Privacy Policy

1. Who We Are (Data Controller)

Vida Diária is operated by Lucas Oliveira Kalab Castello, registered under NIF 308847199, with address in Guimarães – Braga – Portugal – 4800-045. For any matter relating to this policy or to the processing of your data, contact us by e-mail at privacidade@vidadiariaapp.com.

2. What Data We Collect

2.1 Data you provide to us directly

• Registration data: name, e-mail and password (stored in encrypted form);
• We collect your date of birth at registration in order to (i) confirm that you meet the minimum age of 16 years required by our terms of use, and (ii) send a congratulations message within the application on your birthday. This information is not shared with third parties nor used for any other purpose;
• Data entered into the App's modules, including: health information (weight, physical activity, lab tests, vaccines, hydration, blood pressure, sleep and medications), financial information (entries, bills payable and receivable), appointments and personal documents, grades and school records, vehicle data, birthdays (name, day/month of birth, gender of third parties), shopping list and entertainment recommendations;
• Third-party/dependent data: some modules allow the account holder to register information about other persons under their responsibility (for example, children, spouse or other family members), such as name and date of birth. By registering such data, the account holder represents that they have the legal authority required (for example, parental authority or custody) to do so.
• Birthday data: the Birthdays module allows the account holder to register the name and date of birth (day and month) of any person within their personal relationships — not limited to dependents — solely for the purposes of personal reminders and sending congratulatory messages. This processing is carried out under the sole responsibility of the account holder, on the basis of their legitimate interest and strictly personal use, the account holder being solely responsible for having a legitimate reason to keep such data.

2.2 Data collected automatically

• Device identifiers, IP address and application usage and performance data;
• Data used for displaying ads, described in Section 8;
• Anonymous or pseudonymized analytics data on performance and technical failures (e.g., Firebase Crashlytics) to ensure system stability.

3. How We Use Your Data

• To provide, operate and maintain the features of the App;
• To send reminders and notifications related to the data you have registered yourself (e.g., vaccines, bills, appointments);
• To generate PDF reports at your request;
• To personalize and improve the user experience;
• To display ads, respecting the user's consent where required by law;
• To comply with legal obligations and respond to requests from data subjects.

4. Legal Basis for Processing

• Performance of a contract: to provide the Service you requested (Art. 7, V of the LGPD; Art. 6(1)(b) of the GDPR);
• Explicit Consent for Sensitive Data: To collect and process health information voluntarily entered by you, we rely on your unambiguous and highlighted consent, in line with Art. 11, I of the LGPD and Art. 9 of the GDPR. You may withdraw this consent by deleting the information or your account at any time;
• Consent: for displaying personalized ads to users in the European Economic Area, the United Kingdom and Switzerland (Art. 7, I of the LGPD; Art. 6(1)(a) of the GDPR);
• Legitimate interest: for security, fraud prevention and improvement of the App, always respecting the fundamental rights and freedoms of data subjects;
• Compliance with a legal or regulatory obligation, where applicable.

5. With Whom We Share Your Data

• Supabase Inc. — database and authentication infrastructure, with servers located in Europe.
• Google LLC (Google AdMob) — ad serving, subject to prior consent via a consent management platform (CMP) for users in the European Economic Area, the United Kingdom and Switzerland. See Section 8.

We do not sell, rent or trade your personal data for third-party marketing purposes.

6. International Data Transfer

Your data is stored and processed on servers located in Europe (Supabase). For users residing outside Europe (Brazil), this entails an international transfer of data. We adopt the safeguards required by the LGPD and corresponding legislation, relying on Standard Contractual Clauses (SCCs) and strong encryption to ensure a level of protection equivalent to or higher than that required by your home jurisdiction.

7. Data Retention and Deletion (Apple / Google Requirement)

We keep your data for as long as necessary to fulfill the purposes described in this policy, while your account is active. In full compliance with the guidelines of the Apple App Store (Guideline 5.1.1) and the Google Play Store, you may request the permanent deletion of your account and all your data at any time, directly in the App, under Settings > Account > Delete Account. Once confirmed, the deletion is processed automatically and permanently within a few minutes, and cannot be undone. For health data, retention is strictly limited to the period of use of the service, and such data is deleted immediately upon deletion of the account. Residual data present in automatic security backups will be completely overwritten or irreversibly anonymized within a maximum technical period of 30 days.

8. Ads and Consent Management

The App displays ads provided by Google AdMob. For users located in the European Economic Area (EEA), the United Kingdom and Switzerland, we request consent through a Google-certified Consent Management Platform (CMP) before displaying personalized ads or collecting data for that purpose.

You may review or change your consent choice at any time under Settings > Privacy > Manage Ad Consent, directly in the App.

9. Data Security

We adopt technical and organizational measures to protect your data, including encryption in transit and at rest, secure authentication and row-level access control policies (Row Level Security – RLS) in the database, which ensure that each user can only access their own data.

In the event of a personal data breach that may result in a real risk of significant harm to data subjects, we will notify the competent authorities and the affected data subjects, as required by the LGPD, the GDPR and other applicable legislation (within the maximum period of 72 hours required by the GDPR).

10. Your Rights

Under the LGPD and, where applicable, the GDPR, you have the right, at any time, to:

• Confirm the existence of processing of data and access your data;
• Correct incomplete, inaccurate or outdated data;
• Request the portability of your data to another provider. You have the right to export your registered information (such as financial histories or health reports) in a structured, machine-readable format (e.g., PDF or CSV) in a simple manner;
• Request the deletion of your data, directly in the App (see Section 7);
• Withdraw consent previously given;
• Object to processing carried out on the basis of legitimate interest;
• Lodge a complaint with a competent supervisory authority, such as the Comissão Nacional de Proteção de Dados (CNPD) in Portugal or the Autoridade Nacional de Proteção de Dados (ANPD) in Brazil, if you consider that the processing of your data violates applicable law.

To exercise these rights or ask questions, contact us by e-mail at privacidade@vidadiariaapp.com.

11. Data of Minors

The App is not intended for independent registration, as account holders, by children and adolescents under 16 years of age. As described in Section 2.1, the adult account holder may enter data relating to minor dependents (for example, vaccines or school grades) under their parental responsibility. In such cases, the account holder is legally responsible for consent and for the management of the minor's data.

12. Cookies and Similar Technologies

The App may use device identifiers and local storage for operational purposes and for displaying ads, as detailed in Section 8.

13. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated through the App or by e-mail, indicating the new effective date.

14. Effective Date

This Policy takes effect on October 1, 2026.