Proteside Privacy and LGPD
What the SDK collects in the customer's browser, what it never collects, how it transmits data and how long data is kept.
The SDK runs in your customers' browsers, so it's natural to ask what data it sends. In short: technical metadata about the page and its scripts, never payment data or anything the customer types. This page details each point so you can review it with your data protection officer (DPO) or legal team.
What is never collected
- Form field values. The SDK never reads what the customer types. For sensitive fields, it records only which script added a listener, the field type and the event type.
- Keystrokes.
- Payment data: card number, CVV, Pix key, copy-and-paste code, crypto address, VPA and boleto digit line. The payment code read on the page stays in memory only, in the browser, as a reference for comparison.
- Clipboard content. Only the length of the copied text is sent.
- Request bodies. For exfiltration detection, only the names of the patterns found (for example, "card" or "CPF") and the body size are sent.
- Script source code. Only the SHA-256 hash of the content is sent.
- The values of your rules and trusted recipients. They only travel as hashes.
On top of that, the SDK applies automatic redaction before sending: fields with names such as pan, cvv,
cardNumber, pixKey, password, token, secret, amount, key and address become [REDACTED], and values
that are entirely a card number, CPF, CNPJ, email address or a 3- to 4-digit code are also replaced.
What is collected
| Data | Detail |
|---|---|
| Page | Full page URL (pageUrl) and path. |
| Visit source | Full document.referrer, in the PAGEVIEW event. |
| Browser | User agent, truncated to 100 characters, and page load time. |
| Session | A random identifier generated on every page load. It doesn't identify the customer and isn't persisted. |
| Scripts | Address (origin and path, without query string), content hash, size, classification and whether it uses integrity or nonce. |
| Detections | Event type, technical selectors of the elements involved (for example, input#cpf, never the value) and destination domains. |
| Security headers | Values of the page's security headers (CSP, HSTS and others). Set-Cookie is never read. |
| Version | SDK version and channel. |
The visitor's IP address reaches Proteside's servers with every request, as with any web access, and is used to limit API abuse.
Don't put personal data in the checkout URL
The SDK sends the full page URL, including query string and fragment, and the full referrer. If your checkout
uses parameters such as ?email=customer@example.com, ?cpf=… or session tokens in the URL, those values are sent
to Proteside: automatic redaction doesn't detect them inside a URL. Keep personal data and tokens out of your
payment page URLs.
Browser storage
- The SDK doesn't set cookies or write to
localStorage. - It uses a single
sessionStorageentry (__prote_card_pending__), with the payment provider's name and a timestamp, valid for 10 minutes. It's used to confirm a card payment on the confirmation page. - The store's configuration stays in memory while the page is loaded.
Transport
- All traffic goes over HTTPS to
app.proteside.com. - Events are grouped in batches of up to 50 and sent roughly every 5 seconds, and when the customer leaves the page
(via
sendBeacon). - On a temporary server or network error, the SDK retries the same batch up to 3 times. Events that can't be sent are discarded; the checkout never waits for delivery.
Retention
Events are kept according to the store's plan and then deleted automatically:
| Plan | Retention |
|---|---|
| Essential | 30 days |
| Standard | 90 days |
| Growth | 180 days |
| Pro | 365 days |
Once events expire, SDK Health and Payment Integrity may show empty states again for older periods. See the plans in Billing.
LGPD
Proteside is designed to minimize personal data: what travels is technical metadata, hashes and the page URL. The points that need attention are the full URL and referrer, the user agent and the IP address. Check with your legal team whether your privacy policy should mention the use of a checkout security tool.