Privacy Policy
Last updated: October 28, 2026
Procurando a versão em português? Clique aqui.
This Policy explains, in plain terms, what personal data Sorteador processes when you use the sorteador.com.br website, the Sorteador Dashboard, our apps and draw tools: why we use it, who we share it with and how you can exercise your rights. It follows Brazil's General Data Protection Law (Law No. 13,709/2018 – LGPD).
1. Who we are
Sorteador is operated by Sorteador Ltda., registered under CNPJ No. 35.701.316/0001-95, located at Av. Getúlio Vargas, 1492, 2nd floor, Savassi, Belo Horizonte – MG, Brazil, ZIP 30112-021 ("Sorteador", "we", "us").
Data Protection Officer (DPO): this role is performed by our Privacy and Data Protection team, which handles requests from data subjects and the ANPD at privacidade@sorteador.com.br.
2. Summary
- You can run simple draws without creating an account.
- In comment draws made on the website without an account, comments are used only during the draw and are not kept. In the Dashboard, imported comments are kept in your account for up to 30 days.
- We do not sell your personal data, and we do not use Instagram, Facebook or YouTube data for advertising.
- Payment details (card, Pix) are processed directly by our payment providers; we do not store your card details.
- You can request access to, correction or deletion of your data at any time by emailing privacidade@sorteador.com.br.
3. What data we process
3.1 Sorteador Dashboard account
- Sign-up: first name, last name, email, password (stored encrypted), language, preferred theme, the date you accepted the Terms of Use and a support code generated to identify your account in customer service.
- Social login: if you sign in with Google, Facebook or Apple, we receive your name, email, profile picture and account identifier from that service. We never have access to your password on those platforms.
- Connected accounts: when you connect Instagram, Facebook or YouTube to draw comments, we store the account identifier, the associated email, the permissions granted and the access tokens issued by the platform (see section 3.5).
- Verification and recovery: temporary codes to confirm your email and reset your password.
3.2 Purchases and billing
The plan or feature purchased, amount, date and payment status. To issue invoices, we store the billing profile you provide: tax ID (CPF or CNPJ), name or company name, trade name, phone number, email and address. Card and Pix details are handled directly by our payment providers.
3.3 Draw content
- Draws: name, description, participant list, number of winners, scheduled date, result and the codes used to look it up.
- Customization: the logo, background images, fonts, colors and text you upload to customize your draws and results.
- Secret Santa: participants' names and, when you provide them, their emails, used only to tell each person who they drew.
- Online bingo and cards: the name or nickname each player uses to join a session.
- Public lists: lists you submit for publication. They are moderated before going live, and your name is shown only if you choose to display it.
3.4 Third-party data you add to draws
When you paste a participant list, draw comments from a post or send campaign participants, you decide which third-party data goes into the draw and why. In these cases you are the controller of that data, and Sorteador acts as a processor, handling it only to run the draw you requested. It is your responsibility to have a legal basis to use it, such as your promotion's official rules.
Campaigns (API integration): companies using Sorteador campaigns send participants and their entries from their own systems (external identifier, name, email, phone number and additional information). Before creating a campaign, the company confirms it has obtained participants' consent or another legal basis. This data is used only to run that campaign's draws.
3.5 Comment draws (Instagram, Facebook and YouTube)
When you connect your account, you authorize Sorteador to access, through the official Meta and Google APIs, only what is needed to draw comments from your posts. The permissions we request are:
Permission | What we use it for |
|---|---|
| Identify your account and link it to your Sorteador account |
| List the Facebook Pages you manage, so you can choose which one to use |
| Read posts and comments from the selected Page |
| Find the Instagram professional account linked to your Page |
| List posts from your Instagram professional account |
| Read comments on the selected Instagram post |
| List your videos and read comments on the selected video, read-only |
What we collect: post or video details (link, thumbnail, caption or title, account, Page or channel name) and the comments: username or display name, text, date and identifier.
How we store it:
- on the website, without an account: comments are fetched at the time of the draw, kept only during your session and then discarded. If you save the result, we keep only the post details and the winning comments;
- in the Dashboard: the imported comment list is saved in your account, together with the import and the draw, so you can apply filters, re-run or review the draw and present the result transparently. It is automatically deleted 30 days after the import, or sooner if you delete the draw or your account. The result (the winning comments and the post details) stays saved until you delete it;
- access tokens are kept while the account is connected and are deleted when you disconnect it in the Dashboard.
What we never do: we do not post anything, reply to or delete comments, change anything in your accounts, use this data for advertising, sell it or share it with third parties, except the infrastructure providers that store it on our behalf.
YouTube: Sorteador uses YouTube API Services. By using this feature you also agree to the YouTube Terms of Service and are subject to the Google Privacy Policy. You can revoke Sorteador's access at any time on your Google Account permissions page. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
3.6 Customer support
When you open a support ticket, we store the subject, the messages exchanged, any attachments you send and, if you have no account, your name and email. If support happens over WhatsApp, we also store your phone number and the conversation history.
3.7 Security and abuse prevention
- Sign-in history: date and time of each sign-in, method used, whether it succeeded, IP address, browser, operating system, device type and a device identifier.
- Feature usage: records of when you use plan features (such as imports and customizations), with IP address and browser, to enforce limits and investigate issues.
- Blocks: if an account is blocked for violating the Terms of Use, we keep the reason and the blocked identifiers (such as email and social accounts) to prevent abusive re-registration.
3.8 Data stored in your browser
Some information is saved only on your own device (the browser's local storage) and is never sent to us: the history of your latest draws made without an account, tool settings (such as the wheel and dice), customization preferences and your participation in bingo sessions. You can erase all of it by clearing the site's browsing data.
3.9 Data collected automatically
- Usage and device data: IP address, browser type and version, operating system, pages visited, date and time of access and time spent.
- Access logs: kept for at least 6 months, as required by Brazil's Internet Civil Framework (Law No. 12,965/2014).
- Cookies and similar technologies: see section 7.
4. Why we use data and on what legal basis
Purpose | Legal basis (LGPD, art. 7) |
|---|---|
Create and maintain your account, run and schedule draws, save and share results and issue certificates | Performance of a contract |
Import comments from the accounts you connected to run draws | Performance of a contract |
Run campaign draws with participants sent by companies | Performance of a contract with the company, which is the controller of that data |
Send each Secret Santa participant their result | Performance of a contract (at the organizer's request) |
Process payments, issue invoices and meet tax obligations | Performance of a contract and compliance with a legal obligation |
Keep access logs | Compliance with a legal obligation (Internet Civil Framework) |
Send account emails (verification, password reset, receipts) | Performance of a contract |
Provide support on the website, by email or over WhatsApp | Performance of a contract |
Moderate public lists | Legitimate interest |
Prevent fraud and abuse and keep the service secure, including sign-in history and blocks | Legitimate interest |
Measure audience and improve the product | Legitimate interest or consent, depending on the cookie |
Show personalized ads | Consent |
Send news and offers by email | Consent (you can unsubscribe at any time) |
Handle requests and the exercise of your rights | Compliance with a legal obligation |
5. Who we share data with
We share data only with service providers needed to run Sorteador, who process it on our behalf and under our instructions:
- Hosting, storage and security: DigitalOcean, Amazon Web Services (including Amazon S3) and Cloudflare;
- Transactional email: Amazon Web Services (Amazon SES);
- Payments: Stripe and Mercado Pago;
- Social login: Google, Meta (Facebook) and Apple;
- Draw integrations: Meta (Instagram and Facebook) and Google (YouTube);
- WhatsApp support: Meta (WhatsApp Business);
- Audience measurement and ads: Google (Google Tag Manager, Google Analytics and Google AdSense).
We may also share data:
- with the company running a campaign, for the results of its draws;
- with public authorities, when required by law or court order;
- in a corporate reorganization (merger, acquisition or sale of the business), with the safeguards of this Policy maintained;
- with your consent, for other purposes we will tell you about first.
We do not sell or rent personal data.
6. International transfers
Some of our providers store data on servers outside Brazil, mainly in the United States. These transfers follow article 33 of the LGPD and are made to providers that adopt appropriate contractual clauses and security standards.
7. Cookies
We use cookies to:
- make the site work (essential): keep you signed in, remember your language and theme preferences, and keep the site secure. These cannot be disabled;
- measure (analytics): understand how the site is used and improve it;
- advertise (advertising): show Google AdSense ads, which may be personalized based on your browsing. Subscribers to the No Banners plan do not see these ads.
You can manage or block cookies in your browser settings. Google ad preferences can be adjusted at adssettings.google.com. Blocking essential cookies may prevent parts of the site from working.
8. How long we keep data
Data | Retention |
|---|---|
Account data | While the account is active. When the account is deleted, personal data is irreversibly scrambled, except what we must keep by law |
Comments imported in the Dashboard | 30 days after the import, or sooner if you delete the draw or your account |
Draws, results and customizations | Until you delete them or your account |
Connected account tokens | Until you disconnect the account or delete your Sorteador account |
Comments from draws made without an account | Not stored; only the result you choose to save |
Temporary result links | Until the expiration date chosen when they were created |
Draws made without an account | [PERIOD TO BE CONFIRMED] |
Campaign participants | Until the company deletes the campaign or asks for the data to be removed |
Support tickets and WhatsApp conversations | [PERIOD TO BE CONFIRMED, e.g. 2 years after closing] |
Sign-in history and feature usage records | [PERIOD TO BE CONFIRMED], never less than 6 months (Internet Civil Framework) |
Identifiers of blocked accounts | As long as the block is needed to prevent further abuse |
Payment and tax data | 5 years, as required by tax law |
9. Your rights
Under the LGPD (art. 18), you can at any time:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- request anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
- request portability of your data;
- request deletion of data processed based on your consent;
- know who we share your data with;
- withdraw consent, without affecting processing carried out before withdrawal;
- object to processing based on legitimate interest.
To exercise any of these rights, email privacidade@sorteador.com.br. We may ask for information to confirm your identity. We reply within 15 days. If you are not satisfied, you can also file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.
If you take part in a campaign or appear in a draw made by someone else, you can contact the organizer directly. If you prefer, we will forward your request to that person or company.
10. How to delete your data
Account and saved draws: you can delete draws directly in the Dashboard. To delete your entire account, email privacidade@sorteador.com.br from the email address registered on your account.
When your account is deleted, your personal data (such as name, email and connected account identifiers) is irreversibly scrambled: the records no longer identify you and cannot be restored. We keep only the data the law requires us to retain, such as tax records and access logs, for the periods in section 8.
Facebook, Instagram and YouTube data deletion instructions:
- Disconnect the account in the Sorteador Dashboard, in the connected accounts area. This deletes the access tokens we store.
- Also remove Sorteador's access on the platform itself:
- on Facebook: Settings & privacy › Settings › Apps and websites › Sorteador › Remove;
- on Instagram: Settings › Accounts Center › Website and app permissions › Apps and websites › Sorteador › Remove;
- on Google/YouTube: myaccount.google.com/permissions › Sorteador › Remove access.
- To delete imported comments and saved draws, delete them in the Dashboard or email privacidade@sorteador.com.br with the subject "Data deletion – Facebook/Instagram/YouTube", including your account email or the links to the draws.
- We delete the data within 15 days and confirm by email.
Your name in a draw made by someone else: if your name or comment appears in a public result and you want it removed, email us with:
- the draw number or link;
- the approximate date it was held;
- the information you want removed.
Once confirmed, we remove the information from our database. If the removal affects a draw made by someone else, that person will be notified.
11. Security
We use technical and organizational measures to protect your data, such as encrypted connections (HTTPS), encrypted password storage, restricted access control, sign-in history and infrastructure monitoring. No system is completely immune to failures. If a security incident may pose a relevant risk or harm to you, we will notify you and the ANPD, as required by the LGPD.
12. Children and teenagers
Sorteador is not directed at people under 18, and we do not knowingly collect children's data. If you are responsible for a child and believe they have given us personal data, contact us so we can delete it.
13. Links to other websites
The website and blog may contain links and ads to other websites, including partners such as Riffas. When you visit them, their own privacy policies apply. We have no control over the content or practices of those websites.
14. Changes to this Policy
We may update this Policy to reflect changes to the service or to the law. The date at the top shows the current version. If a change is significant, we will notify you in advance by email or with a notice on the website or in the Dashboard.
15. Contact
- Privacy and personal data: privacidade@sorteador.com.br
- General support: suporte@sorteador.com.br
- Contact form: sorteador.com.br/contato
This English version is provided for convenience. In case of any discrepancy, the Portuguese version prevails.
