Table of contents
- Scope and roles
- Definitions
- Where CobraDia is offered
- Data processed
- Legal basis
- Duty to inform Debtors and Collectors
- Identity documents and photos
- Addresses and geocoding
- Collector location
- Receipts sent by WhatsApp
- Lawful collection
- Prohibited uses
- Lawful lending and credit decisions
- Debtor rights
- Retention and deletion
- Hosting, security and incidents
- SonhoLab commitments and suspension
- Responsibility and liability Annex A. Debtor notice template Annex B. Collector notice template
1. Scope and roles
1.1 This Addendum applies to every organization that uses CobraDia, the daily collection System that SonhoLab offers at cobrodia.online.
1.2 It supplements the Terms of Service, the Data Processing Addendum (DPA) and the Acceptable Use Policy. For Debtor Data and Collector Data, this Addendum prevails over them if they conflict.
1.3 The Brazil Supplement (LGPD, CDC, Marco Civil, ECA Digital) and the Latin America Supplement also apply.
1.4 The Lender is the controller of Debtor Data and Collector Data. It decides why and how that data is processed.
1.5 SonhoLab is the processor ("operador", "encargado"). It processes Debtor Data and Collector Data only on the Lender's documented instructions (LGPD Art. 39) and under the DPA.
1.6 SonhoLab is the controller only for the Lender's own account and billing data, under the Privacy Policy.
2. Definitions
- Lender: the business that contracts for CobraDia and grants or collects the credits recorded in it.
- Collector: an employee or other person the Lender authorizes to use CobraDia to visit Debtors, record payments, expenses and cash closings.
- Debtor: a person who owes, or is said to owe, a debt to the Lender. It includes guarantors.
- Debtor Data: personal data about Debtors processed in CobraDia.
- Collector Data: personal data about Collectors and other users of the Lender processed in CobraDia, including their location under section 9.
- Receipt Link: the public web address in the form
/recibo/<token>that shows a payment receipt.
3. Where CobraDia is offered
3.1 Markets. CobraDia is offered to Lenders in Brazil and in Spanish-speaking Latin America, in particular Colombia, Peru and Mexico. It works with the currencies BRL, COP, PEN, USD and MXN.
3.2 Not for the United States. CobraDia is not offered to collect consumer debts from people in the United States. It does not support compliance with the Fair Debt Collection Practices Act, Regulation F or state collection-agency licensing. Lenders and collection agencies must not use it for that purpose.
3.3 Other countries. A Lender that uses CobraDia in any other country must comply with the data protection, consumer credit and debt collection laws of that country.
4. Data processed
4.1 Debtor Data: name, phone number, identity document number, photo of the identity document, photo of the Debtor, address and the map coordinates of that address, credits, installments, payments and delinquency status.
4.2 Collector Data: name, sign-in details, activity in CobraDia, and the last known position described in section 9.
4.3 Operations data: expenses and daily cash closings recorded by the Lender's users. These can identify the Collector who recorded them.
4.4 Minimum necessary. The Lender must record only what it needs for the credit and its collection. It should add identity document photos and Debtor photos only when it has a specific need to identify the Debtor.
4.5 No sensitive data. CobraDia is not designed to process sensitive data, such as health, religion, political opinion or biometric data. The Lender must not record it in notes or other fields.
4.6 No AI. The Free plan has no AI features. On paid plans, any AI feature works only with the Lender's own AI provider key, as described in the Terms of Service, section 12.2. That provider is the Lender's own vendor, not a SonhoLab subprocessor.
5. Legal basis
5.1 The Lender's duty. The Lender must have a valid legal basis for each use of Debtor Data and Collector Data under the law of the country where it lends or collects. SonhoLab does not choose the legal basis.
5.2 Brazil (LGPD). Typical bases are performance of the credit contract (LGPD Art. 7 V), protection of credit (Art. 7 X) and legitimate interest (Art. 7 IX), with a documented balancing test and the Debtor's legitimate expectations in mind. The data in section 4.1 is not sensitive personal data, so LGPD Art. 11 does not apply, provided that photos are not used for biometric identification (section 7.3). If the Lender ever processes sensitive data, it needs a basis under Art. 11.
5.3 Colombia. The Lender must obtain the Debtor's prior, express and informed authorization where Ley Estatutaria 1581 de 2012 requires it, and keep proof of it. Where it reports or consults credit information with credit bureaus (centrales de riesgo), it must also comply with the financial habeas data rules of Ley Estatutaria 1266 de 2008 and its amendments, including prior notice to the Debtor before negative information is reported.
5.4 Peru. Ley 29733 and its Reglamento (Decreto Supremo 016-2024-JUS) make consent the general rule, with exceptions set out in the law, such as data needed for a contractual relationship with the data subject. The Lender must check which applies and register its data bank with the Registro Nacional de Protección de Datos Personales where required.
5.5 Mexico. Under the Ley Federal de Protección de Datos Personales en Posesión de los Particulares of 2025, the Lender must make its privacy notice (aviso de privacidad) available to Debtors and obtain consent where the law requires it, unless an exception applies, such as data needed to fulfil the legal relationship between the Lender and the Debtor.
5.6 Collectors. The Lender processes Collector Data as employer or principal. It must have a legal basis for it under local labor and data protection law, including for the location data in section 9.
6. Duty to inform Debtors and Collectors
6.1 Debtors. At or before the moment it collects Debtor Data, the Lender must tell each Debtor, in clear language:
- who the Lender is and how to contact it;
- what data it records, including any identity document photo or Debtor photo;
- why it records it and on what legal basis;
- that SonhoLab hosts CobraDia for the Lender as its processor, on servers in Finland (EU), with an encrypted backup copy in Brazil;
- that the address is converted into map coordinates through OpenStreetMap Nominatim;
- that receipts may be sent to the Debtor by WhatsApp with a link;
- how long it keeps the data;
- how the Debtor can exercise their rights.
Annex A is a template. It does not replace advice on local law.
6.2 Collectors. Before a Collector uses CobraDia for the first time, the Lender must tell the Collector what data CobraDia records about them, including the last known position under section 9, why, who can see it and how long it is kept. Annex B is a template.
7. Identity documents and photos
7.1 Purpose. Identity document numbers, identity document photos and Debtor photos are used only to identify the Debtor correctly and to prevent fraud and impersonation. The Lender must not use them for any other purpose.
7.2 Storage and access. CobraDia stores these photos outside the public web folder of the website. They have no public address. CobraDia shows them only to signed-in users of the same Lender. The Lender decides which of its users can use CobraDia and must give access only to people who need it.
7.3 No biometric use. The Lender must not use photos for facial recognition, face matching or any other biometric identification. Doing so would turn them into sensitive biometric data, which this Addendum does not cover.
7.4 No other disclosure. The Lender must not copy, forward or publish identity document photos or Debtor photos, including on social media, in messaging groups or in debtor lists.
8. Addresses and geocoding
8.1 CobraDia converts Debtor addresses into map coordinates through the Nominatim service of the OpenStreetMap Foundation. The coordinates are used to plan collection routes.
8.2 Only the address is sent. CobraDia sends Nominatim only the address text. It never sends the Debtor's name, phone number, document number, photos or debt details.
8.3 CobraDia locates Debtors only through the geocoded address. It does not track Debtors' devices.
8.4 The OpenStreetMap Foundation is listed as a subprocessor for CobraDia in Subprocessors and International Transfers.
9. Collector location
9.1 What is recorded. While CobraDia is open on a Collector's device, CobraDia records the Collector's last known position. Each new position replaces the previous one.
9.2 No background tracking. CobraDia does not record the Collector's location when CobraDia is closed. It does not track Collectors in the background.
9.3 Purpose. The Lender may use the last known position only to organize collection routes and the safety of its Collectors during working hours. It must not use it to monitor Collectors outside work, or for hidden surveillance.
9.4 Prior notice. The Lender must inform each Collector in advance (section 6.2) and comply with the labor and data protection laws that apply to monitoring employees.
10. Receipts sent by WhatsApp
10.1 How it works. A user of the Lender can send a Debtor a payment receipt by WhatsApp. CobraDia prepares the message, which the user sends from the WhatsApp account on their own device. The message contains a Receipt Link. WhatsApp is not a SonhoLab subprocessor for this function.
10.2 What the Receipt Link shows. The Receipt Link opens a page with only the minimal data of that receipt: the Lender's name (and logo on paid plans), the client's first name, the amount paid, the date and time, and whether it was a full or partial installment. It never shows the outstanding balance, the remaining installments, the identity document, the address, the phone number or any photo. The link contains a random, unguessable token. Anyone who has the link can open it. The page is marked so that search engines do not index it (noindex), and access is rate-limited.
10.3 No exposure of the debt. The Receipt Link must never be used to reveal the debt to third parties beyond the minimal receipt data. The Lender and its Collectors must:
- send the receipt only to the Debtor's own phone number, or to another number the Debtor has indicated;
- never post the link in groups, on social media or in public places;
- never send it to the Debtor's family, neighbors, employer or references.
10.4 Messaging rules. The Lender is responsible for its WhatsApp account and for complying with WhatsApp's own terms and policies.
10.5 Private message to the Debtor. The text of the WhatsApp message itself (not the Receipt Link) may include the outstanding balance and the remaining installments, because it is a private communication to the holder of the debt about their own debt. The Lender and its Collectors may include them only if: (a) the message goes to the Debtor's own number registered in CobraDia, never to groups or third parties; (b) the message identifies the Lender and uses respectful language, with no threats, insults or labels such as "debtor in default"; (c) it is sent within the days, hours and frequency allowed by the law of the Debtor's country; and (d) the Debtor has not asked to stop receiving collection messages by that channel. If the Lender knows or suspects that the number is shared with other people, the message must not include the balance.
10.6 Contact windows applied by CobraDia. CobraDia applies default contact rules for each country, in the Debtor's local time: allowed days and hours, public holidays, at most one contact per day, at least 24 hours between contacts and at most three contacts per week (and, in Colombia, one channel per week). CobraDia blocks contacts outside these rules and keeps a record of each contact (date, time and channel). The Lender can mark a Debtor as "do not contact by WhatsApp" or "shared number". These defaults help but do not replace the Lender's own duty to comply with the law of the Debtor's country and state; the Lender may make them stricter, never looser. CobraDia does not place calls: it only opens the phone's dialer, so if the Lender calls Debtors, it is responsible for any rule that applies to calls, such as call recording where required (for example, in the State of São Paulo).
11. Lawful collection
11.1 General rule. The Lender is solely responsible for how it collects debts. It must comply with the debt collection and consumer protection laws of each country where it collects. This section sets out minimum principles. Where local law is stricter, local law applies.
11.2 Principles everywhere. When collecting through or with the help of CobraDia, the Lender and its Collectors must:
- treat Debtors with respect and never expose them to ridicule, embarrassment or threats;
- never use violence, threats, coercion, or false or misleading statements;
- never reveal the debt to third parties;
- contact Debtors only at reasonable times and through reasonable channels, and not so often that it becomes harassment;
- identify the Lender in every collection communication;
- take extra care with vulnerable Debtors, such as elderly, illiterate or over-indebted people.
11.3 Brazil. In consumer relationships, the CDC forbids exposing the consumer to ridicule or to any kind of embarrassment or threat when collecting a debt (CDC Art. 42). Collecting an amount that is not owed can oblige the Lender to repay double (CDC Art. 42, sole paragraph). Every collection document must show the supplier's name, address and CPF or CNPJ (CDC Art. 42-A). Using threats, coercion, false statements or any procedure that exposes the consumer to ridicule or unjustifiably interferes with their work, rest or leisure is a crime (CDC Art. 71). The rules on over-indebtedness also apply (Lei 14.181/2021).
11.4 Colombia. Where Ley 2300 de 2023 applies, the Lender must respect its limits on the days and hours of contact, the frequency of contact and the channels used. The Lender must follow the limits in force. Section 12.3 also applies in every case.
11.5 Peru. The Código de Protección y Defensa del Consumidor (Ley 29571), Art. 62, forbids abusive collection methods, such as those that affect the Debtor's reputation or privacy or disturb them at unreasonable times. INDECOPI enforces these rules. Lenders that are supervised financial entities must also follow the rules of the Superintendencia de Banca, Seguros y AFP.
11.6 Mexico. Where the Lender is a financial entity, or uses a collection agency, subject to the Ley para la Transparencia y Ordenamiento de los Servicios Financieros and to the rules of CONDUSEF on collection, it must comply with them. In every case, it must not use violence, threats or intimidation to collect.
12. Prohibited uses
The Lender and its users must not use CobraDia, Debtor Data or Collector Data to:
12.1 harass Debtors, including by repeated, abusive or night-time contact;
12.2 publish, display or share lists of debtors ("public shaming lists"), or share debt information on social media, in messaging groups or in public places;
12.3 contact a Debtor's family, neighbors, employer, co-workers or references about the debt;
12.4 threaten violence, criminal charges without basis, or seizure of property without a court order;
12.5 grant credit to, or collect from, minors;
12.6 collect amounts that are not owed, or add unlawful interest or charges;
12.7 use photos, identity documents or addresses for any purpose other than identification and lawful collection;
12.8 track Collectors in secret or outside the conditions in section 9;
12.9 sell or share Debtor Data with other lenders or third parties;
12.10 carry out usurious or unlicensed lending.
13. Lawful lending and credit decisions
13.1 Lawful loans. The Lender warrants that its credits are lawful where it operates, including interest-rate limits, licenses and registrations. In Brazil, usury is a crime (Lei 1.521/1951, Art. 4). In Colombia, interest above the usury rate certified by the Superintendencia Financiera is prohibited.
13.2 Decisions stay with the Lender. Any decision to grant, refuse or change credit is made by the Lender. If the Lender makes decisions based solely on automated processing of Debtor Data, it must meet the review and information duties of the law that applies, such as LGPD Art. 20.
13.3 Credit bureaus. If the Lender reports a Debtor to a credit bureau or registry, it must give the Debtor the prior notice the law requires (for example, CDC Art. 43 §2 in Brazil and Ley 1266 de 2008 in Colombia).
14. Debtor rights
14.1 Debtors exercise their rights (access, correction, deletion, information on sharing, objection, revocation of consent) with the Lender. The Lender must answer them within its legal deadline.
14.2 If SonhoLab receives a request from a Debtor or Collector, it forwards it to the Lender without undue delay and helps the Lender answer within its legal deadline (for example, 15 days under LGPD Art. 19 II).
14.3 If a Debtor complains to SonhoLab about abusive collection, SonhoLab forwards the complaint to the Lender and may act under section 17.3.
14.4 Deletion requests are subject to the Lender's legal duties to keep records. The Lender decides and explains its decision to the Debtor.
15. Retention and deletion
15.1 The Lender decides retention. SonhoLab keeps Debtor Data as the Lender instructs while the Lender's account is active. The Lender must keep data no longer than it needs.
15.2 Default for identity documents, photos and coordinates. Identity document photos, Debtor photos, identity document numbers and the map coordinates of the Debtor's address are deleted automatically, by a daily job, 90 days after the Debtor's last credit closed, provided the Debtor has no active or overdue credit. The Lender can set a different period between 7 and 3,650 days. The address text itself is not deleted by this job; it is kept with the Debtor's record as described in section 15.3.
15.3 Legal minimums are the Lender's responsibility. Records of credits, installments, payments, expenses and cash closings are kept as the Lender instructs. The Lender is responsible for any minimum period that accounting, tax, consumer or anti-money-laundering law sets for it.
15.4 Collector location. Only the last known position is kept, and each new position overwrites it (section 9). It is deleted together with the rest of the Lender's data (section 15.5).
15.5 Export and termination. The Lender can export its Customer Data as described in the Terms of Service, section 11.6. After a paid plan ends and is not replaced by the Free plan, or after the account is terminated, the data remains available for export for 30 days, and then SonhoLab deletes it from active systems (Terms of Service, section 19.4).
15.6 Backups. Database backups are kept up to 14 days on the server in Finland and up to 14 days in an encrypted off-site copy on equipment operated by SonhoLab in Brazil. Photos and identity-document images travel in that same daily encrypted off-site copy, in addition to the database backup. Deleted data disappears from backups as they expire, within 30 days at most.
15.7 Logs. Server access logs, including visits to Receipt Links, are kept 6 months (Marco Civil Art. 15), and up to 12 months for security investigations.
16. Hosting, security and incidents
16.1 Hosting. CobraDia is hosted by Hetzner Online GmbH in Helsinki, Finland (EU). The encrypted off-site backup copy is kept in Brazil (section 15.6). Transfers are covered as described in Subprocessors and International Transfers.
16.2 Security. SonhoLab applies the measures in Security and Incident Response, including TLS in transit, per-organization logical isolation, photos kept outside the public web folder and served only to signed-in users of the same Lender, encryption of off-site backups, access limited to named personnel, rate limiting and access logs. CobraDia does not offer multi-factor authentication. SonhoLab holds no security certification (no SOC 2 or ISO 27001).
16.3 Impact assessment. Processing identity documents, photos, addresses and financial data about third parties may require a data protection impact assessment (for example, LGPD Art. 38). On request, SonhoLab gives the Lender the information it needs about processing, data flows, subprocessors and security.
16.4 Breach notice. SonhoLab notifies the Lender of a personal data breach affecting Debtor Data or Collector Data without undue delay, with a target of 48 hours and no later than 72 hours after confirming it. The Lender handles notices to authorities and data subjects within its own legal deadlines, some of which are short (for example, in Peru). SonhoLab helps.
17. SonhoLab commitments and suspension
17.1 Commitments. SonhoLab processes Debtor Data and Collector Data only to provide CobraDia to the Lender. It does not sell that data, does not use it for its own purposes, does not share it for advertising and does not train AI models on it.
17.2 Subprocessors. For Debtor Data and Collector Data, CobraDia uses only Hetzner Online GmbH (hosting, Finland) and the OpenStreetMap Foundation (Nominatim geocoding, address text only). CobraDia does not process money: Debtor payments are only recorded. Paid-plan subscriptions are billed through SonhoLab's central billing, which receives no Debtor Data. SonhoLab gives advance notice of new subprocessors under the DPA.
17.3 Suspension. SonhoLab may suspend or terminate a Lender's access, under the Terms of Service and the Acceptable Use Policy, if it has reasonable grounds to believe that the Lender uses CobraDia for illegal lending, abusive collection or any use prohibited in section 12. Where the law allows, SonhoLab gives the reasons.
18. Responsibility and liability
18.1 The Lender's responsibility. The Lender is solely responsible for its credits, interest, collection practices, notices to Debtors and Collectors, legal bases and retention decisions, and for the conduct of its Collectors.
18.2 Indemnity. The Lender indemnifies SonhoLab under the Terms of Service, section 22, for claims, fines and penalties arising from its lending or collection practices or from a breach of this Addendum.
18.3 LIMITATION. TO THE MAXIMUM EXTENT PERMITTED BY THE LAW THAT APPLIES, SONHOLAB IS NOT LIABLE FOR THE LENDER'S LENDING OR COLLECTION PRACTICES, FOR MESSAGES THE LENDER OR ITS COLLECTORS SEND, OR FOR DAMAGE CAUSED BY THEIR BREACH OF THIS ADDENDUM. IN ALL OTHER CASES, THE LIMITS IN THE TERMS OF SERVICE, SECTION 21, APPLY.
18.4 Data subjects. No limitation in this Addendum reduces the rights of Debtors or Collectors under data protection or consumer protection law.
Nothing in this Addendum excludes or limits rights that cannot be excluded or limited under the law that applies to you.
Annex A. Debtor notice template
The Lender adapts this notice to its country and gives it to each Debtor. It does not replace legal advice.
How [Lender name] uses your information
[Lender name], [tax ID], [address], records your credit in a system called CobraDia, provided by SonhoLab.
- What we record: your name, phone, identity document number, address and its map location, your credit, installments, payments and balance. [Add only if collected: a photo of your identity document and a photo of you.]
- Why: to manage your credit, identify you, plan collection visits, send you receipts and meet our legal duties. Legal basis: [basis].
- Who processes it: SonhoLab hosts the system for us, as our processor, on servers in Finland (EU), with an encrypted backup copy in Brazil. To locate your address on a map, only the address is sent to OpenStreetMap. We do not sell your information.
- Receipts: we may send you receipts by WhatsApp with a link that shows only the receipt. We send it only to your number.
- How long: your identity document data, photos and map location are deleted 90 days after your last credit with us closed, if you have no other active or overdue credit, unless the law requires us to keep them longer. Credit and payment records are kept for [period].
- Your rights: you can ask us to access, correct or delete your information, or to explain how we use it. Contact: [Lender contact].
- Fair treatment: we will not embarrass or threaten you, contact your family, neighbors or employer about the debt, or publish your name.
Annex B. Collector notice template
The Lender adapts this notice to its country and gives it to each Collector before first use.
Your data in CobraDia
- What is recorded: your name, sign-in details, the payments, expenses and cash closings you record, and your last known position while CobraDia is open on your device.
- Location: CobraDia keeps only your last position, and only while the app is open. It does not track you when CobraDia is closed.
- Why: to organize collection routes and cash control, and for your safety during working hours.
- Who can see it: [roles] at [Lender name]. SonhoLab hosts the system as our processor.
- Your rights and contact: [Lender contact].
Version 0.9.0 (preliminary) · Effective 28 September 2026 · © L. M. PEREZ MONTANA (SonhoLab), CNPJ 61.620.014/0001-00. This version is under legal review; we will notify material changes as described in these documents.