Privacy Policy

Last updated: 15 September 2026

This is a courtesy translation. The Portuguese version is the authoritative text and prevails in case of any divergence. Numera is a Brazilian operation and the processing described here is governed by Brazilian law.

This policy explains which personal data Numera processes when you visit this website, for what purpose, and what rights you have over it, under Law No. 13,709/2018 (the Brazilian General Data Protection Law — LGPD) and Law No. 12,965/2014 (the Brazilian Internet Civil Rights Framework).

1. Who controls the data

Numera is the brand under which Lopti Tecnologia Ltda., a private legal entity registered with Brazilian corporate taxpayer number (CNPJ) 57.345.692/0001-27, with registered office at Rua dos Pinheiros, nº 603, sala 81, Pinheiros, São Paulo/SP, CEP 05422-011, offers its accounting, tax and finance BPO services. It is the controller of the personal data processed on this website.

Office: Av. São Gualter, 1608 — Alto de Pinheiros, São Paulo/SP, 05455-002, Brazil. Contact: contact@numera.co.

2. What this website collects

This is an institutional website. It has no analytics tools, no social-media tracking pixels, and it loads no resources from third-party servers — fonts, images and logos are served from Numera's own domain. Browsing this site sends no data about you to any company other than the one hosting the site. The only cookie we use is the language preference cookie described in item 2.1.

2.1. Language preference cookie

This website has two versions, in Portuguese and in English. When you pick a language in the switcher in the page footer, we store that choice in a cookie named numera_locale, which holds only the value pt or en — nothing else. It exists so the home page opens in the language you chose rather than the one suggested by your browser.

On a first visit, before you have chosen anything, the server reads the Accept-Language header your browser sends with every request, solely to decide which language to open the home page in. That header is neither stored nor associated with you.

• Purpose: to remember your language preference. It is strictly necessary for that feature — it does not identify you, does not follow your browsing across pages or sites, and is not shared with third parties.
• Legal basis: legitimate interest (art. 7, IX of the LGPD), as a functional cookie triggered by the data subject's own request when choosing a language.
• Retention: 12 months in your browser, or until you delete it.
• How to refuse it: through your browser's cookie settings. Blocking or deleting this cookie does not prevent you from using the site — the home page simply goes back to following your browser's language.

2.2. Server access logs

As with any website, the hosting infrastructure automatically records technical data on each visit, typically: IP address, date and time, page accessed and browser information (user-agent). These records exist for security and to keep the service running.

• Purpose: application security, fraud and abuse prevention, and technical diagnostics.
• Legal basis: compliance with a legal obligation (art. 7, II of the LGPD, read together with art. 15 of the Brazilian Internet Civil Rights Framework) and legitimate interest (art. 7, IX).
• Retention: 6 (six) months, the minimum period required by art. 15 of the Brazilian Internet Civil Rights Framework, unless a court order or a request from a competent authority requires longer storage.
• Processor: Google Cloud (Google LLC and affiliates), the cloud infrastructure provider, with processing in the São Paulo region. The application itself is operated by Lopti Tecnologia Ltda.

2.3. Contact form

The contact buttons on this site open a form. If you choose to submit it, we then process the data you provide: name, work email, company, subject and, if filled in, phone number and message. The site stores none of this in a database: the message is delivered by email to Numera's corporate mailboxes. You can also write directly to contact@numera.co.

• Purpose: to reply to your request and, where applicable, to conduct commercial discussions and prepare a proposal.
• Legal basis: preliminary steps related to a contract to which you are a party (art. 7, V) and legitimate interest (art. 7, IX).
• Retention: for as long as the commercial discussions last and, afterwards, for as long as needed to comply with legal obligations and to exercise rights in legal proceedings, observing the applicable limitation periods (as a rule, up to 5 years). Once those purposes are exhausted, the data is securely deleted.
• Processors: Mailgun (Sinch), to deliver the form message; Microsoft 365 (Exchange Online), for the corporate mailboxes that receive it.

3. Client data processed within Numera's services

This policy covers the institutional website only. As to personal data contained in documents, information and other content submitted by corporate clients in the course of accounting, tax, finance and payroll BPO services — including inside NumeraOS — Numera acts as a processor, processing on behalf of and according to the instructions of the client, who is the controller. Those activities are governed by the contract signed with the client and its Data Processing Agreement, which prevail over this policy wherever they provide specifically.

Where content submitted by the client contains sensitive personal data of third parties, defining and evidencing the applicable legal basis (art. 11 of the LGPD) is the responsibility of the client-controller, with Numera carrying out processing strictly according to the instructions received.

4. Data sharing

Numera does not sell personal data and does not share it for third-party advertising. Sharing takes place only with:

• technology suppliers that operate the site infrastructure, the form delivery and the corporate email, strictly according to our instructions and to the extent necessary for them to carry out those activities;
• public authorities or competent bodies, where necessary to comply with a legal, regulatory or judicial obligation, or to protect the rights of Numera, its users or third parties;
• a successor company, in the event of a corporate transaction (merger, acquisition, reorganisation or sale of assets), strictly to the extent necessary to complete the transaction and to keep processing the data securely.

4.1. International data transfers

Some of these suppliers — in particular the email delivery service (Mailgun) and the corporate email provider (Microsoft) — may process data outside Brazil. In those cases, the international transfer follows the safeguards of art. 33 of the LGPD, with Numera adopting mechanisms such as specific contractual clauses, standard contractual clauses, or seals and certificates recognised by the competent authority, so as to ensure a level of protection compatible with Brazilian law.

5. Security

We adopt technical and administrative measures to protect personal data against unauthorised access, loss, alteration or improper disclosure, including encrypted traffic (HTTPS) across the whole site and access control over internal systems. In the event of a security incident that may cause relevant risk or damage to data subjects, Numera will report it to the Brazilian National Data Protection Authority (ANPD) and, where applicable, to the affected data subjects, under art. 48 of the LGPD.

6. Your rights

The LGPD (art. 18) gives you the right to request, at any time:

• confirmation that processing exists, and access to your data;
• correction of incomplete, inaccurate or out-of-date data;
• anonymisation, blocking or deletion of data that is unnecessary or processed in breach of the law;
• portability to another supplier, under the applicable regulation;
• deletion of data processed on the basis of your consent;
• information about whom we share your data with;
• withdrawal of consent, where that is the applicable legal basis;
• objection to processing based on other legal bases, save for legal and regulatory obligations;
• review of decisions taken solely on the basis of automated processing (art. 20).

To exercise any of these rights, write to privacidade@lopti.ai. We will respond within the statutory period. Where Numera acts as a processor (item 3), the request will be forwarded to the relevant controller, who decides whether and how to meet it.

7. Data Protection Officer

Under art. 41 of the LGPD, Lopti Tecnologia Ltda. has appointed Maria Clara Duarte Brites as Data Protection Officer, with a privacy channel at privacidade@lopti.ai. The Officer is responsible for accepting complaints and communications from data subjects, providing clarifications, receiving communications from the ANPD, and guiding the company's data protection practices.

8. Changes to this policy

We may update this policy to reflect changes to the site, to our services or to the law. The date of the last update is always shown at the top of the page. Material changes will be communicated through clients' contact channels.

This policy is governed by Brazilian law. The courts of the Judicial District of São Paulo, State of São Paulo, Brazil, shall have exclusive jurisdiction over any disputes arising from it.