Privacy Policy

1. Who is responsible for your data

The controller of the personal data processed in the shop and of the customer data we receive to deliver your purchase is A.C.E System LTDA, trading as Consylion · Life and Business, a company organized under the laws of Brazil, registration number (CNPJ) 67.647.041/0001-45, SGAS Quadra 915, Bloco D, Sala 103, Brasília/DF, 70390-150, Brazil.

Data protection officer (DPO) and privacy contact: Jonathan Calsavara Sociedade Individual de Advocacia, a law firm, registration number (CNPJ) 47.851.545/0001-75, Rua Antônio de Godoy, 3171, sala 43, Centro, São José do Rio Preto/SP, 15015-110, Brazil, at dpo@consylion.org. The DPO handles requests from anyone, including people in the European Union, the United Kingdom, and Switzerland.

When you go to the order form, Digistore24 collects your order, billing, and payment data as an independent controller, under its own privacy policy (linked on the order form and available at www.digistore24.com/page/privacy). This policy does not cover that processing. If your purchase is processed by another reseller named on the order form, that company does the same under its own privacy policy.

2. Data we collect

When you browse the shop (there is no account or login in the shop):

• technical data, such as IP address, browser, device, pages visited, referring site, date, and time;
• campaign parameters in the link that brought you to the shop (utm_source, utm_medium, utm_campaign, utm_content, utm_term, src, sck, xcod, fbclid, and the Google click identifiers gclid, gbraid, and wbraid). They are kept in your browser and passed to the order form so the sale can be attributed to the campaign;
• an attribution identifier from the UTMify tool, kept in your browser's local storage;
• your cart and preferences, kept in your browser.

When you buy, Digistore24 shares with us the data we need to deliver the product and support you: your name, email address, country, the products bought, the amount, the order number, and the order status. We do not receive your full card details.

When you contact us, we process the content of your message and your contact details.

Providing your order data is necessary to deliver your purchase. All other data is optional.

We do not ask for sensitive personal data.

3. Why we use your data and on what legal basis

For people in the European Union, the EEA, and the United Kingdom, each purpose relies on a legal basis under Article 6(1) of the GDPR or the UK GDPR:

• delivering your products, providing support, and honoring the guarantee: performance of a contract (Article 6(1)(b));
• keeping the records required by tax, accounting, and consumer laws: legal obligation (Article 6(1)(c));
• keeping the shop secure, preventing fraud, and establishing, exercising, or defending legal claims: legitimate interests (Article 6(1)(f));
• cookieless, aggregated visit statistics with Ahrefs Web Analytics: legitimate interests (Article 6(1)(f));
• analytics and advertising cookies, pixels, and campaign attribution (Google Analytics, Microsoft Clarity, Google Ads, Meta Pixel, TikTok Pixel, Microsoft Advertising, LinkedIn Insight Tag, UTMify, and our attribution cookies): your consent (Article 6(1)(a)), asked for in the cookie banner before these tools load;
• playing a video testimonial when you click on it: your request and our legitimate interests (Article 6(1)(f));
• sending you offers and content by email: your consent or, where the law allows it, our legitimate interests in contacting existing customers about similar products, always with an easy way to unsubscribe.

Outside the EEA, the United Kingdom, and Switzerland, the analytics and advertising tools load when you visit the shop, as explained in the cookie notice shown on your first visit, and you can opt out as described in section 5.

4. Cookies and similar technologies

The shop uses cookies, pixels, and browser storage in these categories:

• Shop functions, in your browser's own storage: your cart, your display preferences, and your cookie choice (kept for 12 months), in local storage; and the campaign parameters of the link that brought you to the shop, in session storage, which is cleared when you close the tab. These parameters are passed to the order form so the sale can be attributed to the campaign.
• Analytics: Google Analytics 4 (Google LLC), loaded through Google Tag Manager, to measure use of the shop and sales. Microsoft Clarity (Microsoft Corporation), also loaded through Google Tag Manager, records how pages are used, such as clicks, scrolling, and pointer movement, in session recordings and heatmaps that help us improve the shop. Ahrefs Web Analytics (Ahrefs Pte. Ltd.) measures visits in aggregate, without cookies or identifiers stored in your browser. It receives technical data such as IP address, browser, device, page visited, and referring site, and records clicks on links and form submissions with the destination address, without what you typed.
• Advertising and attribution: Google Ads (conversion measurement and remarketing on Google, YouTube, and Google partner sites and apps), Meta Pixel (Meta Platforms, campaign measurement and audiences on Facebook and Instagram), TikTok Pixel (TikTok, campaign measurement and audiences on TikTok), Microsoft Advertising (Microsoft Corporation, conversion measurement and remarketing on Bing and Microsoft partner sites), LinkedIn Insight Tag (LinkedIn, campaign measurement and audiences on LinkedIn), and UTMify (attribution of sales to campaigns), loaded through Google Tag Manager. These tools may also query ipify (api.ipify.org), a public service that returns your IP address, to attribute the visit.
• Our own attribution cookies, set on the consylion.org domain and shared with consylion.org and app.consylion.org: a browser identifier (2 years), a session identifier (30 days), and the source of your first and last visit from a campaign (1 year and 90 days), with the campaign parameters described in section 2, the landing page, and the referring site.
• Video players: where the shop shows video testimonials, it only displays a cover image stored in the shop until you click. When you click, the YouTube player (youtube-nocookie.com, Google LLC) or the Panda Video player loads, receives technical data such as IP address, browser, and device, and may use its own cookies under its own privacy policy. UTMify may add your visit's campaign parameters to the player address.

For the collection and transmission of data through the Meta Pixel, we and Meta Platforms Ireland Ltd are joint controllers under Article 26 of the GDPR. Meta's Controller Addendum sets out each party's responsibilities, and Meta handles your rights for its own processing.

Visitors in the European Economic Area, the United Kingdom, and Switzerland, identified by the country of their connection or, when it is not available, by the browser's time zone, see a banner before Google Tag Manager and the analytics and advertising tools it loads (Google Analytics, Microsoft Clarity, Google Ads, Meta Pixel, TikTok Pixel, Microsoft Advertising, LinkedIn Insight Tag, and UTMify) can run. If you decline, Google Tag Manager, these tools, and our attribution cookies are not loaded, and declining removes attribution cookies already set. Your choice is stored in your browser for 12 months. You can change it at any time through the "Cookie settings" link at the bottom of every page, or by clearing this site's data in your browser, which brings the banner back on your next visit.

Ahrefs Web Analytics, which does not use cookies or store identifiers in your browser, is not covered by the banner and loads for every visitor, on the basis of our legitimate interests described in section 3. To block it, see section 5. Because this identification does not always match your location, you can also use the "Cookie settings" link and the options in section 5 wherever you are.

5. Your choices, including "Do Not Sell or Share My Personal Information"

We do not sell personal data for money. However, when Google Ads and the Meta Pixel run in your browser, the data they collect is used to show you Consylion ads on other sites and apps. Under the California Consumer Privacy Act (CCPA), as amended by the CPRA, this may count as "sharing" for cross-context behavioral advertising, and under other US state laws as "targeted advertising".

To opt out:

• use the "Cookie settings" link at the bottom of every page and choose Decline: Google Tag Manager, the analytics and advertising tools, and our attribution cookies stop loading in that browser;
• email dpo@consylion.org with the subject "Do Not Sell or Share". We will process your request and confirm when it is done;
• block or delete cookies and site data in your browser settings, use private browsing, or use a tracker blocker. Because Ahrefs does not use cookies, to block it, use a tracker blocker or block the analytics.ahrefs.com domain;
• install the Google Analytics opt-out browser add-on and adjust your ad settings in your Google account (My Ad Center, myadcenter.google.com) and in your Meta, TikTok, Microsoft, and LinkedIn accounts.

We do not upload customer lists to advertising platforms. If we start doing so, we will update this policy first and, in Europe, ask for your consent.

The shop honors the Global Privacy Control (GPC) signal as a valid request to opt out of the sale and sharing of personal data and of targeted advertising. If your browser sends it, Google Tag Manager, the analytics and advertising tools it loads, and our attribution cookies do not load, unless you choose to accept them in "Cookie settings". The signal applies to the browser that sends it; to opt out on other devices or for data linked to your email address, write to dpo@consylion.org. Blocking these tools does not prevent you from buying.

6. Who we share data with

We share personal data with the following recipients, only to the extent they need it:

• Digistore24 or another reseller named on the order form (see section 3 of the Terms of Use and Purchase), which processes your order, payment, invoice, taxes, and refunds as an independent controller;
• the providers that host and deliver your files and send emails about your order;
• Google, Meta, TikTok, Microsoft, LinkedIn, UTMify, and Ahrefs, for analytics, attribution and, in the case of Google, Meta, TikTok, Microsoft, and LinkedIn, advertising audiences, as described in section 4;
• YouTube (Google) and Panda Video, only when you click to watch a video;
• the shop's hosting and content delivery network (CDN) providers;
• our accountants, lawyers, and auditors, who are bound by confidentiality;
• public authorities, when required by law or by a court order.

7. International data transfers

Consylion is established in Brazil, and our providers process data in several countries, mainly the United States. Google, Meta, Microsoft, and LinkedIn process data mainly in the United States, and TikTok in several countries, including the United States. Ahrefs is based in Singapore and stores data in the United States. UTMify and Panda Video are based in Brazil. Personal data that we receive is processed by Consylion in Brazil. Digistore24 processes data in the European Union and the United States. The European Commission has recognized that Brazil provides an adequate level of data protection (Implementing Decision (EU) 2026/179 of 26 January 2026), so personal data can be transferred from the European Economic Area to Consylion in Brazil without additional safeguards.

When we transfer personal data from the European Union, the EEA, or the United Kingdom to a country without an adequacy decision, we rely on the safeguards provided for in Chapter V of the GDPR and the UK GDPR, such as the EU-US Data Privacy Framework for certified US providers, the European Commission's standard contractual clauses, and the UK International Data Transfer Addendum, or on the transfer being necessary to perform the contract you asked for. You can ask for information about these safeguards at dpo@consylion.org.

8. How long we keep your data

• Order records and related correspondence: up to 5 years after the end of the year of purchase, to meet tax and accounting obligations and to handle any claims.
• Shop access logs: 6 months.
• Data used for offers and email marketing: until you unsubscribe or withdraw your consent.
• Data stored in your browser: until you delete it or, for session storage, until the end of the session. Our attribution cookies last for the periods in section 4. Google and Meta cookies last for the periods set by those providers.

At the end of these periods, the data is deleted or anonymized.

9. Your rights

If you are in the European Union, the EEA, or the United Kingdom, under the GDPR or the UK GDPR you have the right to:

• access your personal data and receive a copy of it;
• have inaccurate or incomplete data corrected;
• have your data erased;
• restrict the processing of your data;
• receive your data in a structured, commonly used, machine-readable format;
• object to processing based on legitimate interests, and object at any time to direct marketing;
• withdraw your consent at any time, without affecting processing carried out before the withdrawal;
• lodge a complaint with a supervisory authority: in the EU or EEA, the data protection authority of your country (list at www.edpb.europa.eu); in the United Kingdom, the Information Commissioner's Office (ico.org.uk).

If you are in Switzerland, you have equivalent rights under the Federal Act on Data Protection and may complain to the Federal Data Protection and Information Commissioner (FDPIC).

We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. We reply within one month, which may be extended by two more months for complex requests, in which case we will tell you.

If you live in the United States, depending on your state of residence, laws such as the CCPA/CPRA in California give you the right to know what personal data we collect and how we use and disclose it, to access, correct, and delete it, and to opt out of its sale, sharing, or use for targeted advertising (see section 5). In the last 12 months we have collected the categories described in section 2: identifiers (such as name, email address, and IP address), commercial information (products bought), internet activity (pages visited and interactions with the shop), and approximate location derived from the IP address. We collected them for the purposes in section 3 and disclosed them to the recipients in section 6. In the last 12 months we have "shared" identifiers (cookie IDs and IP address) and internet activity with Google and Meta for cross-context behavioral advertising. We have not sold or shared the personal information of consumers we know to be under 16. We do not collect sensitive personal information. We will not discriminate against you for exercising your rights. You can use an authorized agent, and we will verify your request before acting on it. We reply within 45 days, as these laws require. Some of these laws apply only to businesses above certain size thresholds; we honor requests to know, access, correct, and delete from every US resident.

Wherever you live, you can ask us for access to, correction, or deletion of your personal data, or object to its use, and you have the rights that your local law grants you. Because Consylion is established in Brazil, Brazilian data protection law also applies to the data we process, and you can also lodge a complaint with the Brazilian data protection authority.

To exercise your rights, write to dpo@consylion.org. We may ask you to confirm your identity before we act on your request.

10. Security

The shop is served only over encrypted connections (HTTPS), payments take place on Digistore24's certified order form, and internal access to order data is limited to those who need it. If a personal data breach is likely to put your rights at risk, we will notify you and the competent authorities as required by applicable law.

11. Children

The products are intended for adults. We do not knowingly collect personal data from anyone under 18. If we learn that a minor made a purchase without the consent of a parent or guardian, we will arrange a full refund of the order and delete the data that is not required by law.

12. Changes

We may update this policy to reflect changes in the shop, in our providers, or in the law. The current version and its effective date are shown at the top of this page. We will announce significant changes in the shop and, to customers, by email.