Privacy Policy - PixGo.org
Last updated: October 25, 2026
This Privacy Policy describes how OtoCo Base WY LLC - Pixgo.org - Series 89 ("PixGo", "we", "us") collects, uses, stores, shares and protects personal data of users ("you", "User") of the pixgo.org website, the wallet.pixgo.org wallet and the PixGo Android app (collectively, the "Services").
PixGo is a single-member Series LLC organized in Wyoming, USA, registered as a Foreign-owned U.S. Disregarded Entity (Form 5472). Although headquartered in the United States, we recognize that most of our users are located in Brazil and we comply with the Brazilian General Data Protection Law (LGPD - Law 13.709/2018).
By using the Services, you acknowledge that you have read and understood this Privacy Policy. If you do not agree with any part of this document, please stop using the Services.
1. Who We Are
Data controller (LGPD Art. 5, VI):
- Legal name: OtoCo Base WY LLC - Pixgo.org - Series 89
- Trade name: Pixgo.org
- Type: Foreign-owned U.S. Disregarded Entity (LLC, Series)
- Registered address: 159 N Wolcott St Ste 133, Casper, Wyoming 82601-1993, United States
- Contact email: contato@pixgo.org
- Website: pixgo.org
2. Personal Data We Collect
2.1. Data You Provide Directly
- Account data: email address, password (stored only as a salted bcrypt hash), display name or username.
- Profile data (optional): full name, phone number, profile picture, business information.
- Wallet data: Liquid Network public address you choose to receive DEPIX tokens. In the PixGo Wallet we register a pseudonymous wallet identifier and its public addresses, to show balances and history, send notifications and prevent fraud. We do not have access to your seed phrase, private keys or passphrase - the PixGo Wallet is non-custodial and these never leave your device.
- Customer support data: messages, attachments and metadata you send to our support channels.
- Purchases and payments in the PixGo Wallet: the CPF or CNPJ you enter to buy crypto with PIX, the amount and the addresses involved; in the Pix button, the name, email and password of your CryPix account (sent to CryPix) and the payment data (PIX key or boleto barcode and amount). CPF/CNPJ is also requested when you activate a PixGo account.
- AI assistant (Naka): the messages you send to the assistant.
2.2. Data Collected Automatically
- Device data: device model, operating system, browser version, language, screen resolution, IP address, ISP, approximate geographic region (city/country level). For security and fraud prevention only, we also keep a random browser identifier (a technical cookie with no advertising use) and a summary of the device's technical characteristics (platform, browser, graphics card, screen and time zone), used to detect accounts operated from the same device.
- Usage data: pages visited, features used, dates and times of access, referring URL, click and scroll events.
- App data (Android): app version, install/update events, push notification token (FCM) when you opt in, and a Firebase installation identifier generated by Google. In the PixGo Wallet we also keep the IP address and country of wallet access, for security.
- Cookies and similar technologies: session cookies (for authentication), preference cookies (language), CSRF protection. See Section 11.
2.3. Transaction Data
When you generate a PIX charge or receive a payment, we process: amount in Brazilian Reais, internal transaction ID, destination wallet address, status, timestamps and partial information returned by the PIX processing partner. We do not have access to the payer's bank account number or to KYC data of the payer - these are held exclusively by the regulated payment partner, under Brazilian Central Bank regulation.
2.4. Data We Do NOT Collect
- Images of identity documents (RG, driver's license, passport) or selfies - when identity verification is required, it is performed by the regulated payment partner, not by us.
- Seed phrases, mnemonic words, private keys or any wallet recovery material.
- Banking account numbers, credit card numbers, or PIX keys of payers.
- Biometric data, precise GPS location, contacts, calendar, photos or microphone. The camera is used only to read QR codes and barcodes on your device, and the images are not sent to us. Biometric unlock uses the Android system feature and stays on the device.
- Children's data - our Services are intended for users aged 18 or older.
3. How We Use Your Data
- Service delivery: create and maintain your account, process PIX charges, settle DEPIX tokens to your wallet on D+1, generate dashboards and reports.
- Security and fraud prevention: detect suspicious activity, prevent unauthorized access, comply with AML obligations imposed on our partners.
- Customer support: respond to your messages, troubleshoot issues, provide product guidance.
- Notifications: transactional messages (payment received, settlement confirmed, password change). Marketing communications only if you opt in.
- Service improvement: aggregate analytics, performance monitoring, debugging - using pseudonymous or anonymized data whenever possible.
- Legal compliance: meet obligations imposed by United States federal/state law and respond to lawful requests from authorities.
Legal basis (LGPD Art. 7): performance of a contract (Art. 7, V); compliance with legal/regulatory obligations of our partners (Art. 7, II); legitimate interest in security and fraud prevention (Art. 7, IX); explicit consent for optional marketing (Art. 7, I).
4. Who We Share Your Data With
We share the strictly necessary data with the following categories of recipients, only for the purposes described:
- Payment processors: payment institutions and technology partners duly authorized and regulated by the Central Bank of Brazil - to process PIX payments.
- DEPIX issuer: Eulen - responsible for issuing DePix in Brazil, converting PIX into the DEPIX stablecoin on the Liquid Network.
- Infrastructure providers: OVHcloud (server hosting, France/Canada), Cloudflare (DNS, CDN, DDoS protection), MariaDB (database engine running on our servers).
- Push notification providers: Google Firebase Cloud Messaging (FCM) when you opt in to receive notifications on Android.
- Email delivery: SMTP relay used for transactional emails (account verification, payment receipts).
- Authorities: when required by valid legal process (subpoena, court order) under U.S. federal or Wyoming state law.
- Swap and payment partners (PixGo Wallet): BrSwap, SideSwap and Relay receive the addresses and amounts needed to execute the swap you request; CryPix receives your CryPix account data and the payment data when you use the Pix button.
- AI assistant: messages sent to Naka are processed by Anthropic to generate the answer and, when the answer is played as audio, by OpenAI. The PixGo team may review conversations, together with the IP address and approximate location of the access, through an internal messaging tool (Telegram), for support and security. Do not send sensitive data such as your recovery phrase.
- Blockchain data providers (PixGo Wallet): balance and history lookups go through our servers and, on some networks, through RPC providers (such as Alchemy) and public explorers (such as mempool.space and TronGrid), which receive the public addresses being looked up.
We do not sell your personal data. We do not share your data with advertising networks for targeted advertising.
5. International Data Transfer
Our servers are located in the United States and the European Union (OVHcloud). When you use our Services from Brazil, your personal data is transferred and processed outside Brazil. We rely on the safeguards permitted by LGPD Art. 33: contractual clauses with sub-processors and adoption of security measures equivalent to those required by Brazilian law.
6. Data Retention
- Account data: retained while your account is active. Upon account deletion request, deleted within 30 days, except where retention is legally required.
- Transaction records: retained for 5 years after the transaction date, to comply with U.S. tax record-keeping rules and AML obligations of our partners.
- Access logs (IP, user agent): retained for 6 months for security and fraud investigation, then automatically deleted.
- Customer support messages: retained for 2 years.
- Anonymized/aggregate analytics: retained indefinitely.
7. Your Rights
Under LGPD (Art. 18) you have the following rights regarding your personal data:
- Confirmation and access: know whether we process your data and obtain a copy.
- Correction: request rectification of incomplete, inaccurate or outdated data.
- Deletion (anonymization or blocking): request deletion of unnecessary, excessive or unlawfully processed data.
- Portability: receive your data in a structured, commonly used format.
- Withdrawal of consent: revoke any consent previously given (where consent is the legal basis).
- Information about sharing: ask which third parties received your data.
- Opposition: object to processing carried out under legitimate interest.
- Review of automated decisions: if any decision affecting you is taken solely by automated means.
To exercise any of these rights, email contato@pixgo.org with the subject "LGPD Request". We respond within 15 days. Identity verification may be required to prevent unauthorized requests. In the PixGo Wallet you can also request deletion in the app (Settings, Privacy and terms, Delete account and data) or as described at wallet.pixgo.org/excluir-conta.html.
8. Security
- All traffic over HTTPS (TLS 1.2+).
- Passwords stored only as bcrypt hashes (we cannot retrieve them - only reset).
- Two-factor authentication (TOTP) available for admin and merchant accounts.
- Database encryption at rest on production servers; encrypted backups.
- Sensitive secrets (API keys, JWT tokens) stored outside web root, restricted to the application process.
- Periodic security audits and dependency vulnerability scanning.
- Incident response: in case of a confirmed breach affecting your data, we notify you and the relevant authorities (ANPD in Brazil) within the period required by LGPD Art. 48.
9. PixGo Wallet - Special Notice
The PixGo Wallet (wallet.pixgo.org and the Android app) is a non-custodial wallet. Your seed phrase and private keys are generated and stored exclusively on your device and are encrypted with the password you set. We have no access to them, cannot recover them, and cannot move your funds. If you lose your seed phrase and your device, your funds are unrecoverable. The wallet exchanges data with the Liquid Network and our infrastructure only for balance lookup, transaction signing assistance and asset metadata - never for key access.
10. Android App - Permissions and Data Practices
The PixGo Wallet is available as an Android app (Google Play and direct download at wallet.pixgo.org), and pixgo.org can be installed as a PWA (Progressive Web App) from the browser. Permissions the app may request:
- INTERNET - required to communicate with our servers.
- POST_NOTIFICATIONS - to display payment notifications (Android 13+). You may revoke this permission at any time in Android system settings.
- CAMERA - to read QR codes and barcodes, only when you open the reader. Images stay on the device.
- USE_BIOMETRIC - to unlock the wallet with your fingerprint, if you enable it.
Data practices:
- Personal info (email, name, CPF/CNPJ): collected, encrypted in transit, you can request deletion.
- Financial info (transaction history, payment info): collected, shared with regulated payment partners and with Eulen (DEPIX issuer), encrypted in transit.
- App activity (interactions, errors): collected for analytics and security.
- Device or other IDs: collected for fraud prevention.
- Data sale: No.
- Data shared with advertisers: No.
- In-app messages (Naka assistant): collected and shared with the AI provider to generate the answer.
11. Cookies and Similar Technologies
We use cookies in three categories. Strictly necessary: session authentication, language preference, CSRF protection, cookie-consent record and the device identifier used for security and fraud prevention - without these the Services do not work. Analytics: Google Analytics 4 and Google Tag Manager, to understand how the site is used and improve it. Advertising: Google Ads, to measure campaign results. On merchant checkout pages, the merchant may also enable their own Meta, TikTok and Google Analytics pixels, under their responsibility. You can configure your browser to refuse cookies, but the Services will not function correctly without session cookies.
12. Children's Privacy
Our Services are intended for users aged 18 or older. We do not knowingly collect personal data from children under 18. If we become aware of such collection, the data will be deleted immediately. If you are a parent or guardian and believe your child has provided us with personal data, contact us at contato@pixgo.org.
13. Changes to This Policy
We may update this Privacy Policy occasionally. Material changes will be communicated by updating the "Last updated" date at the top of this page and, when significant, by email or in-app notice. The current version is always available at pixgo.org/privacidade.
14. Contact
Questions, complaints or requests regarding privacy or this Policy can be sent to:
- Email: contato@pixgo.org (subject "Privacy")
- Postal: 159 N Wolcott St Ste 133, Casper, Wyoming 82601-1993, United States
You also have the right to file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.