Controller: ECOMILHAS TECNOLOGIA LTDA (“ECOMILHAS”), Brazilian company no. (CNPJ) 46.740.714/0001-37, registered office at Alameda Vicente Pinzon 54, Vila Olímpia, 04547-130, São Paulo/SP, Brazil.
Data Protection Officer / DPO: contact@ecomiles.app
Version 3.0 — effective 4 July 2026.
This Privacy Policy explains how ECOMILHAS collects, uses, shares, transfers, stores and protects personal data through the Ecomilhas app, the business.ecomiles.app dashboard, the ecomilhas.app / ecomiles.app websites and any related portals, APIs and forms (the “Services”). It is designed to comply with Brazil’s LGPD (Law 13.709/2018) and, where applicable to users in other regions, with the EU GDPR (Regulation 2016/679), the UK GDPR, Japan’s APPI, the California CCPA/CPRA and other applicable data protection laws. Region-specific rights are set out in “Additional regional rights”.
By using the Services you confirm you have read and understood this Policy. Where the legal basis is consent, it is collected separately and may be withdrawn at any time.
1. Definitions
We use the terms defined in the LGPD and GDPR, including personal data, special/sensitive data, data subject, processing, controller, processor, DPO, anonymisation, consent, international transfer and supervisory authority (in Brazil, the ANPD). Undefined terms have the meaning given by applicable law.
2. Data we collect
We collect only the data needed for the purposes described below:
- Account and identification data: first and last name, email, national ID (CPF or local equivalent), password (stored encrypted) and, where applicable, phone number.
- Social login data: when you authenticate via Strava, Google, Apple or Facebook, we receive the identifiers and basic profile data you authorise on those platforms.
- Geolocation — background collection: the Ecomilhas app collects precise location data, including in the background (when the app is closed), in order to track, record and validate the trips you make using your self-declared transport modes, generating evidence of travel. Background collection requires the explicit permission granted on your device and can be disabled at any time in system settings — which will prevent trip validation and the earning of ecomilhas.
- Trip and usage data: routes, distances, declared mode, timestamps, ecomilhas earned, redemptions and activity history.
- Payment and reward data: PIX key, data required to issue and use the prepaid Mastercard, and Green Card subscription details. Full card data is handled by partner payment institutions and not stored in full by ECOMILHAS.
- Data provided by companies (B2B/ESG program): where you participate through your employer or a partner company, we may receive identification and employment-link data to enable benefits and ESG reporting.
- Automatically collected data: device identifiers, IP address, operating system, browsing data, cookies and similar technologies (see the Cookie Policy).
We do not intentionally collect sensitive personal data.
3. Purposes and legal bases
We process personal data for the following purposes, under the corresponding legal bases (LGPD; and GDPR Art. 6 for EU/EEA and UK users):
| Purpose | Legal basis |
|---|---|
| Create and manage the account and authenticate users | Performance of a contract |
| Track and validate trips and credit ecomilhas | Performance of a contract |
| Background geolocation collection | Consent |
| Process redemptions, PIX and Mastercard | Contract and legal obligation |
| Prevent fraud/abuse and ensure trip integrity | Legitimate interests |
| Comply with legal, tax and regulatory duties | Legal obligation |
| Generate reports and carbon credits for B2B clients | Contract and legitimate interests |
| Send marketing communications | Consent |
| Establish, exercise or defend legal claims | Legal claims / legitimate interests |
| Information security and service improvement | Legitimate interests |
Where we rely on legitimate interests, we carry out a balancing test and you may object as described in Section 8.
4. Automated decision-making
Trip approval or rejection is carried out, in part, by algorithms assessing speed, distance and route consistency with the declared mode. This automated processing may affect the crediting of ecomilhas. You have the right to request human review of these decisions and information about the criteria applied, under LGPD Art. 20 (and GDPR Art. 22 where applicable), via the channels in Section 8.
5. Data sharing
We share personal data only as necessary and with contractual safeguards, with these categories of recipients:
- Processors: cloud/hosting providers, payment processors and the Mastercard issuer, PIX providers, analytics, communications and security tools.
- Program partners: companies that contract the B2B/ESG program (as to their own employees) and reward partner stores.
- Audit and verification: independent auditors (e.g., KPMG) and carbon-credit registries (Verra/CDM/GS), using minimised or aggregated data where possible.
- Authorities and advisers: public, judicial and regulatory authorities, and lawyers and accountants, where required by law or to exercise rights.
- Corporate transactions: in a merger, acquisition or reorganisation, subject to confidentiality and continuity of this Policy.
We do not sell personal data. All processors are required to process data only on our instructions and in line with applicable law under a data processing agreement (DPA).
6. International data transfers
The Services are operated from Brazil and may involve transfers to other countries (e.g., cloud providers). In such cases we apply at least one safeguard: (i) transfer to a country with an adequate level of protection; (ii) standard contractual clauses (including the EU SCCs and the UK International Data Transfer Agreement, where applicable); or (iii) another basis authorised by the ANPD and competent authorities. A copy of the safeguards can be requested via Section 8.
7. Retention and deletion
We keep personal data only as long as necessary for the purposes or to meet legal obligations:
| Category | Reference period |
|---|---|
| Active account data | For the life of the account |
| Trip and ecomilhas data | Life of the account + up to 5 years |
| Application access logs (Brazilian Marco Civil) | 6 months (legal minimum) |
| Tax and payment data | Up to 5 years after the transaction |
| Marketing data | Until consent is withdrawn |
Once the period ends or a valid deletion request is met, data is securely deleted or anonymised, except where mandatory retention applies.
8. Your rights and how to exercise them
Depending on your location and applicable law, you may: confirm processing; access your data; rectify it; request anonymisation, blocking or erasure; port your data; obtain information about sharing; be informed about the option not to consent; withdraw consent; object to processing; and request review of automated decisions.
To exercise your rights, contact contact@ecomiles.app. We may ask for information to verify your identity. We respond as soon as possible and within the legal deadlines. A request may be lawfully refused with justification (e.g., mandatory retention). Deleting essential data may end the contractual relationship. You may also lodge a complaint with your competent supervisory authority — in Brazil, the ANPD (www.gov.br/anpd).
9. Information security
We apply technical and organisational measures appropriate to the state of the art, including encryption in transit and at rest, need-to-know access controls, environment segregation, logging, vendor assessment and an internal privacy governance program. No system is completely secure; in the event of a material security incident we will notify the ANPD and affected data subjects without undue delay as required by law and take mitigation measures. For GDPR/UK GDPR users, notifications to the authority are made, where required, within 72 hours.
10. Cookies and marketing
Our use of cookies and similar technologies is described in the Cookie Policy. Marketing communications rely on consent (opt-in) and can be cancelled at any time via the unsubscribe link (opt-out) or our contact channels.
11. Children
The Services are intended for users aged 18 or over. We do not knowingly collect data from minors without the specific, prominent consent of a parent or legal guardian. If we identify such data, we will delete it.
12. Additional regional rights
In addition to the above, the following apply depending on your location:
- Brazil (LGPD): rights and channels set out in this Policy; authority: ANPD.
- EU/EEA (GDPR) and UK (UK GDPR): rights of access, rectification, erasure, restriction, portability and objection; the right to complain to your local supervisory authority; transfers protected by SCCs/IDTA. ECOMILHAS will appoint an EU and a UK representative where required by Art. 27 GDPR/UK GDPR.
- Japan (APPI): rights to disclosure, correction and suspension of use; identification of the utilisation purpose; specific rules for cross-border transfers to third parties.
- California/USA (CCPA/CPRA): rights to know, access, correct, delete and limit the use of sensitive personal information, and not to be discriminated against for exercising them. ECOMILHAS does not sell personal information.
- Other Latin American countries: equivalent rights under local data protection laws.
13. Changes
We may update this Policy at any time to reflect legal, regulatory or service changes. The current version is always the one published on our official channels, with its date. Material changes will be communicated. Continued use after the effective date means you are aware of the updated version.
14. Governing law
This Policy is governed by Brazilian law, without prejudice to the mandatory data protection and consumer laws of the data subject’s country of residence. The courts of São Paulo/SP are elected, except where the data subject’s local law requires another forum.
Related documents: General Terms of Use · Cookie Policy · Data Processing Agreement (DPA) for corporate clients.