Privacy Policy

1. General Provisions

This Privacy Policy ("Policy") establishes the conditions under which Mirtilu ("Platform," "we," or "our") collects, uses, stores, processes, shares, and protects the personal data of users ("User" or "you") of the Mirtilu application, in compliance with the Brazilian General Data Protection Law (Law No. 13,709/2018 - LGPD), the Brazilian Internet Civil Framework (Law No. 12,965/2014), the Brazilian Child and Adolescent Statute (Law No. 8,069/1990) as applicable, and other applicable regulations. This Policy is an integral part of and supplements the Platform's Terms of Use. Use of the Platform implies knowledge and full acceptance of this Policy.

2. Personal Data Collected

2.1. The Platform collects personal data provided directly by the User during the registration process and use of the service, including, as applicable: email address, authentication credentials, display name, username, profile photo, cover image, biography text, country indication, and any other information the User chooses to provide in their profile. When the User authenticates through third-party providers, the Platform receives the data authorized by the User from the provider, in accordance with the respective provider's privacy policies.

2.2. The Platform automatically collects, during the use of the service, technical and operational data necessary for the operation, security, and improvement of the service, including, without limitation: Internet Protocol (IP) address, device type and model, operating system and version, application version, device and advertising identifiers, authentication and notification tokens, access logs with date and time, application performance and stability data, and navigation and interaction data within the Platform.

2.3. Content generated by the User in the context of using the Platform, including messages, posts, comments, reactions, images, and other materials, is collected and stored as an integral part of the service provision.

2.4. Technical support data, including problem description, device information, and diagnostic logs, may be collected when the User contacts the Platform's support channels.

3. Purposes of Processing

The personal data collected is processed for the following purposes, in accordance with the legal bases set forth in the LGPD: (a) provision and operation of the service, including account creation and maintenance, authentication, transaction processing, and delivery of features, based on contract performance (Art. 7, V, LGPD); (b) communication with the User, including sending operational notifications, security alerts, and service updates, based on contract performance; (c) display of personalized or non-personalized advertising content, based on User consent (Art. 7, I, LGPD); (d) usage analysis, improvement, and development of the service, based on the Platform's legitimate interest (Art. 7, IX, LGPD); (e) detection, prevention, and investigation of fraud, abuse, unlawful activities, and violations of the Terms of Use, based on legitimate interest; (f) ensuring the security and integrity of the Platform and its users, based on legitimate interest; (g) content moderation and enforcement of the Terms of Use, based on legitimate interest; (h) compliance with legal and regulatory obligations, based on legal obligation (Art. 7, II, LGPD); (i) regular exercise of rights in judicial, administrative, or arbitral proceedings (Art. 7, VI, LGPD).

4. Data Sharing

4.1. The Platform does not sell, rent, lease, or trade the personal data of its users.

4.2. The User's public profile data, including display name, username, profile photo, biography, level, and badges, are accessible to other Platform users according to the privacy settings chosen by the User. Content posted by the User in public or shared areas of the Platform is visible to other participants of that space.

4.3. The Platform may share personal data with third-party service providers that assist in the operation of the Platform, including, without limitation, infrastructure and hosting providers, authentication services, file storage services, data analytics and performance services, error detection services, notification delivery services, advertising networks, payment processing providers, and content providers. Such service providers access personal data strictly to the extent necessary for the performance of the contracted services and are subject to confidentiality and data protection obligations.

4.4. The Platform may disclose personal data when required by law, regulation, court order, or request from a competent authority, or when in good faith it believes that disclosure is necessary to: (a) comply with a legal obligation; (b) protect and defend the rights or property of the Platform; (c) prevent or investigate possible irregularities related to the service; (d) protect the personal safety of users or the public; (e) protect against legal liability.

4.5. In the event of corporate reorganization, merger, acquisition, asset sale, or similar proceeding, the users' personal data may be transferred as part of the assets, subject to applicable legislation, and the User will be notified in advance if there is a change in the data controller.

5. International Data Transfer

Personal data collected by the Platform is primarily stored on servers located in Brazilian territory. Nevertheless, due to the nature of the technology services used, personal data may be transferred to and processed on servers located in other countries, including countries that may not offer a level of data protection equivalent to that of Brazil. In such cases, the Platform adopts the safeguards provided for in Art. 33 of the LGPD, including adequate contractual clauses with service providers, to ensure an adequate level of protection for transferred data.

6. Storage and Retention

Personal data will be stored for the period necessary to fulfill the purposes for which it was collected, as described in this Policy. Data associated with an active User account will be retained while the account remains active. After a request for account deletion, personal data will be removed within up to 30 (thirty) days, except for the retention of data that is necessary for: (a) compliance with legal or regulatory obligations; (b) regular exercise of the Platform's rights in judicial, administrative, or arbitral proceedings; (c) resolution of pending disputes; (d) prevention of fraud and abuse, in which case data may be retained in anonymized or aggregated form. Application access logs will be maintained for a minimum period of 6 (six) months, in accordance with Art. 15 of the Brazilian Internet Civil Framework.

7. Security

The Platform employs reasonable technical and organizational measures compatible with the state of the art to protect personal data against unauthorized access, destruction, loss, alteration, communication, or any form of inadequate or unlawful processing. Such measures include, without limitation, data encryption in transit, secure authentication, access controls, request rate limiting mechanisms, and automated verification in sensitive flows. Nevertheless, no method of electronic transmission or storage is absolutely secure, and the Platform cannot guarantee the absolute security of data. In the event of a security incident that may pose a risk or relevant harm to data subjects, the Platform will notify the affected users and the Brazilian National Data Protection Authority (ANPD) within a reasonable timeframe, as provided for in the LGPD.

8. Data Subject Rights

In accordance with the LGPD, the User, as a personal data subject, has the right to: (a) confirmation of the existence of processing of their data; (b) access to the personal data processed; (c) correction of incomplete, inaccurate, or outdated data; (d) anonymization, blocking, or deletion of unnecessary, excessive data, or data processed in non-compliance with the LGPD; (e) portability of data to another service provider, upon express request; (f) deletion of personal data processed based on consent; (g) obtaining information about public and private entities with which the Platform has shared data; (h) information about the possibility of not providing consent and about the consequences of refusal; (i) revocation of consent at any time. To exercise any of these rights, the User must send a request to the email address support@mirtilu.com, which will be responded to within up to 15 (fifteen) business days, as provided for in applicable regulations. The Platform may request additional information for identity verification purposes before fulfilling the request.

9. Privacy Settings

The Platform provides the User with privacy controls accessible in the application settings, which allow the User to manage the visibility of their profile, set contact and communication restrictions, control the display of activity indicators, and customize notification preferences. The Platform is not responsible for data that the User voluntarily chooses to make public or share with other users.

10. Advertising

The Platform may display advertising content provided by third-party advertising networks. Such networks may collect and use device and advertising identifiers, usage data, and other information for ad personalization and effectiveness measurement purposes, in accordance with their respective privacy policies. The User may reset or limit the use of the advertising identifier through the operating system settings of their device. For underage users, the ads displayed comply with the applicable restrictions and classifications under current regulations. The Platform offers the User the option to remove advertising through payment.

11. Minors

The Platform is intended for users aged 12 (twelve) years or older. The Platform does not intentionally collect personal data from children under 12 (twelve) years of age. If the Platform becomes aware that personal data from a child under 12 (twelve) years of age has been inadvertently collected, such data will be deleted without prior notice. The processing of personal data of users between 12 (twelve) and 17 (seventeen) years of age is carried out in their best interest, pursuant to Art. 14 of the LGPD and the Brazilian Child and Adolescent Statute. Consent for the processing of data of minors under 18 (eighteen) years of age must be provided by at least one parent or legal guardian. Parents and legal guardians who wish to exercise rights on behalf of minors under their responsibility may do so by sending a request to the email address support@mirtilu.com, accompanied by documentation proving the guardianship relationship.

12. Changes

The Platform reserves the right to modify this Privacy Policy at any time. Significant changes will be communicated through a notification in the application or via the registered email address. The date of the last update will always be indicated at the end of this document. Continued use of the Platform after the publication of changes constitutes full acceptance of the modified Policy. It is the User's responsibility to periodically review this Policy.

13. Contact and Data Protection Officer

For any questions, requests, complaints, or inquiries related to this Privacy Policy or the processing of your personal data, the User may contact the Platform at the email address support@mirtilu.com. If the User considers that the processing of their personal data violates applicable legislation, they have the right to file a complaint with the Brazilian National Data Protection Authority (ANPD).

Last updated: February 2026