Privacy policy

1. Who processes your data

Data controller: Alan Aparecido da Silva, CPF 470.921.058-62, at Avenida José Cendon Farto, 760, Araraquara/SP — 14806-361, Brasil.

Contact for data protection matters, including exercising your rights: privacy@mylilstep.com. For everything else: support@mylilstep.com or +55 16 99750-7256.

2. What we collect

Identification and contact data: email address and, where the customer provides them at checkout, name and billing address.

Transaction data received from the payment processor: payment reference, amount, currency, date, card issuing country, card brand and the last four digits. We never receive or store the full card number, expiry date or security code.

Browsing data: IP address, device and browser type, language, pages viewed and referral source. This is only collected for measurement after the visitor accepts in the cookie banner.

Communication data: the content of messages you send us by email, so we can reply and keep a record of the support given.

We do not collect children's data. The site is addressed to adults and we never ask for information about the children the material is intended for.

3. Purposes and legal bases

Performing the sales contract: processing payment, delivering the files and providing support. Basis: performance of a contract (GDPR art. 6(1)(b)).

Complying with legal obligations, in particular tax and accounting records. Basis: legal obligation (GDPR art. 6(1)(c)).

Preventing fraud and keeping the site and payments secure. Basis: legitimate interest (GDPR art. 6(1)(f)).

Measuring site audience and sending marketing about similar products where subscribed. Basis: consent (GDPR art. 6(1)(a)), withdrawable at any time.

4. Who we share it with

Stripe Payments Europe, Ltd. and Stripe, Inc., as processors, for payment processing and security.

Our transactional email provider, to deliver purchased files and answer support requests.

Our site hosting and delivery provider, Vercel Inc.

Public authorities, where there is a legal obligation or court order.

We do not sell, rent or share personal data with third parties for their own advertising purposes.

5. International transfers

Some of the providers above process data outside the European Economic Area and outside Brazil, in particular in the United States.

Those transfers rely on standard contractual clauses approved by the European Commission and, for the Brazilian law, on specific clauses ensuring an equivalent level of protection.

6. Retention

Billing and transaction data: for the period required by applicable tax and accounting law, with a minimum of 5 years.

Support contact data: up to 3 years after the last interaction.

Browsing data collected with consent: 14 months at most.

Once those periods end, data is deleted or irreversibly anonymised.

7. Security

The site is served exclusively over an encrypted connection (HTTPS). Payment takes place in Stripe's environment, certified PCI DSS Level 1.

Access to data is limited to those who need it for the purposes described. In the event of a security incident carrying material risk, we notify the competent authority and the affected individuals within the statutory deadlines.

8. Your rights

You may request access, rectification, erasure, restriction of processing, portability and object to processing, and withdraw consent at any time (GDPR arts. 15 to 22).

Data subjects under the Brazilian law also have rights to anonymisation, blocking and information about entities the data has been shared with (LGPD art. 18).

To exercise any of these rights, write to privacy@mylilstep.com. We respond within 30 days at the latest.

You also have the right to lodge a complaint with your national supervisory authority in the European Union, or with the Brazilian National Data Protection Authority.

9. Cookies

The site uses cookies necessary for it to work and, subject to consent, audience measurement cookies. Details are in the Cookie policy.

10. Changes to this policy

This policy may be updated to reflect legal or operational changes. The version in force is always the one published on this page.

Last updated: 31 July 2026.