Privacy policy

This is a translation. If it differs from the Portuguese version, the Portuguese version prevails. Read the original in Portuguese.

Who is responsible

The controller is Ricardo Carapeto, a private individual who runs Dobeo (dobeo.com) in a personal capacity. For any request about your data, write to privacidade@dobeo.com; the controller answers personally.

What we process

• On the website, for everyone: a random identifier kept in a first-party cookie (dobeo_anon) and usage events, such as pages viewed, links checked and clicks to the store. On the first page of each visit, also where it came from: the referring site's domain (never the full address) and the link's campaign parameters, such as utm_source.
• On the website, only if you accept Google Analytics: the pages you view (the address without parameters, except campaign ones such as utm_source), the site you came from, the time on the page, scrolling, clicks on links to other sites, downloads, the start and submission of forms (not what you type in them), the type of device, system and browser, the screen resolution, the language and the approximate location (country, state and city), which Google infers from the IP address (according to Google, the IP address is not logged or stored). A random identifier is kept in the cookies _ga and _ga_0CH19WJVSD. Admin pages are never measured.
• If you save a product: a session identifier (cookie dobeo_sid), the products you follow, the target price you choose and, if you turn notifications on, the technical notification address your browser generates.
• If you sign in with your email: the email, when you confirmed it and when you last signed in. The 6-digit code we send is kept only as a hash and deleted within 24 hours. To prevent abuse, the code request goes through a Cloudflare anti-robot check (Turnstile), which looks at browser signals and the IP address at the moment of the request.
• If you accept the weekly summary: when you accepted and the version of the text you accepted.
• If you use Telegram: the chat number and the username Telegram sends us, and the links you send to the bot.
• Language: if you create an alert on the English or Spanish version, or your Telegram is set to one of those languages, we keep that preference to write your alerts in your language. The site's language suggestion remembers that you closed it only in your browser, without sending anything.
• In the extension, to show the verdict: when you open a product page in a supported store — or, in any other store, when you click the Dobeo icon —, the extension sends the address of that product (without tracking parameters) and a random installation code. We use it only to answer; we don't keep a list of the products seen per installation — we only count how many times each product was checked.
• In the extension, only if you accept: the price, availability and seller of the open product page, together with the installation code, which we keep only as a hash. Outside the supported stores, the extension only reads the page where you clicked the Dobeo icon, and only at that moment. It does not read other pages or your browsing history.

We don't keep IP addresses in the database, we don't use advertising tools and we never ask for your name, CPF (Brazilian taxpayer number), address or a password. The only external tracker is Google Analytics, and only if you accept it. We ask for your email only if you want alerts by email or your list on another device.

For what and on what legal basis

• Keeping your list, letting you sign in with your email and sending the alerts you created: performance of the service you asked for (LGPD, Brazil's General Data Protection Law, art. 7, V).
• Sending the weekly summary and alerts for upcoming seasons: your consent (art. 7, I), given in a separate box, which you withdraw at any time in My list or through the link in each email.
• Measuring usage in aggregate and protecting the service against abuse: legitimate interest (art. 7, IX).
• Measuring visits with Google Analytics: your consent (art. 7, I), given in the cookie notice, which you withdraw at any time through the “Cookies” link at the bottom of every page.
• Receiving the prices read by the extension: your consent (art. 7, I), which you can withdraw at any time in the extension's options.

Who we share it with

We don't sell or hand over personal data. The data is kept on a server in Germany, in the European Union. Emails (the sign-in code and the alerts) are sent by Resend, Inc., which processes your address and the content of the messages in the United States; this transfer is necessary to provide the service you asked for (LGPD, art. 33, IX). Cloudflare runs the anti-robot check of the code request. Browser notifications go through the browser's own push service (Google, Mozilla or Apple), and Telegram messages through Telegram. If you accept Google Analytics, Google LLC processes the browsing data described above, as a processor and only to give us statistics, in the United States and other countries. This international transfer is based on your specific consent, given in the cookie notice (LGPD, art. 33, VIII). We turned off sharing this data with Google for other purposes, Google signals and ads personalization. The data received from the extension is not sold or transferred to anyone, not even in aggregate.

For how long

• Your list, your account and alert channels: until you remove them or delete your data. If you have no active alert and don't use Dobeo for 12 months, we delete everything; if you accepted the weekly summary, after 24 months.
• Sign-in codes: 24 hours. Ended sessions: 30 days.
• Usage events: up to 13 months.
• Google Analytics: 14 months at Google; the _ga cookies last up to 13 months. Your choice in the cookie notice is kept in this browser for 12 months; then we ask again.
• Price readings from stores are not personal data and are part of the products' public history.

Your rights

You can ask for access, correction, portability and deletion of your data, and withdraw your consent (LGPD, art. 18). To delete everything right away, use the “Delete all my data” button in My list. For the other requests, write to privacidade@dobeo.com; we answer within 15 days.

Cookies

• dobeo_anon: anonymous identifier for usage metrics (1 year).
• dobeo_sid: keeps your session in this browser (up to 400 days, renewed while you use it), created only when you save a product or sign in.
• dobeo_login: exists only while a sign-in code is pending (1 hour), so the code works only in the browser that asked for it.
• _ga and _ga_0CH19WJVSD: Google Analytics cookies, created only if you accept, to recognize the browser between visits (up to 13 months). If you decline or withdraw your consent, we delete them.

dobeo_anon, dobeo_sid and dobeo_login are first-party cookies, out of reach of scripts, and are not used for advertising. Cloudflare's anti-robot check runs in a Cloudflare frame, only when you ask for a code.

The site also keeps, in the browser's session storage, a flag with no personal data (dobeo_landed) that tells whether a page is the first of a visit. It is deleted when you close the tab. In the browser's local storage, the site keeps your choice in the cookie notice (dobeo:analytics) and its date, with no personal data. To change your mind, use the “Cookies” link at the bottom of the page.

Changes

If this policy changes, the date at the top changes with it. Important changes will be announced on the site.