Privacy Policy
Who we are
Adlessio is a product of Lexlam Electronics of Brazil, registered under CNPJ [[CNPJ]], with offices at [[FULL ADDRESS]], Brazil.
We are the controller of the data described in this policy under both Brazil's LGPD and the EU GDPR.
Data protection officer (LGPD art. 41): Lexlam Electronics of Brazil — [email protected].
EU representative (GDPR art. 27): designation in progress. Until it is complete, data subjects resident in the EU should send requests to [email protected], handled within GDPR deadlines.
This document follows Brazil's LGPD (Law 13.709/2018) and the EU GDPR (Regulation 2016/679). Have it reviewed by counsel before commercial publication, in particular the data protection officer and the EU representative designations.
What Adlessio does not collect
We start here because it is what matters most in an ad blocker.
- We do not log the pages you visit. Not the domain, not the URL, not the title.
- We do not log your browsing history.
- We do not fingerprint. No canvas, font enumeration, audio or WebGL probing.
- We do not sell data nor share it with data brokers, ad networks or commercial partners.
- We do not use your data to train machine learning models.
Ad filtering happens on your device. Blocklists are downloaded to the browser and applied locally — page content never reaches our servers.
Data we process
| Data | Purpose | Legal basis (LGPD / GDPR) | Retention |
|---|---|---|---|
| Email and name | Create and identify your account, send verification codes and licence notices | Contract performance (art. 7 V / art. 6(1)(b)) | While the account exists + 5 years |
| Password (Argon2 hash) | Authenticate you | Contract performance | While the account exists |
| Installation identifier (install_id), browser, operating system, extension version and IP | Grant and control the 30-day trial before any account exists, and prevent it from being renewed by reinstalling | Contract performance (art. 7 V / art. 6(1)(b)) and legitimate interest for abuse prevention (art. 10 / art. 6(1)(f)) | 2 years after the trial ends, or while the installation is linked to an active account |
| Device identifier | Enforce the licence device limit | Contract performance | While the device stays linked |
| Browser, version and operating system | Compatibility and support | Legitimate interest (art. 10 / art. 6(1)(f)) | While the device stays linked |
| Installed extension version | Know who needs to update | Legitimate interest | While the installation is active |
| IP address and user agent on sign-in | Security, fraud and abuse detection | Legitimate interest / legal obligation | 6 months |
| Payment data | Process the subscription | Contract performance | Held by the gateway; we keep only the transaction reference |
| Support messages | Handle your ticket | Contract performance | 3 years |
The install_id is a random number generated in your browser at install time. It does not identify you and is not derived from anything of yours — it is not a fingerprint of your device, hardware or browser. It exists only so the server recognises the same installation between calls, which is what stops reinstalling the extension to get another seven days. If you create an account, that identifier becomes linked to it; until then, we have no way of knowing who you are.
We never store card data. Payment is processed entirely by the gateway; we receive only a transaction identifier.
Who we share with
Only processors necessary to run the service, each under a contract that forbids using the data for their own purposes:
- Transactional email provider — verification codes and licence notices.
- Payment gateway — subscription processing.
- Infrastructure provider — server hosting.
The sub-processor list is available on request at [email protected].
We may disclose data under a court order or a competent authority's request, strictly within the scope of that request.
International transfers
Your data stays in Brazil. Our servers are in São Paulo, and processing happens on Brazilian soil.
For users in Brazil there is therefore no international transfer of the core data.
If you are in the European Union
Brazil has no adequacy decision from the European Commission. Transferring your data here relies on standard contractual clauses (GDPR art. 46(2)(c)), together with a transfer impact assessment.
You may request a copy of the applicable safeguards at [email protected].
Processors outside Brazil
Some processors — the transactional email provider and the payment gateway — may process data outside the country. In each case we require a contract with protections equivalent to this policy.
Your rights
The LGPD (art. 18) and the GDPR (arts. 15–22) give you the right to:
- Confirmation and access — know whether we process your data and get a copy.
- Rectification — correct incomplete or outdated data.
- Erasure — request deletion of data processed on consent.
- Portability — receive your data in a structured, machine-readable format.
- Objection — object to processing based on legitimate interest.
- Withdraw consent, where that is the legal basis.
- Information about sharing — know who we share with.
- Review of automated decisions — we take no solely automated decisions producing legal effects on you.
To exercise any right, write to [email protected]. We answer within 15 days (LGPD) or 30 days (GDPR).
Most of this you can do yourself: account details, devices and account deletion live in My account.
Security
- Passwords stored with Argon2, never in plain text.
- Verification codes (OTP) stored as HMAC-SHA256, with expiry and single use.
- Integration credentials encrypted at rest, master key outside the database.
- All traffic over HTTPS with HSTS.
- Immutable audit trail for sensitive operations.
- Secrets never reach logs — redaction happens at the formatting layer.
In a breach with material risk we will notify you and the ANPD within the legal deadlines, and the competent EU supervisory authority within 72 hours.
Minors
Adlessio is not directed at people under 18 and we do not knowingly collect children's data. Accounts identified as such will be closed and the data erased.
Changes
If we change this policy materially we will notify you by email and in the panel at least 15 days in advance. The date at the top reflects the last revision.
Complaints
You may complain to Brazil's ANPD (gov.br/anpd) or, if you are in the European Union, to the supervisory authority of your country of residence.