Data Protection Act | Isadora Novo potfolio

Fintech B2C Project (12/2025)

How I identified that an exposed financing value on the interface revealed the profile of 76,800 customers & how I brought the product into data protection compliance

Client : A global leader in telecommunications and mobile devices

Role

UX/UI Designer

Duraction

9 days

Responsibilities

Information Architecture
UX Strategy

Design decisions
high-fidelity prototype

Context

Financing platform used by salespeople in physical stores to simulate and close phone financing sales for end customers.

My Role : UX/UI Designer responsible for identifying and proposing sensitive-data protection in the interface System.

Problem

Because the system handles financing simulation and closing, salespeople had direct interface access to several pieces of the customer’s personal data during service. With the requirements of Brazil’s LGPD (General Data Protection Law), the platform needed to come into compliance identifying which data displayed in the interface should be protected or hidden, and how.

Information design

The challenge is Deciding what to show, what to hide, and how to do it without breaking the salesperson’s ability to properly serve the customer during simulation and financing closure.

Process

Desk research

Alongside the Product Owner, who needed to answer a central question:
Which data used on the platform is considered sensitive under LGPD, and which should be hidden or protected in the interface?

Captura de Tela 2026-07-24 às 11.26.53.png

According to the General Data Protection Law (GOV), data is divided into personal data and sensitive personal data.

Personal data is any information that allows for the direct or indirect identification of a natural person.

Personal

First and last name;
Date and place of birth;
ID number and CPF number;
Home address and email address;
Photograph;
Cell phone number

Bank data

Bank card number;
income and payment history;
consumption habits;tracking data

Tracking data

Location data
The location services feature on a cell phone
P (Internet Protocol) address and cookies;

Sensitive data those related to children and adolescents; and the “sensitive” ones, which are those that reveal:

Racial or Ethnic origin,
Religious or Philosophical beliefs,
Political opinions or Union membership,
Genetic conditions or Biometric,
Health, or Sexual life information.

See article

Captura de Tela 2026-07-25 às 11.05.15.png

Captura de Tela 2026-07-25 às 11.05.11.png

In an article on LGPD compliance written by May Cruz, I found a checklist of best practices that helped me with the product and provided some insights.

Regarding Data Collection

Key Takeaways

Collect only data that is relevant for the service/product
Make it clear what data is being collected, will be used for, & whom it will be shared;
The opt-in box must always be unchecked. The user must take affirmative action to accept.
Company is responsible for any user data,
Sensitive data could cause embarrassment, financial loss, or some form of discrimination for the user.

Customer and Business Obligations

Users must be free to:

Accept or decline the terms of consent;
Revoke data sharing;
Cancel their account at any time.

Terms of consent

Must be freely given, unambiguous, specific, and prominently displayed;
Acceptance is not mandatory.
The Privacy Policy and Terms of Use must be mandatory, as they are essential to the product’s business model.

See article

Design Decision

During my research, I found that the classification of “sensitive data” could not be limited to the obvious, already-known categories; rather, it was necessary to interpret the context in which the salesperson’s interface was displayed.

The approved credit amount and down payment amount for the customer. On its own, this data point doesn’t fall under LGPD’s traditional sensitive categories.

However, since it is displayed directly on the screen visible to the salesperson or others standing near the screen in the store it allows the customer’s purchasing power to be assessed and, based on that, the way the customer is treated during the sales interaction to be adjusted.

This understanding expanded the project’s scope: beyond the “obvious” sensitive data, I also mapped data that became sensitive or generated improper inferences because of the context and visibility of its exposure in the interface.

Prototype

I built a high-fidelity prototype in Figma with the simulation and financing-closure flow screens already adjusted, showing
sensitive data properly protected/hidden.

Solution

The result was a set of interface guidelines applied across the financing flow’s screens, covering:

sensitive data and data that generated improper inferences due to exposure context.
A display/hide pattern the development team could implement consistently.

Before

After

GravacaodeTela2026-07-25as17.46.52-ezgif.com-video-to-gif-converter.gif

Such as the approved financing amount, which became hidden by default on the salesperson’s screen, preventing the customer’s purchasing power from being inferred at a glance and influencing how they were treated during service

See prototype

Results & Impact

The platform maintained 76,800 processed financing simulations, resulting in 4,105 approved contracts.

This means the ≈5.3% conversion rate reflects the service’s performance without any bias in customer treatment based on perceived purchasing power.

Recognition

After developing this work, I was invited to present at TechKnowledge Talks, with the theme “LGPD used to data interpretation on user interface”.

A live event for the entire computing department, with attendees from the company’s 4 headquarter cities.

I shared with the team the contextual interpretation needed to apply the law in practice.

Captura de Tela 2026-07-27 às 00.06.17.png

Key Learnings

This project taught me that data protection isn’t a fixed list of categories it’s a matter of exposure context. A data point that seems harmless in isolation can become sensitive depending on where and to whom it’s displayed.

That shift in perspective, from “legal checklist” to “contextual analysis,” is what most elevated the quality of the delivered solution.

How I identified that an exposed financing value on the interface revealed the profile of 76,800 customers & how I brought the product into data protection compliance

GravacaodeTela2025-01-06as02.21.31-ezgif.com-video-to-gif-converter (1).gif

How I identified that an exposed financing value on the interface revealed the profile of 76,800 customers & how I brought the product into data protection compliance

Role

Duraction

Responsibilities

Information Architecture

UX Strategy

Design decisions

high-fidelity prototype

Context

Financing platform used by salespeople in physical stores to simulate and close phone financing sales for end customers.

My Role : UX/UI Designer responsible for identifying and proposing sensitive-data protection in the interface System.

Problem

Information design

Process

Desk research

Alongside the Product Owner, who needed to answer a central question: Which data used on the platform is considered sensitive under LGPD, and which should be hidden or protected in the interface?

According to the General Data Protection Law (GOV), data is divided into personal data and sensitive personal data.

Personal data is any information that allows for the direct or indirect identification of a natural person.

Personal

First and last name;

​Date and place of birth;

ID number and CPF number;

Home address and email address;

Photograph;

Cell phone number

​

Bank data

Bank card number;

income and payment history;

consumption habits;tracking data

Tracking data

Location data

The location services feature on a cell phone

P (Internet Protocol) address and cookies;

Sensitive data those related to children and adolescents; and the “sensitive” ones, which are those that reveal:

Racial or Ethnic origin,

Religious or Philosophical beliefs,

Political opinions or Union membership,

Genetic conditions or Biometric,

Health, or Sexual life information.

In an article on LGPD compliance written by May Cruz, I found a checklist of best practices that helped me with the product and provided some insights.

Regarding Data Collection

Key Takeaways

Collect only data that is relevant for the service/product

​Make it clear what data is being collected, will be used for, & whom it will be shared;

The opt-in box must always be unchecked. The user must take affirmative action to accept.

Company is responsible for any user data,

Sensitive data could cause embarrassment, financial loss, or some form of discrimination for the user.

Customer and Business Obligations

Users must be free to:

Accept or decline the terms of consent;

Revoke data sharing;

Cancel their account at any time.

​

Terms of consent

Must be freely given, unambiguous, specific, and prominently displayed;

Acceptance is not mandatory.

The Privacy Policy and Terms of Use must be mandatory, as they are essential to the product’s business model.

Design Decision

During my research, I found that the classification of “sensitive data” could not be limited to the obvious, already-known categories; rather, it was necessary to interpret the context in which the salesperson’s interface was displayed.

The approved credit amount and down payment amount for the customer. On its own, this data point doesn’t fall under LGPD’s traditional sensitive categories.

However, since it is displayed directly on the screen visible to the salesperson or others standing near the screen in the store it allows the customer’s purchasing power to be assessed and, based on that, the way the customer is treated during the sales interaction to be adjusted.

This understanding expanded the project’s scope: beyond the “obvious” sensitive data, I also mapped data that became sensitive or generated improper inferences because of the context and visibility of its exposure in the interface.

Prototype

I built a high-fidelity prototype in Figma with the simulation and financing-closure flow screens already adjusted, showing sensitive data properly protected/hidden.

Solution

The result was a set of interface guidelines applied across the financing flow’s screens, covering:

sensitive data and data that generated improper inferences due to exposure context.

A display/hide pattern the development team could implement consistently.

Before

After

Such as the approved financing amount, which became hidden by default on the salesperson’s screen, preventing the customer’s purchasing power from being inferred at a glance and influencing how they were treated during service

Results & Impact

The platform maintained 76,800 processed financing simulations, resulting in 4,105 approved contracts.

This means the ≈5.3% conversion rate reflects the service’s performance without any bias in customer treatment based on perceived purchasing power.

Recognition

After developing this work, I was invited to present at TechKnowledge Talks, with the theme “LGPD used to data interpretation on user interface”.

A live event for the entire computing department, with attendees from the company’s 4 headquarter cities.

I shared with the team the contextual interpretation needed to apply the law in practice.

Key Learnings

Alongside the Product Owner, who needed to answer a central question:
Which data used on the platform is considered sensitive under LGPD, and which should be hidden or protected in the interface?

Date and place of birth;

Make it clear what data is being collected, will be used for, & whom it will be shared;

I built a high-fidelity prototype in Figma with the simulation and financing-closure flow screens already adjusted, showing
sensitive data properly protected/hidden.