on-chain.
  • The sources are public — the 2022 Census CNEFE (IBGE) and the open CNPJ data (Receita Federal) — and they are loaded on our own infrastructure.

Cookies and browser storage

  • Screen preferences (theme, filters) stay in the browser's local storage and never leave it.
  • There is no advertising cookie and no cross-site tracking.

IP address

To limit abuse, the IP address goes into a hash with a secret salt. The approximate country and city come from a geolocation database (MaxMind GeoLite2) looked up on our server, without sending the address to anyone. The raw IP is not stored, except where this page says otherwise.

Your rights

You can request access, correction or deletion of what exists about you by writing to contato@pontofato.com. We answer within the terms of the Brazilian data protection law (LGPD) and, where it applies, the GDPR. Data from public sources (official registries) stays at the source; only the copy here is removed.

Last updated: September 21, 2026.