Privacy Policy

This Privacy Policy explains how personal data is processed when you visit the official Partner Platform Website at https://stadami.club/ (Portuguese (Brazil)) or https://stadami.club/en (English), submit an application, use the dashboard, receive a Promo Code, participate in a Campaign, request support or a payout, or when a Qualifying Action is verified. It forms part of the Terms of Use. Promoted applications, subscriptions and services remain subject to their providers' own privacy notices.

LOSI Sp. z o.o. (LOSI SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ), ul. Korytnicka 46/52, 04-109 Warsaw, Poland; KRS 0001146588, REGON 540499518, NIP 1133154642 (LOSI, Operator or we) is the controller for the Platform, applications, accounts, decisions on Qualifying Actions and rewards, and the initial collection of payout data. LOSI determines the purposes and means of that processing, subject to the Administrator's own functions below.

AIRBPO Serviços e Tecnologia Ltda., Avenida Paulista, 302, Bela Vista, São Paulo/SP, Brazil (Administrator) administers the financial part of programme payouts in Brazil after LOSI confirms the amount earned. For this purpose, LOSI sends the Administrator the confirmed payout instruction and only reasonably necessary personal and financial data, which may include the beneficiary's name, CPF or CNPJ, PIX key or bank details, amount, payout identifier, and proportionate identity, ownership, beneficiary-status or supporting documents required to process the payout.

When verifying the beneficiary, executing PIX and reconciling the payout, the Administrator processes data under LOSI's documented instructions. Where Brazilian law imposes mandatory purposes and means on the Administrator itself — for example fraud prevention, identification, accounting or payment-record retention — it acts as an independent controller limited to those functions. The Administrator keeps operational payout and beneficiary records for five years, or longer where Brazilian law requires. It does not approve applications, determine Qualifying Actions, calculate rewards, control accounts or act as the Partner's tax agent.

This Policy covers Visitors, Applicants, approved Partners, people whose limited Promo Code or Qualifying Action data is used for verification, support contacts and authorised administrative users. The Platform and programme are intended only for people aged 18 or over who reside in Brazil.

We may process browser and device type, operating system, approximate country derived from IP, IP address and request metadata in security or access logs, pages and timestamps, referring site, UTM, campaign or channel parameters, language, consent choices, and limited analytics or advertising events where permitted. This data helps deliver and secure the Website, remember preferences, diagnose faults and measure campaigns. Reward attribution does not depend on a referral-link cookie or identifier.

We process name, e-mail, audience size, niche, social-media handles or links, free-text message, UTM parameters, referring site, date and time, application status, review notes and communications. Do not include sensitive data, passwords or another person's data unless necessary and lawful. Submission does not guarantee approval; review is manual and may consider authenticity, relevance, compliance, conflicts and proportionate fraud signals.

LOSI processes authentication and session data, account identifiers, the individual Promo Code, Campaign, approved channel, dashboard activity, Code use, Qualifying Actions, reward status, payout requests and history, support communications, acceptance of the Terms and related evidence. We may also record the applicable rate and version, Pending Reward, Confirmed Reward, Withdrawable Balance, reversal, date and material reason.

To confirm the beneficiary and process payment, LOSI may collect the beneficiary's name, CPF or CNPJ, MEI or other tax-status information only where reasonably necessary for payout or legal compliance, tax residence where applicable, invoice or supporting document, PIX key or bank details, amount and date, and proportionate proof of identity or ownership. LOSI sends the Administrator only the necessary subset. The Partner must provide correct, complete, current, legible and clear information; defects may suspend, reject or prevent payment under the Terms.

We may process Campaign and Promo Code identifiers, Code-use date and time, the associated account or event, new-account confirmation, type and time of the Qualifying Action, subscription product and status, payment confirmation, refund, chargeback or cancellation, limited duplicate or fraud signals, backend confirmation, and a pseudonymous or hashed identifier where appropriate. Attribution uses Promo Code, account, payment, event, dashboard and backend records; it does not depend on a referral link or attribution cookie.

Data comes from you; your browser or device; Website, dashboard, Promo Code and backend records; authorised administrative users; hosting, network, authentication and communication providers; analytics and advertising providers where consented or otherwise permitted; the promoted provider, limited to necessary Qualifying Action confirmation; and the Administrator, limited to payout status, rejection, execution and reconciliation. We do not receive general in-app usage content from the promoted provider beyond what is strictly needed for that verification.

Under the LGPD and, where applicable, GDPR, we process data to take steps at your request and perform the electronic agreement constituted by the Terms; administer applications, accounts, Campaigns, Promo Codes, attribution, rewards and payouts; comply with legal, accounting and regulatory obligations; establish, exercise or defend legal claims; and pursue legitimate interests in security, manual review, fraud prevention, accurate measurement, support and Platform improvement after assessing necessity, proportionality and impact. Consent is used for optional communications and non-essential technologies where required.

We do not rely on consent where processing is genuinely necessary for the contract or law. Withdrawal affects future consent-based processing and does not invalidate earlier lawful processing. Where LOSI relies on legitimate interests, it applies minimisation, access controls, transparency and an objection mechanism where applicable.

Application, account and support: pre-contractual steps and contract. Promo Code, attribution, calculation, validation, safety period and payout: contract and legitimate interests in accurate measurement, reconciliation and fraud prevention. Beneficiary identification, PIX, accounting and legally required supporting documents: contract and legal obligation. Security, logs, audits and claims: legitimate interests, legal obligation and establishment, exercise or defence of claims, as applicable. Analytics, advertising and optional marketing: consent where required. LOSI does not assume the Partner's personal tax obligations and does not act as the Partner's tax agent.

Applications and Qualifying Action confirmations are currently reviewed manually. Risk rules may flag duplicate activity, an account, channel, Promo Code, refund, chargeback or unusual activity for human review. We do not intend to make a solely automated decision producing legal or similarly significant effects. If this changes, we will provide the information and review rights required by the LGPD or GDPR.

Access is limited to authorised LOSI personnel and providers that need the data for their function. They may include Vercel for hosting and network services; Supabase for database, authentication and session services; transactional communication providers; Google Analytics 4 and Meta only after the required choice; and advisers, auditors, lawyers and authorities where there is a legal basis. Providers are subject to contract, confidentiality, security, minimisation and instructions proportionate to their function.

The Administrator receives only data needed to verify the beneficiary, execute PIX payouts, reconcile and retain legally required operational records. The promoted provider may receive or return limited identifiers to confirm a Qualifying Action. LOSI does not share cookies, general browsing history, dashboard credentials or marketing data with the Administrator where those data are not needed for payment.

We do not sell personal data for money. Google and Meta technologies may receive identifiers and events only after the required choice and under their own legal roles; in some jurisdictions this can be characterised as sharing or targeted advertising. You can reject or withdraw that choice in Cookie Settings without losing public browsing or attribution already validly recorded by Promo Code.

LOSI is established in Poland and serves Partners in Brazil, and some providers may operate in other countries. International transfers follow LGPD article 33, ANPD Resolution CD/ANPD No. 19/2024 and, where applicable, the GDPR through an adequacy decision, approved standard contractual clauses, another permitted mechanism or an applicable equivalent safeguard. We apply minimisation, purpose limitation, security, transparency and proportionate recipient checks.

Data sent between LOSI and the Administrator for Brazilian payouts is limited to payment, beneficiary verification, reconciliation and the recipient's own legal duties. Information about the applicable transfer mechanism or safeguards may be requested through the Privacy Request form available on the Platform or in the dashboard.

LOSI keeps data only as long as needed for the stated purpose, the Partner relationship, law, security, fraud prevention and legal claims. Security and access logs are normally kept for six months. Rejected or withdrawn applications are normally kept for twelve months. Account and Campaign data is kept while the account is active and for up to five years after closure where needed for payouts, accounting, fraud or claims. Consent and acceptance records are kept as long as needed to prove the choice or contract.

After sending payout data to the Administrator and confirming the operation, LOSI deletes full PIX or bank details and copies of identity or supporting documents when no longer needed. LOSI keeps only a minimal instruction, amount, date, status and identifier record for reconciliation, support and claims. The Administrator keeps operational payout and beneficiary records for five years, or longer where Brazilian law requires.

At the end of the applicable period, data is deleted, irreversibly anonymised or access-restricted where a legal obligation or documented legal hold applies. Backups expire on a controlled cycle and deleted data is not returned to ordinary use. Periods may be adjusted where a legal duty or concrete dispute requires longer retention or where the purpose ends sooner.

LOSI, the Administrator and providers apply technical and organisational measures proportionate to the data and risk, including access controls, authentication safeguards, encryption in transit, segregation, logging, backups, vulnerability management and incident response. No system is absolutely secure. Protect credentials, use only your account and promptly report suspected unauthorised access through support.

We investigate, contain, document and remediate incidents. Where an incident may cause relevant risk or harm, LOSI will notify the ANPD and affected people within the period and with the information required by Resolution CD/ANPD No. 15/2024, and make any further notification required by the GDPR. The Administrator and providers must promptly notify incidents involving data under their responsibility so that impact can be assessed and the response coordinated.

Subject to law, you may request confirmation of processing; access; correction; anonymisation, blocking or deletion of unnecessary, excessive or unlawfully processed data; portability under applicable regulation; deletion of consent-based data subject to lawful retention; information about sharing and about the possibility and consequences of refusing consent; withdrawal of consent; objection to irregular processing; review of automated decisions; and petition to the ANPD or a consumer-protection body. You may also request clear information about automated-decision criteria, subject to commercial and industrial secrecy.

Where the GDPR applies, you may also request erasure, restriction and portability, object to legitimate-interest or direct-marketing processing, withdraw consent and complain to a supervisory authority, including the competent Polish authority. Rights are not absolute; we may retain data where law, legal claims or another applicable exception requires.

Submit a request through the Privacy Request form available on the Platform or in the dashboard, or write to LOSI at its registered address. Describe the request, account and, if relevant, the Qualifying Action or payout. We may verify identity proportionately and will never ask for a password. LOSI coordinates Platform requests. The Administrator may respond or assist regarding beneficiary and payout records it controls under its own duties. We will respond within legal periods and explain any limitation or refusal.

You can change non-essential cookie choices through Cookie Settings, unsubscribe from optional marketing, and update account or payout information in the dashboard. Transactional messages about an application, account, Promo Code, reward, payout, security or law may continue. Rejecting optional cookies does not by itself prevent attribution based on a Promo Code and backend records; it may limit analytics, advertising, language memory or session functions. Do not use technical blocking as a substitute for a deletion request where you wish to exercise a legal right.

The Platform and programme are intended exclusively for people aged 18 or over who reside in Brazil. We do not knowingly accept a child or adolescent as a Partner. If we learn that a minor submitted data, we will restrict the account, investigate and delete the data, except for limited retention required by law, security or the person's own protection. Use the privacy channel to report a case.

Account closure removes access and starts the deletion and retention workflow, but does not immediately erase records that LOSI or the Administrator must keep for payout, accounting, fraud prevention, security, disputes or legal duties. The balance and withdrawal right are governed exclusively by the Terms of Use; data deletion does not create, restore or transfer any reward. During mandatory retention, use is restricted to the purpose justifying retention.

We may update this Policy for changes in law, providers, Campaigns, technology or processing. Material changes receive advance and prominent notice where practicable, and new consent where required. The effective date and applicable version will remain available. Changes do not retroactively alter the legal basis for processing already carried out.

Controller and Operator: LOSI Sp. z o.o. (LOSI SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ), ul. Korytnicka 46/52, 04-109 Warsaw, Poland; KRS 0001146588, REGON 540499518, NIP 1133154642. Administrator: AIRBPO Serviços e Tecnologia Ltda., Avenida Paulista, 302, Bela Vista, São Paulo/SP, Brazil. Website: https://stadami.club/; English: https://stadami.club/en. Privacy requests, support requests and complaints may be submitted through the forms available on the Platform or in the dashboard, or by post to LOSI's registered address. You may also petition the ANPD, a consumer-protection body or, where the GDPR applies, the competent supervisory authority.