NanoIris · Privacy and cookies
Privacy policy
Last updated: 25 September 2026
This page explains which personal data nanoiris.com processes, why, for how long, and what your rights are. It is written to be read: if anything is unclear, write to us.
Write to us · intelligence@nanoiris.com01Who is the controller
The data controller is the company that runs NanoIris:
NANOKAPPA BRASIL LTDA
CNPJ (Brazilian company number) 67.868.280/0001-25 · Municipal registration 1181807-7
Rua Coronel Quirino 149, apt. 12, Cambuí — CEP 13025-004 — Campinas (SP), Brasile
intelligence@nanoiris.com
For any question about your data, and to exercise your rights, use the email address above.
02In short
- We do not sell your personal data and do not use it for advertising.
- We use Google Analytics for visit statistics only if you accept it in the banner; no profiling or marketing cookies.
- We process the data needed to let you browse safely, to sell and deliver the files you buy, and to answer your requests.
- Payments are handled by Stripe: your card details never pass through us.
- If you join the affiliate program, we use the details you provide (tax ID, payment details and, for individuals in Brazil, NIT/PIS, date of birth and address) only to pay your commissions and meet tax obligations.
- If your company appears in one of our datasets, you can ask us to remove it (see below).
03What data we process and why
Each row is one processing activity: what we collect, what for, on which legal basis (Brazil's LGPD and, for people in the European Union, the GDPR) and how long we keep it.
| When | Data | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| You visit the site | IP address, country estimated from the IP, browser type, pages requested, date and time | Run the site, protect it from abuse, show your country's language and currency | Legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)) and legal obligation for access logs | Access logs: 6 months, as required by Brazilian law (Marco Civil da Internet, art. 15) |
| You buy a file | Email, optionally name and company, items bought, amount, currency, payment status, downloads (date and format) | Conclude and perform the contract, deliver the file, issue tax documents, support | Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)) and tax obligations (LGPD art. 7, II; GDPR art. 6(1)(c)) | 5 years from the order, for Brazilian tax obligations |
| You sign in to the customer area | Email, one-time access code, session | Let you find your orders and files without a password | Performance of a contract | Session: 30 days; code: a few minutes |
| You request a custom dataset | First name, last name, company (optional), email, description of the request | Answer the request and prepare a quote | Pre-contractual steps at your request (LGPD art. 7, V; GDPR art. 6(1)(b)) | 24 months, or until you ask us to delete it |
| You write to us | Email and message content | Reply | Legitimate interest or pre-contractual steps | As long as needed to handle the request, at most 24 months |
| You choose language and theme | Preferred language and theme (cookies) | Remember your preferences | Consent (LGPD art. 7, I; GDPR art. 6(1)(a)), withdrawable at any time | 1 year, or until you close the browser if you do not consent |
| You accept statistics | Pages viewed, where the visit came from, device and browser type, approximate country and city, a pseudonymous browser identifier (cookie) | Understand which pages and datasets interest people and improve the site; no advertising use | Consent (LGPD art. 7, I; GDPR art. 6(1)(a)), withdrawable at any time | 14 months (Google Analytics setting) |
05Who we share data with
We do not hand your data to third parties for their own purposes. We rely on providers that process it on our behalf, under contracts that limit its use:
| Provider | What it does | Where |
|---|---|---|
| Stripe | Payments: collects and processes card data as an independent controller | United States and European Union |
| Cloudflare | Content delivery and site protection; aggregated, cookie-free visit statistics (Web Analytics) that do not identify you | Global network, headquartered in the United States |
| Brevo | Service emails (order confirmations, access codes) | European Union (France) |
| Neon (on Amazon Web Services) | Catalogue and order database | European Union (Frankfurt) |
| Cloud hosting provider | Server that runs the site | Cloud server |
| Google (Google Ireland Ltd; Google LLC) | Visit statistics with Google Analytics, only if you accept them; no advertising signals | European Union and United States |
06International transfers
The catalogue and order database is hosted in the European Union, in Frankfurt (Germany), and emails are sent from the EU (France): for European customers the data stays in the EU. Under Brazilian law, storing it in Germany is an international transfer to a country with an adequate level of protection (LGPD, art. 33).
Some providers (Stripe, Cloudflare and, if you accept statistics, Google) also process data in the United States. Transfers rely on the safeguards provided by the LGPD (art. 33) and the GDPR (chapter V), such as the standard contractual clauses these providers adopt.
07If your company appears in our datasets
NanoIris publishes and sells lists of companies and organisations built from official public sources. Some rows contain business contacts — the phone number or email of an office — made public by the company itself or by the source.
- We exclude private individuals: when a source contains them, we remove or anonymise them.
- The legal basis is the legitimate interest in making publicly available data accessible and usable (LGPD art. 7, IX and §§ 3, 4 and 7; GDPR art. 6(1)(f)). For people in the EU, this section is the information required by GDPR art. 14.
- You can object at any time and ask us to correct or remove data about you: write to intelligence@nanoiris.com stating the data and the dataset. We reply within 15 days and remove the data from later versions of the files too.
08Your rights
At any time and free of charge you can ask us for:
- confirmation that we process your data, and a copy;
- correction of inaccurate or incomplete data;
- deletion, anonymisation or blocking of data that is unnecessary or processed without a basis;
- portability to another provider;
- information on who we share it with;
- withdrawal of consent, without affecting processing already done;
- objection to processing based on legitimate interest, and restriction of processing.
Write to intelligence@nanoiris.com. We reply within 15 days (LGPD) and in any case within one month (GDPR). You can also lodge a complaint with a supervisory authority: in Brazil the ANPD (Autoridade Nacional de Proteção de Dados), in the EU the data protection authority of your country.
If you live in a US state with a privacy law (California, for example), you can request access and deletion at the same address. We do not sell or share personal information for cross-context behavioural advertising.
09Security
The site is served over HTTPS only; session cookies cannot be read by scripts; the customer area uses one-time codes instead of passwords; databases are reachable only with restricted credentials. No system is perfectly secure: if we discovered a breach affecting you, we would tell you and notify the authority as the law requires.
10Children
NanoIris is a service for professionals and businesses. It is not directed at anyone under 18 and we do not knowingly collect their data.
11Changes
If we change how we process data we will update this page and the date at the top. If the change concerns the cookies we ask consent for, the banner will ask for your choice again.
The Portuguese (Brazil) version of this policy is the reference version; the others are translations.
← Back to home