Provisional version. The company details will be added before sales begin.
Ashtamapa Privacy Policy
Effective date: [DATA DE VIGÊNCIA]
This Policy explains what personal data we use, why, and what your rights are. It follows Brazil's General Data Protection Law (LGPD, Law 13,709/2018). For users in the European Union, we also follow the principles of the General Data Protection Regulation (GDPR).
Summary: - For your subscription, we use your name, email and purchase information. - Payments are processed by Stripe. We do not store your full card number. - Your pain and mobility records stay only on your device. We do not receive them. - No ads. We do not sell your data.
1. Controller
[RAZÃO SOCIAL OU NOME], [CPF/CNPJ], [ENDEREÇO]. Contact: [E-MAIL DE CONTATO].
2. Data Protection Officer (Encarregado)
Data Protection Officer: [NOME DO ENCARREGADO]. Contact: [E-MAIL DE CONTATO].
3. What data we use
a) Account data: name and email address.
b) Sign-in data: one-time codes sent by email, sign-in date and time, and technical session information.
c) Subscription data: plan, currency (BRL or USD), amount, billing dates, payment status (approved, declined, refunded) and Stripe purchase identifiers. From Stripe we receive only limited card details, such as card brand, last 4 digits and expiry date. To comply with the law, Stripe may ask for additional data, such as a tax ID or billing address.
d) Technical data: IP address, browser and device type, date and time of access. This data passes through Cloudflare, which hosts and protects the app.
e) Messages: anything you send us by email.
f) Pain and mobility data (health data): what you record about pain, discomfort and mobility to get practice adjustments. Today this data is stored only on your device (in your browser's local storage, "localStorage"). It is not sent to us or to anyone else.
We do not collect health data on our servers, precise location data, or data for advertising.
4. Why we use it and on what legal basis
| Purpose | Data | Legal basis (LGPD) | Legal basis (GDPR, EU users) |
|---|---|---|---|
| Create your account, sign you in, give you access | account, sign-in | performance of contract (art. 7, V) | contract (art. 6(1)(b)) |
| Charge, renew, cancel and refund your subscription | account, subscription | performance of contract (art. 7, V) | contract (art. 6(1)(b)) |
| Keep tax and accounting records | subscription | legal obligation (art. 7, II) | legal obligation (art. 6(1)(c)) |
| Send account emails (codes, receipts, renewal reminders, price or terms changes) | account | performance of contract (art. 7, V) | contract (art. 6(1)(b)) |
| Keep the app secure and prevent fraud and abuse | sign-in, technical | legitimate interest (art. 7, IX) | legitimate interest (art. 6(1)(f)) |
| Answer your messages and requests | account, messages | contract or legitimate interest | contract or legitimate interest |
| Defend our rights in legal proceedings | as needed | exercise of rights (art. 7, VI) | legitimate interest (art. 6(1)(f)) |
| Suggest practice adjustments based on pain and mobility | pain and mobility (on your device) | specific, highlighted consent (art. 11, I) | explicit consent (art. 9(2)(a)) |
About health data. Pain and mobility are sensitive personal data. That is why the app asks for your consent before your first entry. Today this data stays only on your device and we cannot access it. You can use the app without recording it; you just will not get personalized adjustments. You can withdraw consent at any time by deleting your records in the app or clearing your browser data.
If this changes. If we ever want to store this data on a server (for example, to sync between devices), we will tell you first, explain how it will work, and ask for new consent. Without that new consent, nothing changes.
Marketing emails. We will only send news or offers if you agree. You can unsubscribe at any time using the link in the email.
5. Who we share data with
We do not sell, rent or trade your data. We do not run ads.
We share data only with companies that help us run the app:
- Stripe — payment processing, fraud prevention and receipts. Stripe also processes some data on its own behalf, to comply with financial laws and prevent fraud, under its own privacy policy.
- Cloudflare — hosting, app delivery and protection against attacks. Receives technical data such as IP address.
- [PROVEDOR DE E-MAIL] — sending sign-in codes and account emails. Receives your email address and the content of those messages.
We may also share data when the law or an authority requires it, or to defend our rights.
Pain and mobility data is not shared with anyone, because it never leaves your device.
6. International transfers
Stripe, Cloudflare and [PROVEDOR DE E-MAIL] may process data outside Brazil and outside the EU, for example in the United States. In these cases, the transfer relies on the mechanisms in article 33 of the LGPD, such as contractual clauses, and, for EU users, on GDPR mechanisms such as standard contractual clauses or adequacy decisions. You can ask for more information at [E-MAIL DE CONTATO].
7. How long we keep data
- Account and sign-in data: while your account exists. After it is closed, we delete or anonymize it within [PRAZO DE EXCLUSÃO EM MESES] months, unless the law requires us to keep it.
- Subscription and payment data: for the period required by tax and accounting law, usually 5 years.
- Access logs: for the period required by applicable law and as needed for security.
- Messages: for as long as needed to handle your request and any complaints.
- Pain and mobility data: stays on your device until you delete it. We do not have a copy.
8. Your rights
At any time and free of charge, you can:
- confirm whether we process your data and access it;
- correct incomplete, inaccurate or outdated data;
- ask for anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
- ask for data portability;
- ask for deletion of data processed based on your consent;
- find out who we share your data with;
- find out what happens if you do not give consent;
- withdraw your consent;
- object to processing based on legitimate interest;
- ask for review of decisions made solely by automated means.
EU users may also ask for restriction of processing.
How to ask: write to [E-MAIL DE CONTATO] from your account email. We may ask you to confirm your identity. We will respond within the time required by law.
Complaints: if you are not satisfied, you can complain to Brazil's National Data Protection Authority (ANPD) at gov.br/anpd. EU users can complain to the data protection authority in their country.
9. Security
- The app is only accessed over an encrypted connection (HTTPS).
- Sign-in uses one-time codes that expire.
- Card details stay with Stripe, not with us.
- We limit access to data to the people who need it to run the app.
No system is 100% secure. If a security incident could create significant risk or harm to you, we will notify you and the ANPD (and, where applicable, the competent EU authority), as required by law.
Your device matters too. Because pain and mobility records are stored on your device, anyone using the same device and browser can see them. Use a screen lock and avoid recording this data on shared devices.
10. Cookies and local storage
- We use your browser's local storage (localStorage and PWA features) to keep you signed in, save app preferences, allow offline use and store your pain and mobility records on your device.
- Cloudflare may use strictly necessary cookies for security and bot protection.
- Stripe uses its own cookies on the payment page to process the purchase and prevent fraud.
- We do not use advertising cookies or ad tracking.
- You can delete this data in your browser settings. This may sign you out and delete your pain and mobility records.
11. Under 18s
Ashtamapa is not intended for anyone under 18. We do not knowingly collect data from minors. If we learn that an account belongs to a minor, we will close it and delete the data, except what the law requires us to keep. If you are a parent or guardian and believe this has happened, write to [E-MAIL DE CONTATO].
12. Changes to this Policy
We may update this Policy. If a change is significant, we will tell you by email or in the app before it takes effect. The date at the top shows the current version.
13. Contact
[RAZÃO SOCIAL OU NOME] · [CPF/CNPJ] · [ENDEREÇO] Data Protection Officer: [NOME DO ENCARREGADO] · [E-MAIL DE CONTATO]