PT-BR EN

Privacy Policy

Last updated: 03/08/2026

On this page

Who controls this data
Data from store visitors and customers (web and app)
Data from admin panel staff (web and app)
Cookies and local storage
Third-party services
What we use data for
How long we keep data
How we protect data
Your rights (LGPD)
Contact

1. Who controls this data

This policy describes how Móveis3B (CNPJ 00.000.000/0001-01, a Brazilian company registration number) handles personal data collected through the website (moveis3b.com) and the Móveis3B Android app, which talk to the same API and the same databases. Anything that applies to "the website" in this policy also applies to the app, and vice versa, except where explicitly noted otherwise.

2. Data from store visitors and customers (web and app)

2.1 Just browsing the catalog (no account)

We collect as little as possible: a technical session identifier (cookie), an anti-fraud token (CSRF), and, stored only in your own browser, the products you add to your cart — this never reaches our servers until you place an order. See the cookies section for details.

2.2 When you place an order on the website or the app

To process an order, we collect:

Data	What it's for
Name	Identifying the order
E-mail	Order confirmation and contact
ZIP/postal code (CEP)	Shipping cost calculation
Chosen payment method	Order processing (we do not integrate a third-party payment gateway — no card data is ever entered or stored in this system)
Order items	Fulfillment and invoicing

2.3 Registered customers (in-store purchase / customer service)

When you're registered as a customer by one of our staff (e.g. an in-person store sale), we store: your CPF (Brazilian taxpayer ID), name, phone number, e-mail and full address (postal code, street, number, complement, neighborhood, city, state). This record is used to identify future purchases and to meet our tax obligations.

2.4 Android app — what's different

The app talks to the same API as the website, so it collects the same data described above when you browse the catalog or place an order. The app does not request or access location, contacts, camera, photo gallery, or any other device data — it only uses what's needed to display the catalog and process orders/login.

3. Data from admin panel staff (web and app)

For staff with panel access (our internal team), we process additional data needed to operate the store securely:

Account: name, e-mail, username and password (always stored hashed, never in plain text).
Two-factor authentication (2FA/TOTP): when enabled, we store the TOTP secret and the hashes of the single-use backup codes — never the code itself.
Preferences: light/dark theme choice.
Security and audit: IP address, device type (phone/tablet/computer, detected from the browser's or app's user-agent), timestamp of each access, and a log of actions taken in the panel (what, who, when). This lets us detect unauthorized access, remotely end sessions, and meet information-security obligations.

4. Cookies and local storage

Name	Used by	Duration	Purpose
`PHPSESSID`	Everyone (store and admin panel)	Browser session	Essential — keeps you logged in / identifies your cart during the visit. HttpOnly, Secure, SameSite=Lax.
`m3b_remember`	Admin panel staff only	90 days	"Keep me signed in" option. HttpOnly, Secure, SameSite=Lax; the value is rotated on every use to reduce the impact of a stolen cookie.
Cart (`localStorage`)	Store visitors (web)	Until you clear your browser	Keeps cart items only on your device — it is not a cookie and is never sent to the server until checkout.

We do not use advertising cookies, cross-site tracking, or third-party analytics.

5. Third-party services

We do not sell or share your data with third parties for marketing purposes. We use the following external, strictly operational services:

Google Fonts and Font Awesome (cdnjs/Cloudflare) — load fonts and icons; these providers may log the IP address of the request, as any externally-loaded browser resource would.
ViaCEP — when a staff member types a postal code (CEP) into an address form, that CEP (no other personal data) is sent to this public lookup service to auto-fill the address.
IBGE (Brazilian government public data) — used only to list municipalities by state; no personal data is sent.

6. What we use data for

Processing, delivering and supporting orders;
Allowing staff to log in and use the admin panel (web and app);
Preventing fraud and abuse (login attempt limits, audit logging, session detection);
Meeting legal, tax and accounting obligations.

7. How long we keep data

Customer and order data is kept for as long as needed for business, tax and warranty purposes. Access and audit logs are retained for as long as needed to investigate security incidents. Database backups follow a standard 7-day retention policy.

8. How we protect data

Staff passwords are never stored in plain text, always hashed;
CSRF protection on actions that change data;
Per-IP rate limiting on login, 2FA and password recovery;
All database queries use parameterized statements, preventing SQL injection;
Uploaded files (favicon, fonts, images) are validated by their actual file content, not just their extension;
Sensitive cookies are marked HttpOnly, Secure and SameSite.

9. Your rights (LGPD)

Under Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), you may request at any time: confirmation that we process your data, access to it, correction of incomplete or outdated data, anonymization/deletion of unnecessary data, data portability, and information about who we share your data with. To exercise any of these rights, use the contact details below.

10. Contact

Questions about this policy or your data can be sent to marketing@moveis3b.com or by phone/WhatsApp at (66) 99677-1515

We may update this policy from time to time to reflect changes to the website, the app, or the law. The date at the top of this page reflects the latest version.