Privacy Policy

Version 1.0 — effective September 22, 2026 · Versão em português (prevalece)

This Privacy Policy explains how VGS Comm processes your personal data, in accordance with Law 13.709/2018 (LGPD). It is part of the Terms of Use.

1. Who is the controller

The controller of your data is [RAZÃO SOCIAL], CNPJ [CNPJ], with its registered office at [ENDEREÇO COMPLETO]. Data Protection Officer (DPO): [E-MAIL DO ENCARREGADO]. General contact: [E-MAIL DE CONTATO].

2. Data we collect

• Registration and profile: username, e-mail, password (stored only as a cryptographic hash), avatar, "now playing" status, city/state and social login identifiers (GitHub/Google), when you use those providers.
• Content and activity: game and console shelf, ratings, posts and photos, captions, hashtags, mentions, comments, likes, chat messages, events and RSVPs, wishlist, offers, auctions, bids and negotiation history.
• Technical and security data: IP address, access date and time, session identifiers, application logs, anti-bot verification data, and moderation and report records.
• Aggregated analytics: when enabled, we use our own Umami instance, without cookies, honoring "Do Not Track" and never sending usernames, e-mails, captions or search terms.
• Terms acceptance: the accepted version and the date/time of acceptance at registration.

We do not collect sensitive data (such as racial or ethnic origin, religious belief, health or biometric data) or data from children and adolescents for trading purposes.

3. How we use your data and legal bases

• Performance of a contract: to create and maintain your account, and to operate the shelf, feed, chat, events, auctions, offers and trades, enabling communication between Users.
• Legitimate interest: security, fraud and abuse prevention, moderation, service improvement and aggregated usage metrics.
• Compliance with legal or regulatory obligations: record keeping, responding to authorities and defense in proceedings.
• Consent: when required for a specific purpose, which may be withdrawn at any time.
• Regular exercise of rights: collection, prevention and defense in disputes.

4. Cookies and local storage

• Session cookie (vgs_session): essential to keep you signed in; expires in up to 30 days in production.
• Local storage: theme (light/dark) and language preference, stored in your browser.
• Analytics: when enabled, Umami is configured without cookies and honors the browser's "Do Not Track" signal.

You can clear cookies and local storage in your browser settings; doing so may end your session.

5. Sharing with third parties

We do not sell your personal data. We share only what is necessary with operators that help us run the Platform:

• Infrastructure and CDN (hosting, proxy and anti-bot protection): IP and HTTP metadata;
• Media storage (S3/R2): uploaded images;
• Transactional e-mail (Resend): e-mail and username, to send the confirmation link and service notices;
• Social login providers (GitHub/Google): identifier, name and avatar, when you choose to sign in with them;
• Managed database and cache: transactional data required for operations;
• Public authorities: upon legal order or to report evidence of a crime, as required by law.

If the Platform starts offering payment intermediation, the payment providers will be listed in this Policy before you engage them.

6. International transfers

Some operators may process data outside Brazil. In such cases, we adopt contractual and technical safeguards compatible with the LGPD to protect your data.

7. Retention and deletion

• Account and profile: while the account exists. Upon a deletion request, access is blocked immediately and personal data is anonymized within 30 days.
• Chat messages: 1 year, anonymized upon account deletion (the other participant's history is preserved).
• Notifications: 90 days.
• Auctions, bids and negotiation history: 2 years, for auditing and fraud prevention, kept anonymized after deletion.
• Reports and audit records: 2 to 5 years.
• Application logs: up to 90 days.
• E-mail verification tokens: 24 hours (only the hash is stored).

Longer periods may apply where there is a legal obligation, an authority order or the need for defense in proceedings.

8. Your rights

Under art. 18 of the LGPD, you may request:

• confirmation of processing and access to your data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data;
• portability of your data, in a structured format;
• deletion of data processed with consent;
• information about sharing;
• withdrawal of consent.

To exercise your rights, write to [E-MAIL DO ENCARREGADO]. You may also petition the Brazilian Data Protection Authority (ANPD).

9. Security

We adopt technical and organizational measures such as password encryption, encrypted sessions, administrative access control (with two-factor verification), HTTPS connections, backups and audit logging. No system is infallible; if you find a vulnerability, please report it to [E-MAIL DE CONTATO].

10. Children and adolescents

The Platform is not intended for trading by persons under 18. Minors may browse only under the supervision of a legal guardian. If we identify data from minors collected improperly, it will be deleted.

11. Changes to this Policy

We may update this Policy to reflect legal, technical or product changes. The current version, with its date, will always be on this page; material changes will be communicated through the Platform's channels.

12. Contact

Questions about privacy and data protection: [E-MAIL DO ENCARREGADO] · [E-MAIL DE CONTATO].

This Policy takes effect on the date shown at the top and supersedes previous versions.