Privacy Policy

Last updated: September 2026 · App domain: notasbiblicas.app

This Policy describes how NotasBíblicas (trade name), operated by Anderson Alexandre Paz Cardoso, a sole proprietor based in Brazil, collects, uses, shares and protects your personal data. Our company is based in Brazil, so our data protection obligations are primarily governed by Brazil's General Data Protection Law (Lei Geral de Proteção de Dados — LGPD), and by Google Play's requirements. We extend the same core rights described below (access, correction, deletion, portability) to every user, wherever you are. By using the app (PWA and Android), you agree to the practices described here.

1. Who controls your data

The data controller is Anderson Alexandre Paz Cardoso, registered under Brazilian tax ID (CNPJ) 68.671.925/0001-06, based at Avenida Dona Afra, 846, Casa — Planalto da Catumbela, Russas — CE, Brazil, CEP 62901-276. Product/trade name: NotasBíblicas. Privacy contact: suporte@notasbiblicas.app.

2. Data we collect

• Sign-up / account: name, email and, optionally, phone number. Email is the access key on the web (no password). On Android, sign-up/sign-in is also available via Google (OAuth).
• Content you create: notes, folders, highlights, prayers, audio recordings, scanned photos, Theology chat conversations and community comments.
• Payment: on the web, processed by Asaas (a Brazilian payment processor; card/Pix). We do not store your card details. On Android, purchase identifiers from Google Play. We log email, status and order identifiers to grant Premium access.
• Usage and device: interaction events, app preferences (e.g. reminders), device/browser type, approximate IP address and technical identifiers needed for the app to work and stay secure.
• Marketing attribution (when present): campaign parameters (utm_*), fbclid, gclid and measurement/advertising cookies (e.g. Meta's _fbp / _fbc) when you reach the app from an ad or campaign link.

3. How we use your data

• Create and maintain your account and grant Premium access once payment is confirmed.
• Process recordings into transcripts, summaries, flashcards, devotionals and other AI features you request.
• Send communications about your access, support and product updates (when authorized).
• Measure audience, attribute conversions and, where applicable, optimize ads (Meta/Google) for the app's own channel.
• Improve the product, prevent fraud and comply with legal obligations.

4. Legal basis

Because the controller is based in Brazil, our primary legal framework is the LGPD. We process data based on contract performance (providing the service), consent (measurement/marketing cookies and optional communications — disclosed on the welcome screen and manageable in Settings → About), legitimate interest (security, product improvement, abuse prevention) and legal obligation (tax/accounting). If your local law grants additional or different rights, contact us at the email below and we'll do our best to honor them.

5. Who we share data with

• Asaas — web payment processing (Brazil-based). Card data stays with Asaas (or its processors); we don't store it.
• Google Play — billing and subscriptions on Android (under Google's policy).
• Supabase — authentication, database and file storage.
• Cloudflare — Worker/CDN hosting and edge infrastructure.
• OpenAI — AI processing (transcription, summaries, chat, text-to-speech) when you use Premium AI features.
• Meta Platforms — Pixel and, when configured, Conversions API, for measuring and optimizing campaigns on the app's own channel. With advanced matching, contact data (email, phone, name) and the internal user identifier are sent only as SHA-256 hashes, alongside technical attribution identifiers (_fbp/_fbc cookies, IP address and device user-agent at the time of purchase).
• Google (Analytics 4 and, when linked, Ads) — audience and performance measurement via Google Tag Manager.

We do not sell or rent user data.

6. Cookies and tracking

We use cookies and similar technologies that are essential to the app's operation and, after the notice shown on the welcome screen (when you continue on your phone), measurement and marketing cookies/pixels, including:

• Necessary: session, preferences and security.
• Analytics: Google Analytics 4 (G-678JGVPKRB) via Google Tag Manager (GTM-5J3H89FM).
• Marketing: Meta Pixel 1614801716676907 and, when configured, Google Ads — via GTM. On purchase confirmation, the Pixel's Conversions API may send contact data (email, phone, name) and the internal user identifier only as SHA-256 hashes, plus _fbp/_fbc, IP and user-agent from checkout — deduplicated against the browser event with the same event identifier.
• Analytics in the Android app: Firebase Analytics measures app open, sign-up and plans screen after consent. Firebase does not collect the advertising ID.
• Marketing in the Android app: Meta SDK (App Events) and the app Conversions API. We send Meta the app install/open, completed sign-up, plans screen view and the paid subscription confirmed by Google Play, together with the device advertising ID, an install identifier, technical device data (model, OS version, language, time zone), IP and the internal user identifier as a SHA-256 hash. If you reject marketing in Settings, none of this is sent; you can also reset or delete the advertising ID in Android settings.

You can restrict analytics/marketing in Settings → About → Cookie / marketing preferences, clear site data in your browser, or write to suporte@notasbiblicas.app. Blocking cookies may affect parts of the app or campaign measurement.

7. Security

Data travels encrypted in transit via HTTPS. Data at rest is held with the providers listed above, under access controls and standard information-security practices.

8. Deleting specific content (without deleting your account)

9. Full account deletion and your rights

You can confirm what data we process, access it, correct it, anonymize it, port it, or delete it, revoke consent, and ask who we've shared it with — the same rights recognized under the LGPD (art. 18), which we extend to every user regardless of location.

To delete your account and associated data, use the dedicated page:

https://notasbiblicas.app/account-deletion

In short: in the app, Profile → Delete my account → confirm; or email suporte@notasbiblicas.app. You can also download your data from Profile (self-service export).

• We delete your account content (notes, folders, highlights, prayers, conversations, audio/photos in storage, push registrations), anonymize/remove your profile, and revoke authentication.
• We may retain order/payment records without identifiable profile data, when required for tax, anti-fraud or accounting obligations; and Google Play's own billing history (under Google's policy).

Self-service deletion in the app is immediate. Email-only requests: within 30 days.

10. Retention

We keep data for as long as needed for the purposes described and to meet legal obligations. After account closure, we delete or anonymize data, except where retention is legally required (e.g. tax records). Attribution and technical logs may be retained for a limited period for audit and fraud prevention.

11. International transfers

Some providers (including Meta, Google, OpenAI and cloud infrastructure) may process data on servers outside Brazil, including in the United States. In those cases we rely on the safeguards and contractual clauses provided by those vendors.

12. Changes

We may update this Policy. Material changes will be announced in the app, on the site, or by email, with the revised date at the top of this page.

13. Contact

Questions about privacy or exercising your rights: suporte@notasbiblicas.app.

Controller: Anderson Alexandre Paz Cardoso — Brazilian sole proprietor, CNPJ 68.671.925/0001-06 — Avenida Dona Afra, 846, Casa — Planalto da Catumbela, Russas — CE, Brazil, CEP 62901-276.

Back to the app · Terms of Use · Português · Español