Privacy Policy

1. Who the controller is

La Lista is operated by DECKE LTDA, registered under CNPJ 53.518.447/0001-13, with offices at Avenida Paulista, 1106 — Floor 16, Suite 1 — Bela Vista, São Paulo/SP — ZIP 01310-914, Brazil.

Data Protection Officer: privacy@lalista.club.

2. What we collect

We collect only what is needed to build and refine your style profile:

• Email — sign-up; code-based authentication and transactional communication (contract performance).
• Display name and username — identification within the product and between people who follow each other (contract performance).
• Birth date and gender — optional; personalization of recommendations (consent).
• Password — optional; alternative sign-in method (contract performance).
• Quiz answers — style profile calculation (contract performance).
• Style degrees derived from photos — profile refinement (consent).
• Like and dismiss reactions — continuous profile evolution (legitimate interest).
• Purchase clicks — metrics and partnership compensation (legitimate interest).
• Instagram identifier and handle — optional connection; verified identity and photo import (consent).
• Instagram token — optional connection; access to your own media (consent). Stored encrypted and never displayed.
• Marketing opt-in — sending news (consent).

3. Your photos are never stored

This is the most important point of this policy. The photos you upload and the media imported from Instagram are processed in memory, converted into seven numeric style degrees, and discarded within the same request.

There is no copy on disk, in a database, or in a backup. What persists is only the derived vector — numbers, not images.

4. Who we share with, and international transfer

We use processors (subprocessors) that handle data on our behalf. All are located in the United States:

• Anthropic — AI style classification; receives images in transit (not retained by us) and descriptive text about garments.
• Amazon Web Services — hosting and email delivery; receives your address to deliver the product's messages.
• Amplitude — product analytics; receives identifier, email, and usage events.
• Meta/Instagram — optional connection; authentication and reading of your own media.

International data transfer is supported by article 33 of the LGPD, through contractual clauses and the guarantees offered by each processor.

5. Your rights and how to exercise them

The LGPD (article 18) guarantees the rights below, and La Lista fulfills them technically:

• Confirmation and access — complete JSON export, available at My profile → Download my data.
• Correction — direct editing of your data in the profile.
• Erasure — account deletion at My profile → Delete my account, or by email.
• Portability — the same JSON export, in a machine-readable format.
• Withdrawal of consent — disconnect Instagram, uncheck the marketing opt-in, or retake your profile discarding previously uploaded photos.
• Information about sharing — the processor list in the previous section.

6. Purchase clicks are anonymized, not erased

When you delete your account, purchase click records are not erased: the link to you is removed and the statistical row remains, without any personal identifier.

We state this explicitly because it differs from erasure — the data stops being personal, but continues to exist as an aggregate number.

7. How long we keep data

• Account data — for as long as the account exists.
• After deletion — only an audit record with the hash of your email and the date, to evidence that the request was fulfilled.
• Verification codes — 10 minutes.
• Instagram token — until you disconnect or delete the account; encrypted at rest.

8. Security

Access and Instagram tokens are stored encrypted and are never displayed in the interface. Share links use high-entropy tokens and can be revoked at any time. Your style report is never shared — only the closet.

9. Requests from public authorities

Public authorities sometimes ask for data about people. We do not hand anything over simply because it was asked for.

We require a valid legal instrument. An informal request — by email, telephone or a letter with no legal basis — is refused, and we ask for it to be made through the proper channel.

We review every request and challenge those that are excessive, vague or disproportionate. Where a request can be partly met, we disclose only the part strictly required.

We tell you when a request reaches your data, unless the law or a court order forbids us from telling you. Where the prohibition is temporary, we tell you as soon as it lifts.

We keep an internal record of every request received: what was asked for, what was disclosed, the legal reasoning behind the decision and who took it. The record exists so that this conduct can be audited.

Requests should be sent to privacy@lalista.club.

10. Contact

To exercise any right or ask questions about this policy, write to privacy@lalista.club. We respond within 15 days.

11. Changes

If this policy changes materially, we will notify you by email or within the product before the change takes effect.