---
title: "Vagalerta Privacy Policy"
description: "Vagalerta privacy policy: what data we collect to make your Federal Police booking, how the protocol number and date of birth are protected and deleted, who processes them, and your rights under Brazil's LGPD."
url: "https://vagalerta.com/privacy/"
language: "en"
last_modified: "2026-10-07"
alternates:
  pt-BR: "https://vagalerta.com/privacidade/"
  en: "https://vagalerta.com/privacy/"
  x-default: "https://vagalerta.com/privacidade/"
---

# Privacy Policy

Last updated 7 October 2026.

To make your booking we need what the Polícia Federal Agenda Web asks for: **your protocol number and your date of birth**, plus name, email, phone, unit, service and the period in which you can attend. The protocol and date of birth are stored encrypted, seen by one person on our team only at the moment of booking, and deleted 10 days after the appointment. We do not sell data and we do not use your data for advertising.

## 1. Controller

Vagalerta is the controller of the data described here and can be reached at [contato@vagalerta.com](mailto:contato@vagalerta.com), which is also the channel for exercising your rights and for the data protection officer.

## 2. What we do with the data, stated plainly

We check the Agenda Web's date availability for the unit and service you chose. When the Federal Police releases a date inside your period, a person on our team opens the Agenda Web, types your protocol, your date of birth and your email, and makes the booking on your behalf, as your representative for that act. No software fills in the Federal Police site: it is a person, one case at a time. The Federal Police sends its confirmation to your email, and we send the PDF confirmation with the Pix.

## 3. What we collect

- **Identity and contact**: full name, email, phone and, if you give it, nationality.
- **Booking data**: Federal Police unit and service, the period in which you can attend, time preference, hard deadline if given, page language.
- **Agenda Web credentials**: the protocol number (request code) and date of birth. Stored encrypted (AES-256-GCM, dedicated key, versioned). Every read by a person on our team is written to an access log, with who, when and for which case.
- **Confirmation**: the PDF or image of the Agenda Web confirmation, with date, time, unit and your protocol.
- **Case history**: every state change, with date and who made it, and the payment record (Pix identifier, date).
- **Link to continue later**: if you ask for this link on the form, the email address you give, the unit and service you chose and the date of the request. Nothing else: no name, protocol, date of birth or phone.
- **Minimal technical logs**: a hash of the IP address, browser identification and the request timestamp, for security and abuse prevention under Brazil's Internet Civil Framework.

We never ask for any system password, we do not ask for document copies.

## 4. Why, and on what legal basis

- **Making the booking you hired us for**, sending the confirmation, the Pix and the appointment reminders: performance of a contract, LGPD art. 7(V). The authorisation box on the form exists to make the mandate you give us explicit; the legal basis is the contract.
- **Sending the link to continue your request later**, when you ask for it on the form: consent, LGPD art. 7(I), given by ticking the box next to the button. It is a single email, sent at once; we send no reminders. You can withdraw consent at any time by writing to contato@vagalerta.com.
- **Security, fraud and abuse prevention**: legitimate interest, art. 7(IX).
- **Tax and accounting obligations** on the payment: legal obligation, art. 7(II).

We do not use your data for advertising, profiling, or automated decisions about you.

## 5. Who processes the data for us

- **Neon** (database), region sa-east-1, São Paulo, Brazil: all case data, with the protocol and date of birth encrypted.
- **Resend** (email delivery): your email address, the content of the messages we send and the attached confirmation.
- **Telegram**: used by our team only, to be told that a date has appeared. The message carries the case code, the unit, the service and the period. **Never your name, protocol, date of birth or email.** The confirmation passes through Telegram for under a minute and is deleted from there.
- **The people on our team** who make the booking, each identified in the access log.
- **DataFast** (visit statistics): no cookies and no individual identification.

The email infrastructure and Telegram are located outside Brazil. The international transfer is limited to what each one receives, as described above, under LGPD art. 33 and the contractual terms of those providers. We may also disclose data under a court order or a request from a competent authority.

## 6. How long we keep it

- **Protocol and date of birth**: deleted **10 days after the appointment date**. If the case is cancelled, closed for invalid data, or closed with no answer to the renewal request, they are deleted immediately.
- **Confirmation**: deleted 30 days after the appointment date.
- **Name, email, phone and case history**: 12 months after closure, for support and accounting; then anonymised.
- **Link to continue later** (email, unit and service): deleted 30 days after the link was requested.
- **Credential access log**: 24 months.
- **Technical logs**: for the applicable statutory period.

Data from the earlier free service (the emails, units and services of people who received email notices) is deleted 90 days after that service closed. That deletion closes the retention gap that existed for those records.

## 7. Your rights

Under LGPD art. 18 you may request confirmation of processing, access, correction, anonymisation, portability, deletion and information about sharing. Write to [contato@vagalerta.com](mailto:contato@vagalerta.com) and we respond within 15 days. The export is a JSON file with your case data. Cancelling the request from your case page deletes the protocol and date of birth immediately.

## 8. Cookies and local storage

We use no advertising cookies and no third-party trackers. The site may store preferences such as your chosen language in your own browser; that information never leaves your device.

## 9. Security

Traffic is served over HTTPS only. The protocol and date of birth are encrypted in the database and only decrypted on the screen a person on our team uses to book, behind a short-lived link with an access record. Administrative access is restricted and authenticated. No system is completely immune, and in the event of a significant incident we notify affected people and the ANPD under LGPD art. 48.

## 10. Minors

The service is aimed at people aged 18 or over. A request on behalf of a minor is accepted only when made by the legal guardian, who is responsible for the authorisation given in the form.

## 11. Changes

We may update this policy. The date at the top indicates the current version, and material changes are emailed to anyone with an open case.

## Talk to us about your data

[contato@vagalerta.com](mailto:contato@vagalerta.com). See also our [Service Terms](https://vagalerta.com/terms/) and [who operates Vagalerta](https://vagalerta.com/about/).

## Structured data (JSON-LD)

```json
{
  "@context": "https://schema.org",
  "@graph": [
    {
      "@type": "WebPage",
      "@id": "https://vagalerta.com/privacy/#webpage",
      "url": "https://vagalerta.com/privacy/",
      "name": "Vagalerta Privacy Policy",
      "inLanguage": "en",
      "isPartOf": {
        "@id": "https://vagalerta.com/#website"
      },
      "about": {
        "@id": "https://vagalerta.com/#organization"
      },
      "dateModified": "2026-10-07"
    },
    {
      "@type": "BreadcrumbList",
      "itemListElement": [
        {
          "@type": "ListItem",
          "position": 1,
          "name": "Home",
          "item": "https://vagalerta.com/en/"
        },
        {
          "@type": "ListItem",
          "position": 2,
          "name": "Privacy"
        }
      ]
    }
  ]
}
```