Brawe Privacy Policy

Version 2026-11 · Published November 4, 2026 · Effective: immediately for new Accounts and from December 4, 2026 for existing Accounts

This is a translation. If there is any conflict, the Portuguese version prevails, unless the law of your country requires otherwise.

1. Who is responsible for your data

1.1. Controller: BRAWE TECHNOLOGIES LTDA, CNPJ 41.988.422/0001-02, Av. Cândido de Abreu, 776, sala 803, 8º andar, Centro Cívico, Curitiba/PR, CEP 80530-000, Brazil (“Brawe,” “we,” “us”).

1.2. Data Protection Officer (DPO): Data Protection Officer of BRAWE TECHNOLOGIES LTDA, privacy@brawe.app. The Data Protection Officer receives your requests and communications from the ANPD and other authorities (LGPD art. 41).

1.3. Representatives:

1.4. Scope. This Policy applies to the Brawe app (iOS and Android), the brawe.app website, and all Services described in the Terms of Use. It does not apply to third-party websites or services accessed through links.

1.5. Independent controllers. When you buy on the Marketplace, the seller also processes your data (name, address, order) as an independent controller, to fulfill the sale. Apple and Google process data from purchases made in their stores as controllers, under their own policies.

2. What data we process

2.1. Data you provide to us

2.2. Data generated by use

2.3. Data received from third parties

• Apple and Google: confirmation of login and purchases, chargebacks.
• Payment partners: identity verification and payment status.
• Correios and postal-code services: address based on the postal code provided.
• Other users: mentions, tags, messages they send you, reports about you.

2.4. Sensitive data

We do not ask for sensitive data, such as health, religion, sexual orientation, political opinion, or racial origin. If you post it voluntarily, it will be processed only to display your Content, according to your choice.

The Creator verification selfie is used to confirm that the document belongs to you. If that comparison is done by facial biometrics, this will be stated on screen and done with your specific consent (LGPD art. 11, I; GDPR art. 9(2)(a)). The selfie is deleted after verification, except for the record of the result.

2.5. What we do not collect

• We do not use the device advertising identifier (IDFA or Android Advertising ID).
• We do not track you in third-party apps and websites.
• We do not access your contact list.
• We do not collect location in the background.
• We do not store full credit card data.

3. What we use your data for and the legal basis

3.1. Purposes and legal bases

3.2. Legitimate interest

When we rely on legitimate interest, we first assess whether it is balanced against your rights and expectations (LGPD art. 10). You may object to such processing (section 8). We may continue the processing only where there is a legitimate reason that prevails, such as security or defense in legal proceedings.

3.3. How the feed works

The feed and the Explore tab order content by these main criteria:

1. accounts you follow;
2. interests chosen at sign-up;
3. recent interactions (likes, comments, viewing time);
4. recency of the post;
5. language and country;
6. quality and safety signals, which reduce the reach of spam and reported content.

You can adjust your interests in your profile and follow only the accounts you follow in the Following tab.

3.4. Automated decisions

Automatic filters block spam, malicious links, and prohibited terms. They may hide a message or comment immediately. Decisions that significantly restrict your Account go through human review or can be reviewed by a person at your request (LGPD art. 20; GDPR art. 22). We do not carry out profiling with legal effects on you without human intervention.

3.5. Aggregated and anonymized data

We may create aggregated or anonymized statistics, which do not identify anyone, for reporting, transparency, and improvement of the Services. Truly anonymized data ceases to be personal data (LGPD art. 12).

4. Who we share with

4.1. We do not sell your personal data and do not share it for cross-context behavioral advertising.

4.2. Other users. Your profile (name, @, photo, bio, badge, level, and badges), your public posts, comments, and lives can be seen by other users. Messages are seen by the participants in the conversation. Gifts sent may appear to the Creator and in the live. Earnings are private by default.

4.3. Processors (service providers). They act on our behalf, under contract with confidentiality and security duties:

We keep this list up to date in this Policy and will give notice of material changes.

4.4. Apple and Google. They receive data from purchases made in the stores and from social login, as independent controllers.

4.5. Marketplace sellers and buyers. The seller receives the buyer’s name, delivery address, and phone to fulfill the order. The buyer receives the seller’s identification data required by the CDC.

4.6. Authorities. We provide data upon court order or valid legal request. Access logs, in Brazil, only by court order (Marco Civil arts. 10 and 15). We report CSAM to NCMEC, the Brazilian Federal Police, and the competent authorities, including the data of the Account involved. In case of imminent risk to life, we may share data with emergency authorities.

4.7. Corporate transactions. In the event of a merger, acquisition, or sale of assets, data may be transferred to the successor, who will be bound by this Policy. We will give notice before the transfer.

4.8. Advisors. Lawyers, auditors, and accountants, under a duty of confidentiality, when necessary.

5. International data transfers

5.1. Brawe is operated from Brazil, but part of the data is stored and processed in other countries, mainly the Netherlands (European Union) and the United States, through the suppliers in section 4.3.

5.2. Safeguards used:

• From Brazil abroad: standard contractual clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024) or another mechanism under art. 33 of the LGPD.
• From the EU/EEA and the United Kingdom to countries without an adequacy decision: European Commission Standard Contractual Clauses (Decision 2021/914), the UK addendum (IDTA) and, where the supplier is certified, the EU-US Data Privacy Framework.
• To Brazil: while there is no EU adequacy decision in force for Brazil, data of European users transferred to Brazil is also protected by Standard Contractual Clauses.

5.3. You may request a copy of the applicable safeguards at privacy@brawe.app. Commercially sensitive data in the contracts may be omitted.

6. How long we keep data

6.1. We keep data only for as long as necessary for each purpose or for the period the law requires.

6.2. Account deletion. When you delete the Account through the app or at brawe.app/account-deletion:

1. your profile stops appearing immediately;
2. within 30 days we delete or anonymize your profile, Content, messages sent by you (except copies already in the recipient’s account), media, notification tokens, and sign-up data;
3. we keep only what the table above requires, isolated and with restricted access.

6.3. Comments on other people’s posts are deleted with the Account. Reactions, Gifts, and battle records may remain in anonymized form (“Deleted user”) to preserve the integrity of leaderboards and third-party Earnings.

7. Security

7.1. We adopt technical and organizational measures appropriate to the risk, including:

• passwords stored with bcrypt hashing;
• encrypted connections (HTTPS/TLS);
• storage with restricted access and encryption at rest offered by the providers;
• e-mail confirmation by code;
• role-based access control for staff;
• audit logs of administrative and moderation actions;
• protection against denial-of-service attacks;
• limits on login attempts and code requests.

7.2. No system is completely immune. Protect your password, do not reuse it on other services, and be suspicious of messages that ask for codes.

7.3. Incidents. If a security incident occurs that may cause significant risk or harm, we will:

• notify the ANPD and affected data subjects within 3 business days (Resolution CD/ANPD No. 15/2024);
• notify the competent European authority within 72 hours (GDPR art. 33), where applicable;
• comply with other local notification laws.

7.4. Security researchers may report vulnerabilities at security@brawe.app. We will not take action against research carried out in good faith and without access to third-party data.

8. Your rights

8.1. Wherever you are, you may exercise the rights below. Some have different names or details depending on the law of your country (annexes in section 12).

8.2. Deadlines. We respond within 15 days (LGPD art. 19, II). Simple confirmation requests are answered immediately, where possible. Exercising your rights is free of charge.

8.3. Verification. To protect your Account, we may confirm your identity before fulfilling a request, normally through the e-mail on file. Requests made by a representative require a power of attorney or authorization.

8.4. Limits. We may decline in whole or in part when the law requires us to keep the data, when the request affects the rights of third parties (such as messages sent by another person), or in the case of manifestly abusive requests. We will always explain the reason.

8.5. Controls in the app:

• who can send you messages: everyone, followers, or no one;
• show or hide your Earnings and viewers;
• block, mute, and report users;
• notifications by type;
• theme and language, saved to your profile to apply on all devices;
• interests used in recommendations.

9. Minimum age

9.1. Brawe is intended only for people over 18 (or the local age of majority, if higher). We ask for your date of birth at sign-up and do not allow the creation of an Account by anyone who does not meet the minimum age.

9.2. We do not knowingly collect data from children and teenagers. If we identify a minor’s Account, it will be closed and the data deleted. We will keep only what is necessary to protect the minor or comply with the law.

9.3. Parents or guardians who learn of a minor’s Account can notify us at privacy@brawe.app or safety@brawe.app.

10. Cookies and similar technologies

10.1. The brawe.app website uses cookies and local storage. The app uses local storage on the device to maintain your session and preferences.

10.2. Analytics cookies are only activated after you accept in the banner. You can change your choice at any time through the “Cookie preferences” link in the footer of the Terms and Privacy pages. We respect the browser’s Global Privacy Control signal: with it enabled, analytics cookies are turned off.

10.3. In the app, we do not use advertising SDKs or cross-app tracking. For that reason the app does not request the iOS tracking permission (App Tracking Transparency).

11. Device permissions

11.1. The app only requests each permission when you use the corresponding feature. You can deny or revoke it at any time in the device settings; only the feature tied to it will stop working.

11.2. We do not request access to contacts or to the device’s biometric data.

12. Regional annexes

A. European Union, EEA, and United Kingdom (GDPR and UK GDPR)

• Legal bases: those in section 3.1 (GDPR art. 6). For legitimate interest, you may request a summary of the balancing assessment.
• Rights: access (art. 15), rectification (16), erasure (17), restriction (18), portability (20), objection (21), and not to be subject to solely automated decisions (22).
• Deadline: 1 month, extendable by 2 more in complex cases, with notice. In practice, we respond within 15 days.
• Complaint: you may complain to the authority of the country where you live, work, or where the infringement occurred. For example: CNPD (Portugal), AEPD (Spain), CNIL (France), Garante (Italy), ICO (United Kingdom).
• Representatives: section 1.3.
• Transfers: section 5.
• Mandatory data: e-mail, name, @, and date of birth are necessary to create the Account. Without them it is not possible to provide the service.

B. United States (California and other states with a privacy law)

This annex addresses the CCPA/CPRA (California) and the laws of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states with similar rules.

• We do not sell or “share” (for cross-context behavioral advertising) personal information, and have not done so in the last 12 months. We do not sell data of minors under 16.
• Rights: know, access, delete, correct, portability, limit the use of sensitive information, opt out of sale/sharing and of profiling with significant effects, and not be discriminated against for exercising rights.
• How to request: privacy@brawe.app or the app. We respond within 45 days, extendable by 45 more with notice. Authorized agents may make requests on your behalf.
• Appeal: if we deny a request, you may appeal at privacy@brawe.app and, if the denial is upheld, complain to your state attorney general.
• COPPA: Brawe is not intended for children under 13, nor for anyone under 18 (section 9).

C. Mexico

• Responsable: BRAWE TECHNOLOGIES LTDA, at the address indicated in section 1.
• Purposes: those in section 3.
  • Primary: Account, Content, payments, and security.
  • Secondary: e-mail marketing and website analytics. You may refuse them at privacy@brawe.app without losing the service.
• ARCO rights (acceso, rectificación, cancelación y oposición) and withdrawal of consent: at privacy@brawe.app, with your identification and a description of the request. We respond within 20 business days and implement within 15 business days.
• Complaint: to the competent Mexican data protection authority.

D. Argentina, Chile, Colombia, Peru, and other Latin American countries

The following apply:

Rights are exercised at privacy@brawe.app, within the deadlines of each law.

E. Other countries

• India (DPDP Act 2023): you may access, correct, and delete data, nominate a representative, and complain to the Data Protection Board. The grievance officer is the DPO in section 1.2.
• South Korea, Japan, Indonesia, Turkey, and other countries: we apply this Policy and the rights guaranteed by local law. If the law requires specific consent for international transfer, it will be requested in the app.
• Countries without availability: Brawe is not offered where the law requires local storage or a license that we do not hold, such as mainland China and Russia.

13. Changes to this Policy

Material changes will be announced in the app and by e-mail at least 30 days in advance, with a summary of what changed. When the change requires new consent, it will be expressly requested. Previous versions may be requested at privacy@brawe.app.

14. Contact

Last updated: November 4, 2026. Previous version: 2025-01-01.