Privacy policy

1. Who is responsible for your data

The data controller is Agencia Hut (54.502.510 JEOXIMAR CHIQUINQUIRA PARRA HERNANDEZ), CNPJ 54.502.510/0001-96, based in Chapecó/SC, Brazil. For any privacy matter, including contacting our data protection officer, email contato@myvidaflow.com.

2. What data we use

• Account data: email and password (stored encrypted — not even we can see it), the name you’d like to be called and, if you want, a profile photo.
• Content you record: financial accounts and transactions, habits, tasks, notes, shopping lists, goals, appointments and reminders. This data is entered by you; VidaFlow does not connect to banks.
• Subscription: plan, subscription status, and trial and billing dates. Card details are entered directly on Stripe and never reach VidaFlow; we only receive the payment result.
• Notifications: if you turn on alerts while the app is closed, we store your device’s technical address to deliver reminders, and your time zone to send them at the right time.
• Technical data: basic access logs (such as IP address, date and time), kept by our providers for security and as required by Brazil’s Internet Civil Framework.
• On your device: the app keeps a copy of your data in the browser, your preferences (theme, font, currency, language) and your login session, so it opens quickly and works offline. We don’t use advertising cookies or track you across websites.
• Visit statistics: we count visits and page views anonymously and in aggregate (Vercel Web Analytics), without cookies and without identifying you, only to learn which pages are used most and improve VidaFlow.

3. What we use it for

• To make VidaFlow work: save your records, sync them across devices and send your reminders (performance of the contract).
• To charge the subscription, issue receipts and meet tax and legal obligations (contract and legal obligation).
• To protect your account and the service against fraud and unauthorized access (legitimate interest).
• To send essential emails: account confirmation, password recovery and subscription notices.

We don’t sell your data, we don’t use it for advertising and we don’t look at your content, except when you ask for help and authorize it, or when the law requires.

4. Who we share it with

Only with companies that help us provide the service, and only what’s needed:

• Supabase — sign-in and the database where your account and records are stored.
• Vercel — hosting for the website and the app, and anonymous visit statistics.
• Stripe — payment and subscription processing.
• Apple, Google and other browser makers — delivery of notifications to your device (they receive only the alert, not your content).
• ExchangeRate-API — provides currency exchange rates; it only receives the rate request, none of your data.

We may also share data when required by law or court order.

5. International transfers

Some of these providers store data on servers outside Brazil, mainly in the United States. We choose companies that follow recognized security and data protection standards, and the transfer happens to provide the service you signed up for, as permitted by the LGPD.

6. How long we keep it

• Your data is kept while your account exists — even if your subscription is canceled, so nothing is lost if you come back.
• If you ask us to delete your account, we erase your records within 30 days, except what the law requires us to keep longer (for example, payment data for tax purposes and access logs for 6 months).

7. Security

The connection is always encrypted (https), your password is stored encrypted and the database rules ensure each account can only access its own data. No system is 100% invulnerable; if an incident happens that could put you at risk, we will notify you and the competent authorities, as required by law.

8. Your rights

You can, at any time:

• find out whether we process your data and access it;
• correct incomplete or outdated data (most of it you can edit yourself in the app);
• get a copy of your data (Settings has an option to download a backup);
• ask us to delete your account and data;
• find out who we share your data with;
• withdraw consents, such as notification permissions (in your device or app settings);
• file a complaint with Brazil’s National Data Protection Authority (ANPD) or the data protection authority of your country.

To exercise any of these rights, email contato@myvidaflow.com. We reply within 15 days.

9. Children and teenagers

VidaFlow is intended for people aged 18 and over. Minors should only use it with the permission and supervision of a parent or guardian.

10. Changes to this policy

If this policy changes in a significant way, we will let you know in the app or by email before the change takes effect. See also the Terms of use.