Privacy Policy
Last updated: 15/10/2026 · This is a translation; in case of conflict, the Portuguese version prevails.
This policy explains how Web Orago® Invoice (https://invoice.weborago.com) processes personal data, in accordance with Brazil's General Data Protection Law (Law 13,709/2018 — LGPD) and the Brazilian Internet Civil Framework (Law 12,965/2014).
1. Who we are
The service is operated by Web Orago® Tecnologia Ltda, CNPJ 59.013.007/0001-90, headquartered at Calçada das Margaridas, 163, Sala 02 — Condomínio Centro Comercial Alphaville, Barueri/SP, CEP 06453-038, Brasil (“Web Orago®”, “we”).
2. Our role
- Controller: Web Orago® is the controller of your account data (name, email, password, access data) and service usage data.
- Processor: data you enter about your clients (name, email, tax ID, address) and the content of your invoices is processed by Web Orago® only as a processor, on your instructions, to provide the service. In that case you are the controller and are responsible for having a legal basis to process that data and for informing your clients.
3. Data we process
- Account: name, email and password (stored only as a cryptographic hash; we never see your actual password).
- Issuer company data: company name, address, email, phone, website, tax ID, logo and payment details you provide.
- Data you enter: clients, products, invoices, items, notes and terms.
- Technical and security data: IP address and date/time of logins, failed login attempts, acceptance of these terms and sensitive actions (data export and deletion); last access date and number of logins.
- Communications: a record of your email confirmation and, if you choose, of your consent to receive marketing emails (date, time and IP of the consent and of any withdrawal).
- Cookies: only one essential session cookie (
invsess), needed to keep you signed in and remember your language. We do not use advertising, tracking or third-party analytics cookies.
4. Purposes and legal bases
| Purpose | Legal basis (LGPD, art. 7) |
|---|---|
| Create and maintain your account, generate invoices and PDFs, store clients and products | Performance of contract (item V) |
| Keep access logs (IP and date/time) for 6 months | Legal obligation — Internet Civil Framework, art. 15 (item II) |
| Security, fraud and unauthorized-access prevention, login attempt limits | Legitimate interest (item IX) |
| Aggregated usage statistics to improve the service | Legitimate interest (item IX) |
| Service communications (email confirmation, changes, security) | Performance of contract (item V) |
| Sending news, tips and offers from Web Orago® itself by email — only if you tick the option | Consent (item I), which you can withdraw at any time |
We do not sell, rent or share your data for third-party advertising. Your clients' data is never used for marketing.
5. Sharing
- Hosting and email: Hostinger, which hosts the website and database and sends the app's emails.
- Automatic translation (optional): if you enable translation on an invoice, the notes, terms and, if selected, item descriptions are sent to the MyMemory service (Translated S.r.l., Italy). Client data, amounts and payment details are never sent. Avoid writing personal data in those fields when translation is enabled.
- Interface libraries: your browser loads public libraries (Bootstrap, PDF generation) from the jsDelivr and cdnjs/Cloudflare CDNs, which receive the visitor's IP address like any website.
- Authorities: when required by law or court order.
Invoice PDFs are generated in your own browser; we do not send them to third parties.
6. International transfers
Some of the providers above may process data outside Brazil (e.g. in the European Union or the United States). These transfers are made to perform our contract with you, with providers that adopt adequate security measures, under art. 33 of the LGPD.
7. Security
We use encrypted connections (HTTPS), hashed passwords, protection against repeated login attempts, per-account data separation, blocking of direct access to internal files, backups, and restricted, logged administrative access. The admin panel shows only account data and usage statistics; it does not display your invoice content or your clients' data.
8. Retention
- Account data and content: while your account exists. When you delete your account, it is removed from the database immediately; backups are overwritten in the normal backup cycle.
- Access logs: 6 months (Internet Civil Framework, art. 15), or longer if required by court order.
- Failed login attempts: up to 24 hours.
- Signups whose email was never confirmed: deleted after 7 days.
- Marketing consent: while active; after withdrawal we keep only the date record to prove we respected your choice.
9. Your rights (LGPD, art. 18)
You may request confirmation of and access to your data, correction, anonymization, blocking or deletion of unnecessary data, portability, information about sharing, review of decisions and withdrawal of consent. Directly in the app, under Settings → My data, you can export all your data (JSON file) and delete your account. Account and company data can be corrected at any time in Settings, where you can also turn marketing emails on or off; every marketing email will also include an unsubscribe link. For other requests, contact our data protection officer; we reply within 15 days.
If you are a client of an Web Orago® Invoice user and want to exercise rights over data shown on an invoice, please contact the company that issued the invoice (the controller) first. We can help forward your request.
10. Data Protection Officer and contact
Data Protection Officer: Web Orago® Tecnologia Ltda — contato@weborago.com.br. You may also file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.
11. Changes
We may update this policy. Material changes will be announced in the app and, when necessary, we will ask for a new acceptance.