Norteia Privacy Policy

This Policy explains which personal data Norteia processes, what for, who we share it with, and what your rights are, in line with the Brazilian General Data Protection Law (LGPD, Law no. 13,709/2018).

1. Who is the controller

The controller of your data is Jefferson Cerqueira de Oliveira, an individual, provider of Norteia. The channel for any privacy matter and for exercising your rights is support@norteia.app, and the same person acts as data protection officer.

2. Data we process

• Account data: first name, last name, email, phone (optional) and password (stored only as a hash). If you sign in with Google, we receive your name and email from the Google account.
• Financial data you enter: the accounts, categories, transactions, goals and dashboards you create. Norteia does not access banks or other sources: only what you enter exists.
• Subscription: identifiers, plan, status and period of the subscription. Payment is made at Apple or Google; we do not receive your card data.
• Support: the content of the messages you send us, together with technical information the app attaches (operating system, platform and app version).
• Technical data: IP address, device and app information, access and crash logs.
• Acceptance of the documents: which version of the Terms and of this Policy you accepted, the exact text (through a verification code), the date and technical evidence (IP and device).
• Communication preference: whether you agreed to receive news and offers by email, and the history of that choice.

3. What we use it for and the legal basis

• Providing the Service (creating and keeping your account, computing your reports, managing your subscription, giving support): performance of a contract.
• Security and fraud prevention (blocking access attempts, audit records): legitimate interest and compliance with a legal obligation.
• Measuring usage and fixing failures (metrics and crash reports): legitimate interest, respecting your privacy and using the least data necessary.
• Proving the acceptance of the Terms and Policy and keeping billing records: compliance with a legal obligation and regular exercise of rights.
• Sending news and offers by email: only with your consent, which is optional and can be withdrawn at any time. Emails about your account (for example, verification and password recovery) do not depend on that consent.

We do not sell personal data.

4. Who we share it with

We use providers that process data on our behalf, only for the purposes above:

• Resend: email delivery (address and content of the messages).
• RevenueCat: subscription management (user identifier, status and purchase history).
• Apple and Google: app stores, payment and, if you choose it, Google sign-in.
• Firebase Crashlytics (Google): app crash reports.
• A usage analytics service and the hosting provider of the server and database.

We may also share data with authorities when the law requires it or to defend our rights.

5. International transfer

Some of these providers store or process data outside Brazil. In those cases the transfer takes place on the basis of the LGPD (for example, with contractual clauses and adequate safeguards), and we look for providers that offer a compatible level of protection.

6. How long we keep it

• While your account exists, we keep the data needed for the Service.
• When you request the deletion of your account, you have 15 days to change your mind. After that we permanently delete your transactions, accounts, categories, goals and dashboards, and anonymize your registration (name, email, phone and password).
• What we keep even afterwards: the subscription and billing records, for the period required by law and to defend rights; the proof of acceptance of these documents (version, verification code and date), without your IP and device; and a deletion audit record that contains no personal data.

7. Your rights

You can, at any time and free of charge: confirm that we process your data; access it; correct incomplete or outdated data; ask for anonymization, blocking or deletion of unnecessary data; ask for portability; know who we share it with; withdraw consent; and object to a processing.

In the app you can export your transactions, delete your account and turn news by email on or off. For any other request, write to support@norteia.app. You can also file a complaint with the Brazilian National Data Protection Authority (ANPD).

8. Security

We adopt technical and organizational measures to protect your data: passwords stored as hashes, encrypted connections, access control, progressive lockout of login attempts and audit records. No system is entirely immune to incidents; if one occurs that may cause you significant risk, we will notify you and the ANPD as the law requires.

9. Minors

Norteia is not intended for people under 18, and we do not intentionally collect data from minors.

10. Changes to this Policy

We may update this Policy. When the change is significant, we will give advance notice in the app and ask you to accept the new version. All published versions remain available at https://norteia.app/legal/privacy.

11. Contact

Jefferson Cerqueira de Oliveira · support@norteia.app