1.Who is responsible
Controller: KB LTDA, trade name KB Sites, CNPJ No. 69.456.589/0001-33, based in Pindamonhangaba, São Paulo, Brazil (Brazilian Law No. 13,709/2018, the "LGPD", Article 9, III).
Data protection officer (Encarregado, LGPD Article 41): Kauã Barbosa dos Santos.
Contact for privacy requests: the support chat in your account, the contact form on our website, by replying to any email from us, or [email protected].
2.Information we collect
Account information: name, email address, password (stored only in a hashed form we cannot read) and a profile photo if you add one. If you choose "Sign in with Google", Google shares your name, email address, profile photo and a Google account ID with us.
Project information: what you send us through the request form, the website form, the chat or email: your name, business name, email, messages, the options you choose, and the texts, photos, logos, files and references for your site. If you edit your website preview, we send a one-time sign-in code to your email and record the sign-in (date, time, IP address and browser information).
Order and acceptance records: the Website Agreement you accepted (with the typed name, date, time, IP address and browser information of the acceptance), the refund-deadline confirmation, your approval of your website in the chat, payments, refunds and deliveries.
Payment information: BRL payments may be processed by InfinitePay (CloudWalk), as identified before payment. Other methods, such as PayPal, remain identified when used. KB Sites does not collect or store full card numbers or security codes; you provide those directly to the payment provider. To create and reconcile payment requests, we share the order reference, service description and amount and, when needed for the selected flow, your name, email and phone number. We receive the transaction identifiers, status, amounts, payment method, installment count and receipt reference made available by the provider. We use these records to confirm payment, unlock the brief and agreed stages, send transactional messages, handle cancellations/refunds and maintain legal and security records. InfinitePay processes the data it collects under its own Privacy Notice, acting as a controller where applicable. Recurring card charges require the payer's authorization through the provider.
Partner Program information: if you join as a partner (Brazil only), your full name as registered with your CPF, your CPF (also your Pix key), your confirmation that you are 18 or older, your referral code, referrals, commissions and payouts, and the information needed for legally required tax withholding (such as your NIT/PIS number), if any. When you contact a business through the Lead Finder, your full name and the email address you send from appear in your message to that business.
Security and anti-fraud data: your IP address and a random device identifier kept in a first-party cookie (kb_dev), with the dates they were first and last seen, linked to your account and requests.
Basic technical data: like most websites, our hosting provider keeps standard server logs (such as IP address and browser type) for security and operation.
Business contact data for prospecting (Lead Finder): see section 4.
3.How we use your information
To run your account and your private project chat; to quote, design, deliver, host and maintain your website; to process payments and refunds; to send the service emails in section 5; to keep accounts secure and prevent fraud (for example, partners earning commission on their own purchase); to credit referrals and pay partners; to keep records and comply with legal, tax and accounting obligations; and to defend our rights in disputes. We do not sell personal information and we do not send marketing emails to clients unless you ask us to.
4.Prospecting (Lead Finder)
To offer our services to businesses in the United States, we collect business contact information that the businesses themselves make public: business name, address, phone number, email address, website, public social-media pages and public ratings, from sources such as OpenStreetMap, the Google Maps Platform and the business's own website. We use it only to identify businesses that may need a website and to let one partner at a time send that business a single, individual message about our services. Each message identifies the sender, says it is a business offer, includes our postal address and a link to opt out.
Legal basis: our legitimate interest in offering our services to businesses (LGPD Article 7, IX), limited to public business information.
Opting out: if a business opts out, we add its name, email address, website domain and phone number to a suppression list and never contact it again. We keep that list for as long as we prospect, only to honor the opt-out. Other prospecting data is deleted within 12 months after we last use it.
5.Emails we send
Service emails (not marketing), to the email on your account: sign-in and confirmation codes; request confirmation; project status updates; replies in your chat; hosting renewal reminders (3 days before your plan renews and, if not paid, on the renewal day); and notices about your account, refunds and payments.
Partner emails: program updates, commissions earned or paid, rate changes and promotional events of the Partner Program. Partners can turn off promotional notices in the chat at any time.
We keep a log of the emails we send (type, recipient, subject, date and whether sending succeeded) for up to 12 months.
6.Legal bases
Where the LGPD (or the EU/UK GDPR) applies, we process your data to take steps at your request and to perform our contracts with you (LGPD Article 7, V), to comply with legal, tax and accounting obligations (Article 7, II), to exercise our rights in disputes (Article 7, VI), and based on our legitimate interests in running and securing our services, preventing fraud and prospecting as described in section 4 (Article 7, IX). Where we rely on your consent (such as optional analytics cookies), you can withdraw it at any time.
7.Websites we host for clients
On websites we build and host, the business that owns the site decides how its customers' data (orders, reservations, contacts, newsletter emails) is used and is the controller of that data. KB Sites only stores and processes it to run the site, on the business's instructions, as its processor (LGPD Article 39) or "service provider" under U.S. laws. If you are a customer of one of those businesses, please contact the business directly; we will help it answer your request. Each of those sites has its own privacy policy. Our websites are not designed to collect health information. On websites of health care providers (such as dental clinics), we do not provide appointment or booking forms: patients book by phone or through the provider's own scheduling system, and please do not send health information through any form on those sites.
8.Who we share it with
We share the minimum necessary with providers that help us operate, each under its own terms:
- HostGator (Brazil): hosting of our website and of hosted client sites;
- Cloudflare (United States): network delivery and security, including the DNS settings of the domains of the client sites we host;
- Discord (United States): private notifications to our team about new requests and messages (name, business name, email and the text of the message);
- InfinitePay (CloudWalk) and PayPal: payment processing and related records, according to the method identified before payment;
- Google: service emails through Gmail SMTP when the email transport is configured, "Sign in with Google", Google Fonts, the Google Maps Platform for prospecting and, on client sites, Google Analytics only with the visitor's consent. Optional analytics on the KB public website, if you allow it, is separately described in section 9.1.
- our bank in Brazil: to pay partners by Pix (the bank shows us the name of the Pix key holder).
If you reached us through a partner's referral link, that partner can see your business name (or your name, if you gave no business name), the date of your request and whether it became a paid project; partners never see your email, your messages or other details. A partner who reserves a business in the Lead Finder sees that business's public contact data listed in section 4, under confidentiality.
We may also disclose information when required by law or to protect our rights. We do not otherwise share your data with third parties for their own purposes.
9.Cookies and local storage
We use a few first-party cookies and no advertising trackers: referral cookie (kb_ref, up to 30 days, only the partner code); login session cookie (deleted when you close the browser); "keep me signed in" cookie (kb_remember, up to 60 days, a random token); device identifier (kb_dev, one year, only for security and partner-fraud detection, never for advertising); and our hosting provider's bot-protection cookie (humans_...). Local storage remembers that you dismissed the cookie notice and your referral code. External services you use (InfinitePay, PayPal, Google sign-in, Google Fonts) may set their own cookies under their own policies.
Language preference: if you choose a language, we remember it in the kb_language cookie (up to one year) and local storage, only to keep your choice. The lang parameter carries that choice between pages when storage is unavailable. It does not change your market or payment currency.
9.1. Optional analytics on the KB Sites website
If you allow optional analytics, KB LTDA uses Google Analytics 4 to understand visits to our public website and interest in website models and Software de Mercado. This is separate from sign-in, service requests and the analytics settings of delivered client sites. Refusing does not limit those services.
Measurements are limited to approved public-page paths, fixed model identifiers and clicks/selections, event times, cookie identifiers and basic browser/device information. Google receives the technical information needed to handle these requests. We do not send account details, form answers, search text, names, email addresses, CNPJ/CPF numbers, order data, URL tokens, query strings, fragments or referrers through this implementation. We do not use it for advertising, Google Signals or user-provided data, and do not link it to your KB account.
The legal basis is your specific consent (LGPD Article 7, I). Google Analytics is blocked until you choose “Allow analytics” or save that option in “Analytics preferences”. Scrolling, silence, continuing to browse or dismissing the necessary-cookie notice is not consent. You can refuse immediately or withdraw later through the same preferences control, without charge or account access. Withdrawal stops new measurements and removes the Analytics cookies this website can control in your browser; it does not automatically erase data already sent. You may request deletion through section 1.
Your choice, its date and the notice version are remembered in this browser for up to 180 days, equally for permission or refusal, without extending that period just because you visit. If storage is unavailable, a choice applies only while that page remains open. Analytics cookies (_ga and the cookie for our GA4 stream) are configured for up to 90 days without renewing their lifetime on each visit. Google user-level and event-level detail retention is set to 2 months, with activity-based reset off. This setting does not automatically delete standard aggregated reports, which can remain longer.
Google may process this information outside Brazil, including in the United States; section 12 also applies. See Google’s explanation of Analytics data handling. Our preferences control remains available on the public website and Privacy Policy. No analytics is collected on this policy page, in the account, in the software setup form, in private previews or in delivered client sites through this KB implementation.
How Google safeguards Analytics data
10.How long we keep it
Optional KB website analytics: the distinct browser-choice, cookie and Google retention periods are described in section 9.1; they are not the paid-order retention period.
Account data: while your account exists. When you close your account, you have 30 days to change your mind; after that we delete your account and the data linked to it (profile, conversations, site brief, photos, files, references, notifications, sign-in and device records, and the partner Pix key and CPF on your profile).
Paid orders: the client file of each paid order (name, email, what you ordered and paid, the Agreement and Terms you accepted, payment and refund proof, delivery, the project conversation and copies of our emails) for 5 years after the payment, for tax and accounting rules and payment disputes.
Hosted sites: files and data are kept for 30 days after the hosting ends, so you can ask for them, and then deleted.
Website previews: the preview we build from your website form (your texts, photos, logo and any changes you make in the preview) is kept for 30 days after your website goes live or its files are delivered, or after your order ends, and then deleted. Your live website is not affected.
Self-hosted website files: we keep a copy of the files we deliver to you for 30 days after delivery, or until 7 days after we close the last defect fix you asked for within those 30 days, whichever is later, and then delete it.
Previews and copies of website files are also deleted when your account is deleted.
Partner payments: the record of each commission paid (date, amount, Pix receipt, name and CPF, and any tax withheld) for 5 years after the payment.
Security and anti-fraud records: deleted or anonymized no later than 24 months after your last activity, except records tied to a review or dispute, kept until it is closed.
Email log: up to 12 months. Prospecting data: section 4.
11.Your rights
Depending on the law that applies to you (for example the LGPD, the GDPR or U.S. state laws such as the CCPA), you may have the right to: confirm whether we process your data; access it; correct it; delete it; receive a copy (portability); know who we share it with; object to or restrict certain processing; have it anonymized or blocked in certain cases; and withdraw consent. Send your request through the channels in section 1. We may ask you to confirm your identity first. We answer as soon as possible and within the time the law requires. When we delete data, we keep only what the law requires or what is needed for disputes and fraud prevention.
12.International transfers
We are based in Brazil and our main servers are in Brazil; some providers (such as Cloudflare, PayPal and Google) process data in other countries, including the United States. We use providers that offer appropriate safeguards and share only what is necessary.
13.Security
We use reasonable measures such as encrypted (HTTPS) connections, hashed passwords, account and device checks and backups. No method is completely secure. If a security incident may create a relevant risk to you, we will notify you and the authorities as required by law.
14.Children
Our services are for businesses and adults. We do not knowingly collect personal information from anyone under 18.
15.Changes
We may update this policy. The current version is the one published here, shown by the "Last updated" date.
16.Contact
Privacy questions or requests: support chat in your account (kbsites.com.br/account), the contact form on our website, reply to any email from us, or [email protected].