Privacy Policy
Last updated:
Quick summary: Galaxies collects the contact and usage data needed to run the Platform and support your account. We don't collect sensitive personal data, and we don't sell your data. Most of what we process, we process as a processor acting on your organization's instructions — your organization, as our Client, is usually the controller of your data, not us. Below is the full account.
1. Who this applies to
This Privacy Policy applies to anyone whose personal data Galaxies processes: visitors to our website, Users of the Platform, and contacts at organizations we work with.
2. Our role: usually a processor
When your organization is our Client, Galaxies typically acts as the data processor (an “Operadora” under LGPD), and your organization is the data controller. That means your organization decides why and how your personal data is processed, and Galaxies processes it on their instructions.
3. How we collect data
We collect data directly from you, from Clients providing their employees' contact information, and automatically through cookies and similar technologies when you use our website or Platform.
4. What data we collect
Contact and registration data — name, corporate email, phone number, company, and role.
Navigation data — IP address, device information, cookies, and access logs.
Platform usage data — how you interact with the Platform.
We don't collect sensitive personal data or data from children, and we don't intentionally collect data from anyone under 18.
5. Why we process it, and the legal bases we rely on
We process this data to provide and improve the Platform, manage your account, communicate with you, and meet legal obligations. Depending on the purpose, we rely on your consent, the performance of a contract, our legitimate interests, or compliance with a legal obligation.
6. Who we share data with
Business partners and service providers who help us run the Platform.
A successor organization, in the event of a merger or acquisition.
Authorities, when legally required.
Law firms, when necessary to protect our rights.
The cloud and IT infrastructure providers that host our systems.
7. International data transfers
Some of the providers we work with are based outside Brazil, including in the United States. When we transfer personal data internationally, we use appropriate safeguards to protect it, consistent with LGPD, GDPR, and other applicable frameworks.
8. How long we keep data
We keep personal data only as long as necessary for the purposes described here, or as required by law. After that, we delete or anonymize it.
9. How we protect it
We use encryption, access controls, confidentiality commitments from our team, and audit logs to protect personal data against unauthorized access, loss, or misuse.
10. Children's data
The Platform is built for corporate clients and professionals aged 18 and over. We don't knowingly collect data from minors.
11. Your rights
11.1 Brazil — LGPD
Under Brazil's General Data Protection Law (Lei nº 13.709/2018), you have the right to:
confirm whether we process your data;
access it;
correct incomplete, inaccurate, or outdated data;
anonymize, block, or delete unnecessary or excessive data;
request portability to another provider;
delete data processed with your consent;
get information about who we've shared your data with;
be informed about your right to refuse consent and the consequences of doing so; and
revoke your consent at any time.
11.2 European Economic Area and UK — GDPR
If GDPR applies to you, you have the right to access, delete, correct, and restrict how we process your data, to object to processing, to request portability, and to lodge a complaint with your local data protection authority.
11.3 United States — CCPA and state privacy laws
If applicable US privacy laws cover you, you have the right to know what data we've collected about you, access it, request its deletion, correct it, opt out of the sale or sharing of your data, limit our use of sensitive personal data, and not be discriminated against for exercising these rights. Galaxies does not sell personal data for money.
12. Contact
Questions or requests about your data: contato@galaxies.gg.
13. Updates to this policy
We may update this Privacy Policy from time to time. We'll post the current version here, with the date it was last updated.
Glossary
Personal Data — any information that identifies or can identify a natural person.
Sensitive Personal Data — personal data about racial or ethnic origin, religious belief, political opinion, health, sex life, or genetic or biometric data.
Data Subject — the person the personal data is about.
Controller — whoever decides why and how personal data is processed.
Processor — whoever processes personal data on the controller's behalf.
Data Protection Officer (DPO) / Encarregado — the point of contact between an organization, data subjects, and regulators on data protection matters.
LGPD / GDPR / CCPA — Brazil's, the EU's, and California's data protection laws, respectively.
International Transfer — sending personal data to a country other than the one where it was collected.
Processing — any operation performed on personal data: collection, use, storage, sharing, deletion, and so on.