Privacy policy

Updated on

This policy explains, in plain language, what data the Orafolio website (orafolio.com) collects, why we collect it, who we share it with, and what you can do about it. It applies to every page of the site, in all six languages, and to the purchase of the ebooks sold here.

Who is responsible for your data

OraFolio is the site and the brand operated by the company identified below, which is the controller of the personal data processed here:

  • Company name: Pagar Fácil Ltda
  • Company registration number (CNPJ): 67.549.049/0001-79
  • Address: Avenida Paulista, 1636, Pavmto 11 Conj 05, Bela Vista, São Paulo/SP, CEP 01310-200
  • Contact email:
  • Email for privacy matters:

We are a Brazilian company, so our processing follows Brazil's General Data Protection Law (Law 13.709/2018, the LGPD), the Consumer Protection Code (Law 8.078/1990) and the Brazilian Internet Civil Rights Framework (Law 12.965/2014). If you live in the European Economic Area, the United Kingdom or Switzerland, you also keep the non-waivable rights your local law gives you, including your rights under the GDPR and the UK GDPR. Nothing in this policy takes those away.

The principle we follow

We collect the minimum we need. The blog is read with no sign-up, no login and no tracking cookie. Personal data only appears when you decide to buy an ebook, write to our email address, or review a product you bought.

Data we collect

When you are only reading the blog

Our audience measurement is built in-house and designed not to identify anyone. When you open a page we record, in aggregated daily counters:

  • The approximate country, region and city that Cloudflare's edge reports from your connection. We do not store your IP address.
  • The path of the page you visited and the page you arrived on.
  • Where the visit came from: direct, a search engine, a social network, another website, or a campaign tagged with UTM parameters. We keep only the source domain, never the full address.
  • The search term, when the search engine itself sends it in the referrer. Google and most engines do not send it.
  • Your browser's preferred language (the first item of the Accept-Language header).
  • The browser, the operating system and the device class (desktop, phone or tablet), read from Client Hints where available and from the user agent otherwise.
  • The hour of the day of the visit.

To count unique visitors and sessions without using a cookie, we generate a scrambled code: we run the SHA-256 function over the combination of a random daily secret, your IP address, your user agent and the site identifier. The IP address and the user agent go into that calculation and die there — they are not written anywhere, not even to a log. The daily secret is drawn by the database itself, changes at midnight and is deleted within seven days, which makes the code irreversible and stops it from following you from one day to the next. In practice: if you come back tomorrow you are counted as a new visitor, and we prefer that imprecision to creating a permanent identifier.

To measure time on page, a small piece of code at the end of the page adds up how long the tab stayed visible and sends that number, and nothing else, when you leave. It uses no cookie and no storage on your device.

When you buy an ebook

On these English pages, and on every page outside Portuguese, payment is by credit card only, in a single instalment, and the form collects only your name, your email address and your card details (number, name on card, expiry date and security code). We do not ask for an identification document, a postcode or a street address.

On the Brazilian checkout (the pages in Portuguese) the form also collects a CPF, the Brazilian taxpayer number, because the payment provider requires it to issue the charge, and it offers Pix and bank slip (boleto) alongside the card. Those two methods exist only there: both are Brazilian payment rails and both require a Brazilian document, so they cannot be offered to you here.

Our payment platform passes card details straight to the payment institution that issues the charge — Asaas or Mercado Pago — and they are never written to our database, to our audit trail or to any log. When the processor returns them to us, we keep only the last four digits and the card brand, so that you can recognise the purchase.

We also record the order itself: product, amount, currency, payment method, payment status, date and the language the purchase was made in.

When you write to us

If you write to our email address, we keep the message, the sender, the date and our reply, so that we can follow up on your case and show what was agreed.

When you review a product

Only buyers can review, and the review is written from the page of the order itself. We keep the rating, the text and the buyer's first name. We publish the first name only — never the surname, the email address or any other detail. Every review is moderated before it appears on the site.

  • Processing the purchase, charging you and delivering the ebook — performance of the contract (LGPD, art. 7, V). Without this data there is no way to issue the charge or release the file.
  • Sending you emails about your order (charge created, payment confirmed, download link) — performance of the contract.
  • Issuing tax documents and keeping accounting and transaction records — compliance with legal and regulatory obligations (LGPD, art. 7, II).
  • Keeping application access records in the form required by the Brazilian Internet Civil Rights Framework — compliance with a legal obligation.
  • Helping you by email — performance of the contract, or legitimate interest in providing support (LGPD, art. 7, IX).
  • Measuring audience in an aggregated, non-identifying way, so we know which content is useful — legitimate interest. Because there is no persistent identifier and no data that leads back to you, the impact on your privacy is minimal.
  • Publishing buyer reviews — performance of the contract and legitimate interest in informing other readers, always with the text you wrote yourself and subject to moderation.
  • Sending a single abandoned cart reminder, when you started a purchase and left your email address — legitimate interest in direct marketing, with an unsubscribe link in every message.
  • Showing advertising, when advertising is switched on — legitimate interest for non-personalised ads, and consent for personalised ads in the regions where consent is required.
  • Preventing fraud and abuse at checkout and on downloads — legitimate interest and compliance with legal obligations.

You can object to any processing based on legitimate interest by writing to the privacy address given in this policy.

Who we share it with

We do not sell personal data. Our payment platform, PagarFácil, is not a third party: it belongs to the same company behind this site. The parties that receive data from outside are the payment institutions that issue and settle the charge. We share it only with the parties the site needs in order to work, and only what they need:

  • Cloudflare, Inc. — hosting, content delivery network, database and file storage. Every page passes through it.
  • Asaas (Asaas Gestão Financeira Instituições de Pagamento S.A.) — the Brazilian payment institution that issues and settles the charges: credit card, plus Pix and bank slip on the Portuguese pages. It receives your name, email address, CPF where applicable, and your card details.
  • Mercado Pago — payment processing, when that is the active gateway. It receives the same data.
  • Cloudflare Email Service — sending and receiving the site's transactional email.
  • Google (AdSense) — when advertising is switched on, as described in the advertising section below.
  • Public authorities, where there is a court order or a legal obligation.

Each of these providers processes the data for the purpose we contracted, under our instructions or, in the case of the payment providers, also as controllers in their own right for the information they need in order to meet financial sector regulatory obligations.

International transfers

Our infrastructure and advertising providers run servers outside Brazil, including in the United States and in the European Union, so your data may be processed abroad. The transfer is made under art. 33 of the LGPD — necessary for the performance of the contract and supported by the contractual safeguards these providers offer, including standard data protection clauses.

How long we keep it

  • Order, payment and invoice data — for the period required by tax and civil law, counted from the end of the relationship. After that it is deleted or anonymised.
  • Application access records — for the period set by the Brazilian Internet Civil Rights Framework.
  • Emails exchanged with support — for as long as they are useful to your case and to the defence of rights.
  • The daily secret used in audience measurement — seven days at most, then deleted.
  • Audience statistics — kept indefinitely, because they are aggregated counters that identify nobody.
  • Published reviews — while the product is on sale, or until you ask us to remove yours.

Cookies and similar technologies

The site uses no analytics cookie, no cross-site tracking cookie and no social network cookie.

When you open the payment page we set a cookie called of_cc. It holds only the random identifier of your purchase session, lasts 24 hours and is httpOnly, meaning the page's JavaScript cannot read it. It contains no name, no email address and nothing that identifies you directly. Its job is to avoid opening a new purchase session on every reload and to link the completed purchase to the session that started it.

Payment provider cookies

When you are taken to a page belonging to the payment institution, or when components of theirs load, your browser may receive cookies from that provider. Those cookies are governed by the processor's own privacy policy, not by this one.

Advertising cookies

See the next section.

How to control cookies

Every browser lets you block or delete cookies in its privacy settings. Blocking the checkout cookie does not stop you from buying, but it may make the site treat each load of the payment page as a new session.

Advertising

The site may show ads served by Google AdSense, from Google Ireland Limited and Google LLC. When ads are switched on:

  • Google, as a third-party vendor, uses cookies (including cookies on the DoubleClick domain) and similar identifiers to serve and measure ads.
  • These cookies allow Google and its partners to serve ads based on your visits to this and other sites on the internet.
  • You can opt out of personalised advertising from Google in your ad settings at adssettings.google.com.
  • You can opt out of personalised advertising from other participating companies at www.aboutads.info/choices and, in Europe, at www.youronlinechoices.eu.
  • Google's use of cookies and data in advertising is described in its advertising technologies policy at policies.google.com/technologies/ads.
  • Turning personalisation off does not remove the ads: they become non-personalised, chosen by the content of the page and your approximate location.

For visitors in the European Economic Area, the United Kingdom and Switzerland, personalised ads and any reading or writing of information on your device happen only with your consent, collected through a consent management platform (CMP) certified under the IAB's TCF, with the option to refuse and to change your mind later. While ads are not switched on for this site, no advertising cookie is written at all.

We do not run customer-list remarketing and we do not send advertisers your email address or your purchase data.

Your rights

The LGPD (art. 18) guarantees that you can ask, at any time, for:

  • Confirmation that we process data about you, and access to it.
  • Correction of incomplete, inaccurate or outdated data.
  • Anonymisation, blocking or deletion of data that is unnecessary, excessive or processed outside the law.
  • Portability to another provider.
  • Deletion of data processed on the basis of your consent.
  • Information about who we share your data with.
  • Information about your option not to consent, and about the consequences of refusing.
  • Withdrawal of consent.
  • Objection to processing based on legitimate interest.
  • Review of automated decisions, where any exist.

If you are in the European Economic Area, the United Kingdom or Switzerland, the GDPR, the UK GDPR and your national law give you equivalent rights — access, rectification, erasure, restriction, portability and objection — and those rights cannot be signed away by this policy. You also have the right to lodge a complaint with the data protection authority of your country.

To exercise any of them, write to our data protection officer:

  • Data protection officer (DPO):
  • General contact:

We normally reply within two working days and, in any case, within the legal deadlines. We may ask for extra information to confirm that the request really comes from you — for example, that the message is sent from the email address used in the purchase.

You may also complain to the Brazilian data protection authority, the ANPD.

Security

The site runs entirely over HTTPS, with HSTS. The files we sell live in private storage and are released only through an address carrying a random code tied to a paid order. Card data never touches our database. Access to the admin panel is protected by a password with key derivation (PBKDF2), sessions that expire and protection against forged requests. No system is infallible: if a security incident occurs with relevant risk, we will notify the affected people and the ANPD as required by art. 48 of the LGPD, and any equivalent notification duty under the law of your country of residence.

Children and teenagers

The site is not intended for anyone under 18 and we do not knowingly collect data from children or teenagers. Purchases must be made by adults. If you are a parent or guardian and believe a minor has sent us data, write to and we will delete it.

Automated decisions

We make no automated decisions that produce legal effects on you. Approving or declining a payment is decided by the payment institution and by the bank that issued your card, according to their own criteria.

Changes to this policy

We may update this policy to reflect changes to the site, to our providers or to the law. The version in force is always the one published on this page, with the update date below. Significant changes will be flagged on the site itself.

Contact and data protection officer

Questions, requests and complaints about privacy:

  • Data protection officer (DPO):
  • General contact:
  • Company name: Pagar Fácil Ltda
  • Company registration number (CNPJ): 67.549.049/0001-79
  • Address: Avenida Paulista, 1636, Pavmto 11 Conj 05, Bela Vista, São Paulo/SP, CEP 01310-200

Last updated: September 6, 2026.