Diego Castro and Carol Paranhos
Lawyers in charge · direct contact with who signs the work
Legal checklist for launching a SaaS or app in Brazil: terms of service and privacy notice in Portuguese, consumer law, auto renewal, LGPD and B2B contracts.
Terms of service in Portuguese that match your checkout, plans and cancellation flow.
Consumer law check for free trials, auto renewal and the 7 day right of withdrawal.
Privacy notice and cookie banner that meet the LGPD without rebuilding your global stack.
B2B subscription agreement and DPA for Brazilian enterprise customers.
Online meetings in English · Attorney client confidentiality · Brasília time business hours
To launch a SaaS in Brazil, a foreign company needs terms of service and a privacy notice in Portuguese adapted to Brazilian law, a subscription flow that respects the Consumer Defense Code (clear renewal, easy cancellation and the 7 day withdrawal right), LGPD compliance including an encarregado (DPO) and transfer mechanism, B2B contracts and DPAs for enterprise customers, and a trademark filed at the INPI.
US terms translated to Portuguese
Risk ·Foreign forum and liability waivers void against Brazilian consumers.
Action ·Rewrite the clauses that do not survive Brazilian consumer law.
Free trial that converts to a paid plan
Risk ·Unexpected charges, Procon complaints and refund disputes.
Action ·Renewal notice, visible cancellation and refund rules in the terms.
Data hosted in the US
Risk ·LGPD transfer without a valid ANPD mechanism.
Action ·Transfer disclosure in the notice and Brazilian SCCs in contracts.
App or game likely to be used by minors
Risk ·Digital ECA duties ignored: age assurance, parental tools and a legal representative in Brazil.
Action ·Product review against Law 15,211/2025 before the Brazilian launch.
Enterprise customer in Brazil
Risk ·Customer paper with unlimited liability and local forum.
Action ·Brazilian MSA and DPA with caps and dispute rules you can live with.
Product name not registered in Brazil
Risk ·A local company registers the name first at the INPI.
Action ·Clearance search and filing before the public launch.
Translation is a start, but several common clauses are void against Brazilian consumers, such as foreign forum only and broad liability waivers. They need to be adapted.
Consumers can withdraw within 7 days of an online purchase and get the amount back (CDC, art. 49). Your refund policy should reflect that.
Not to start. Many companies sell from abroad first. A local entity becomes relevant for invoicing, local payments, enterprise deals and hiring.
No. Trademark rights in Brazil come from registration at the INPI, directly or through the Madrid Protocol. File before you launch.
It applies to products aimed at or likely to be accessed by minors in Brazil, including foreign ones. Games, edtech and social apps should assume it does until reviewed.
The E-commerce Decree requires an effective support channel, and information must be clear to the consumer. In practice, Portuguese support prevents most escalations to Procon.
If your company is already dealing with any of these situations, the next step is a short call about the facts.
Online meetings in English · Attorney client confidentiality
Brazil is a large and fast growing software market, and also a market where consumer complaints are public and frequent. The legal launch is a short list of documents that must describe your product as Brazilian users experience it.
Your global terms adapted to Brazilian law, not just translated: plans, billing, renewal, cancellation, acceptable use, liability and dispute resolution.
Rules for free trials, automatic renewal, price changes and refunds that hold up with Procon and in small claims courts.
LGPD privacy notice in Portuguese built from your real data flows, plus a cookie notice consistent with the banner shown to Brazilian visitors.
Master subscription agreement or order form for Brazilian companies, with SLA, liability caps and renewal rules that Brazilian procurement teams accept.
Data processing agreement under the LGPD, with Brazilian standard contractual clauses when customer data leaves Brazil.
Trademark clearance and filing at the INPI so your product name is protected in Brazil before local competitors or resellers register it.
A short, launch ready package. Each document has a Portuguese version to publish and an English working copy for your team.
Scope and fees are set in an individual written proposal, as required by the Brazilian Bar (OAB).
Adapted to the CDC, the Internet Act and your real checkout and cancellation flow.
LGPD notices with legal bases, encarregado contact and transfer disclosure.
Trial, renewal, price change and the 7 day withdrawal written the way billing works.
For Brazilian enterprise customers, with SLA, caps and data processing terms.
Checkout, renewal email and cancellation screen texts that repeat the rules of the terms.
Short list of points to fix before launch, ranked by consumer and LGPD risk.
Translation keeps the words. Adaptation keeps the protection. The difference shows up in the first Procon complaint or chargeback dispute.
Forum only in Delaware or California, void against Brazilian consumers.
No mention of the 7 day right of withdrawal.
Broad liability waivers that the CDC treats as abusive.
Renewal and cancellation rules that do not match the checkout.
Privacy notice without encarregado contact or transfer disclosure.
Brazilian forum option for users and arbitration only where valid.
Withdrawal and refund rules stated clearly.
Limitations highlighted and drafted to survive CDC review.
Same rules in pricing page, checkout, emails and terms.
Portuguese privacy notice aligned with your global policy.
Tick what you already have. Each open item is a point where Brazilian consumer law, the LGPD or a local customer can create friction after launch.
Brazilian law applies to services offered to users in Brazil, even when the provider is abroad. These are the points that most often create problems for foreign SaaS and apps after launch.
The Brazilian Internet Act applies Brazilian law to data collection and processing when at least one device is in Brazil, including for foreign companies that offer services to the Brazilian public (art. 11). Its article 8 voids adhesion clauses that do not offer users a Brazilian forum for disputes about services provided in Brazil. Terms that only point to Delaware or California courts will not stop a Brazilian user from suing at home.
When the user is a consumer, the Consumer Defense Code applies. It requires clear information in Portuguese (art. 31), voids clauses that waive consumer rights (art. 51) and requires limitations of rights to be highlighted (art. 54). Consumers can file complaints with the Procons, on the consumidor.gov.br platform and in small claims courts at low cost. Clear terms and a working cancellation flow prevent most of them.
Article 49 of the CDC gives consumers 7 days to withdraw from purchases made outside a physical store, which includes online subscriptions, with a refund of amounts paid. The E-commerce Decree 7,962/2013 adds mandatory seller information and support duties. For subscriptions, the safest design is a renewal reminder, a visible cancellation option and terms that describe exactly what the checkout does.
Contracts between companies benefit from freedom of contract and a presumption of parity (Civil Code, arts. 421 and 421-A). Liability caps, SLAs and auto renewal are generally accepted when clearly agreed. Small business customers may still claim consumer protection when they are vulnerable compared to the provider, so B2B terms aimed at very small companies deserve extra care.
A SaaS that collects personal data from users in Brazil is subject to the LGPD, even if the data is hosted abroad. That means a Portuguese privacy notice, legal bases for each purpose, an encarregado (DPO), a request channel and, for data leaving Brazil, a valid transfer mechanism.
Many SaaS companies start selling to Brazil from abroad and open a Brazilian entity later. The choice affects invoicing, local payment methods such as Pix and boleto, withholding taxes paid by Brazilian business customers and which party appears in your terms. We flag these points so your accountant and tax advisor can confirm the structure.
Since March 17, 2026, the Digital Statute of Children and Adolescents (Law 15,211/2025) applies to digital products and services aimed at, or likely to be accessed by, minors in Brazil, including foreign ones. It requires age assurance, parental supervision tools and protective default settings, bans loot boxes in games aimed at minors and requires foreign providers to keep a legal representative in Brazil. Sanctions go up to R$ 50 million per infraction. Games, edtech, social and creator apps should check it before launch.
Brazilian consumers check complaint platforms such as Reclame Aqui and consumidor.gov.br before buying, and companies that answer there are seen as more trustworthy. Clear terms, a Portuguese support channel and a cancellation flow that works reduce both complaints and legal risk, because the same issues that reach Procon usually appear first on these platforms.
You are translating the product into Portuguese or pricing in reais.
Brazilian users are already signing up through organic traffic.
Support is receiving refund and cancellation requests from Brazil.
A Brazilian enterprise customer asked for a contract in Portuguese or a DPA.
You received a complaint on consumidor.gov.br, Reclame Aqui or from a Procon.
A local partner or reseller wants to sell your product in Brazil.
A video call where you show the signup, checkout, plans and cancellation flow as a Brazilian user would see them.
We list the documents needed for your launch, with deadlines and fees in a written proposal.
Portuguese documents with English working copies, validated with your product, billing and support teams.
Guidance on where to publish each document, how to collect acceptance and how to version future changes.
These criteria help decide whether to do it now or after testing the market.
Answers for foreign SaaS, app and ecommerce companies preparing to sell in Brazil.
For consumers, in practice yes. The Consumer Defense Code requires information about products and services in Portuguese, and terms that Brazilian users cannot understand are a weak defense in any complaint. B2B contracts can be in English if both parties agree, but enterprise customers often ask for a Portuguese version.
Yes, when the SaaS offers services to consumers in Brazil. The Consumer Defense Code and the Brazilian Internet Act apply to services offered to the Brazilian public, and consumers can sue in Brazil regardless of the forum clause in your terms.
Yes, if it is clearly informed before payment and the user can cancel easily. Hidden renewals, hard to find cancellation and charges after cancellation are among the most common reasons for consumer complaints and Procon fines.
Article 49 of the Consumer Defense Code applies to contracts made outside a physical store, which includes online subscriptions. The consumer can withdraw within 7 days and receive a refund. The application to digital content already used is debated, so the terms should state the rule clearly.
Against Brazilian consumers, no in practice. The Internet Act voids adhesion clauses that do not offer a Brazilian forum for disputes about services provided in Brazil, and consumers can sue at their domicile. For B2B contracts, arbitration or a foreign forum can work.
A privacy notice in Portuguese, a legal basis for each purpose, an encarregado (DPO), a channel for data subject requests, security measures, a DPA with business customers when you act as processor and a valid mechanism for transfers of Brazilian data abroad.
For a product with a standard signup and subscription flow, usually a few weeks, depending on how fast the product team can share screens and data flows. The timeline is confirmed in the proposal.
Brazilian Bar rules require individual fee agreements, so there is no generic price list. After the product walkthrough we send a written proposal with the document list, the deadline for each delivery and the fees.
The Digital ECA (Law 15,211/2025), in force since March 17, 2026, protects children and teenagers online. It applies to digital products aimed at or likely to be accessed by minors in Brazil, including foreign providers, which must keep a legal representative in the country. Duties include age assurance, parental tools and protective defaults.
Yes, when selling online to consumers. The E-commerce Decree 7,962/2013 requires the seller's name, registration number, physical and electronic address and contact details in a visible place, plus clear information about the offer, total price and conditions before payment.
// about the firm
Diego Castro Advogado is a Brazilian law firm focused on data protection (LGPD), contracts and technology law for digital businesses. The lawyer in charge is Diego Castro, admitted to the Brazilian Bar under OAB/PI 15.613, with a postgraduate degree in Digital Law and author of the book "Termos de Uso sem mistério" on terms of use. The firm has an office at Av. Brigadeiro Faria Lima, 1181, São Paulo, and a base in Teresina, Piauí, and works with foreign companies by video call in English. It advises on Brazilian law only and coordinates with the client's home counsel when the matter also involves foreign law.
By Diego Castro, OAB/PI 15.613 · Published · Updated · 16 min read
// legal sources
Reviewed against the Consumer Defense Code, the E-commerce Decree, the Brazilian Internet Act, the Civil Code and the LGPD. Information only. Each product, billing model and audience needs its own analysis; get advice from a Brazilian lawyer before launching.
Tell us what you sell, who your users in Brazil are and which document or decision is on the table. We reply in English with the next step and, when it makes sense, a written proposal before any work starts.
Online meetings in English · Video calls across time zones
Message us on WhatsApp
