Privacy Policy

This Privacy Policy explains how Raphael Depes Bruzzi Emery, an individual(“Avaqia”, “we”, “us”, the “controller”) collects, uses, shares, and protects your personal data when you use the Avaqia platform (the “Service”). It applies to users outside Brazil; Brazilian users are covered by our PT-BR Privacy Policy under the LGPD. Please also read our Terms of Use.

1. Who we are and how to contact us

Controller: Raphael Depes Bruzzi Emery, an individual. Privacy and data-protection contact: legal@avaqia.com. General contact: contato@avaqia.com. Data-protection requests may be sent to legal@avaqia.com.

2. The personal data we collect

Account data:name, email and, optionally, phone number (used, if you wish, for the friend finder). With social sign-in (Google, Microsoft, or Apple): name, email, profile photo. With Sign in with Apple, you may choose to hide your email; Apple then gives us a private relay address (“Hide My Email”), which we store only to send essential account communications. Usage and learning data: mission progress, scores, achievements, your onboarding answers (goal and usage profile, used to personalize missions), and the texts and prompts you submit in activities. Voice input: short audio clips you choose to record to fill in an answer. Contacts (optional): if you use the friend finder, we receive irreversible SHA-256 hashes of your contacts’ phone numbers computed on your device; we never receive or store the phone numbers themselves. Generated content: images you generate in image missions (stored in a private bucket, accessible only to you, for as long as your account exists; images you save to your Gallery can be deleted individually, and deleting your account removes them all). Technical data: access logs, device and browser information, IP address, security identifiers needed to run and protect the Service, and, if you enable notifications, a push identifier (Expo/APNs token on mobile, or a browser push subscription on the web) used solely to send you notifications. Billing data: subscription status and billing metadata; card details are handled directly by Stripe, and we do not store full card numbers.

We do not intentionally collect special-category or sensitive data, and we ask that you not submit it in your missions.

3. How we use your data and our legal bases

We process your personal data on the following bases:

• Provide, personalize, and operate the Service and generate feedback, to perform our contract with you.
• Transcribe a voice clip you choose to record, to deliver a feature you requested (contract).
• Process payments and manage your subscription (contract).
• Comply with legal, tax, and regulatory obligations and keep consent and transaction records (legal obligation).
• Improve the Service, prevent fraud and abuse, and keep the platform and users secure, including anti-bot protection, based on our legitimate interests and balanced against your rights.
• Send you optional communications with your consent, withdrawable at any time.

Where we rely on legitimate interests, we have weighed them against your interests and rights; you can object to that processing at any time (see Section 9).

4. Voice input and how it is handled

If you use voice input, your audio clip is sent to our transcription provider (Groq, using a Whisper model) solely to convert it to text that fills in your answer. The audio is processed in memory and is never stored on our servers, and the transcription is not logged. Voice input is used for transcription only, not for voice or biometric identification. On the web, if transcription by our provider fails or your daily limit is reached, your browser may use its own speech-recognition service (for example, Google in Chrome), subject to that provider’s privacy policy. If you prefer not to use it, simply type your answers.

5. AI processing and automated decisions

To deliver feedback and generated content, your texts, prompts, audio, and images are processed by third-party AI providers acting as our processors (see Section 6). We do not submit your content to third-party AI providers to train their models. We select providers that, under their contracts and current policies for commercial APIs, do not use inputs sent through those APIs to train their models, or that offer controls to exclude such use; if a provider changes this policy, we will update our practices and this notice accordingly.

The AI feedback you receive is educational and does not produce legal or similarly significant effects about you. We do not make solely automated decisions that produce legal or similarly significant effects about you.

6. Sharing and sub-processors

We do not sell your personal data.We share only what is necessary with vendors that act, as applicable, as processors, sub-processors, service providers, or independent controllers, depending on the nature of the processing and the applicable contracts and law, each under written agreements and its own policies: AI providers that generate text feedback and images from your prompts (Google Cloud / Vertex AI, OpenAI, xAI); a transcription provider (Groq; in-memory, not stored); authentication, database, and storage (Supabase); cloud hosting (Google Cloud / Firebase App Hosting); social sign-in (Google, Microsoft, Apple); push notification delivery (Expo, which forwards to Apple’s APNs or Google’s FCM); payment processing (Stripe); in-app subscription management (RevenueCat); transactional email (Resend); and network protection, email routing, and anti-bot (Cloudflare). We may also disclose data where required by law, to enforce our Terms, or to protect rights, safety, and security.

Anti-bot protection (Cloudflare Turnstile). To distinguish humans from bots and protect access, we use Cloudflare Turnstile, including in invisible mode. It collects technical signals from your device and connection (e.g., IP address, User-Agent, TLS fingerprint, and the site key). This is based on our legitimate interest in security and fraud prevention and is governed by the Turnstile Privacy Addendum, available at cloudflare.com/turnstile-privacy-policy.

7. International data transfers

We and some of our sub-processors are located outside your country, including in the United States, so your personal data may be processed there and is subject to the laws of those countries. For users in Canada, cross-border processing is addressed in Section 13 (PIPEDA). You can request more information about our safeguards via legal@avaqia.com.

8. Data retention

We keep your personal data only for as long as necessary for the purposes described above or to meet legal obligations, after which we delete or anonymize it. When you delete your account, we permanently erase your profile and associated data (missions, progress, generated images, and authentication account); limited records may be retained where the law requires (e.g., consent and billing records). When we keep connection or access logs, we retain them for the period required by applicable law. In the mobile app, some content you view or share (such as images) may be temporarily kept in your device’s cache by the operating system, and is removed when you uninstall the app.

9. Your rights

Depending on where you live, you have rights over your personal data. You may:

• access your data and obtain a copy;
• correct inaccurate data;
• delete your data (you can do this yourself from your profile settings);
• restrict or object to certain processing, including processing based on our legitimate interests;
• request a copy of your data in a portable format;
• withdraw consent at any time, without affecting prior processing.

To exercise these rights, contact legal@avaqia.com. U.S. and Canadian residents, see Sections 12 and 13 for details specific to your region.

10. Cookies and similar technologies

The Service uses only essential cookies and storage needed to function, for example your authentication session, your language preference, and anti-bot protection. We do not use advertising or third-party analytics cookies, and we do not track you across other sites. Because these are strictly necessary, no consent banner is required to operate them.

11. Children’s privacy

The Service is intended for users 16 and older and is not directed to children under 13. We do not ask for your date of birth and rely on your representation that you meet the minimum age. We do not knowingly collect personal data from children under 13; if you believe a child has provided us data, contact legal@avaqia.com and we will delete it.

12. U.S. state privacy rights (California and others)

If you are a U.S. resident, you may have rights under your state’s privacy law (e.g., the California Consumer Privacy Act, as amended by the CPRA). In the past 12 months we have collected these categories of personal information: identifiers (name, email, phone, account ID, IP address); commercial information (subscription status and purchase history; card data held by Stripe); internet or network activity (mission usage, progress, onboarding answers, access logs); audio and visual information (voice clips, processed in memory for transcription and not stored; and images you generate, stored in a private bucket for as long as your account exists, deletable individually when saved to your Gallery); and, if you use the friend finder, irreversible hashes of your contacts’ phone numbers (we never collect or store the phone numbers themselves). We do not collect precise geolocation, sensitive personal information for inference, or biometric information.

Vendors are service providers, not sales. Under the CCPA, our vendors (e.g., OpenAI, xAI, Google, Groq, Supabase, Stripe, RevenueCat, Resend, Cloudflare) act as service providers or contractors under written contracts that prohibit them from selling your personal information or using it for any purpose other than providing services to us. We do not sell your personal information, and we do not share it for cross-context behavioral advertisingas those terms are defined under California law. Because we do not sell or share, no “Do Not Sell or Share My Personal Information” link is required; if this ever changes, we will provide one.

We do not use your personal information for automated decision-making or profiling that produces legal or similarly significant effects about you, so no opt-out of automated decision-making applies. Because we do not collect or use sensitive personal information to infer characteristics, the right to limit the use of sensitive personal information does not apply.

Subject to your state’s law, you may request to know or access, delete, and correct your personal information, and you have the right to non-discrimination for exercising these rights. Submit requests to legal@avaqia.com; you may use an authorized agent (we may require written authorization and may still ask you to verify your identity directly). We will verify your request against your account.

13. Canada (PIPEDA and provincial laws)

If you are in Canada, we handle your personal information in line with PIPEDA principles: accountability, identifying purposes, meaningful consent, limiting collection, use, and retention, accuracy, safeguards (see Section 8), openness, individual access and correction, and challenging compliance. You may exercise access and correction at legal@avaqia.com, and we retain Canadian personal information only as long as necessary for the purposes described here.

• Cross-border processing. Your personal information may be processed and stored outside Canada (including in the United States) by our service providers and is therefore subject to the laws of those countries, including lawful access by their authorities.
• Breach notification. If a breach of security safeguards creates a real risk of significant harm, we will notify affected individuals and report to the Office of the Privacy Commissioner of Canada as required by law.
• Provincial laws. Where applicable, additional rights may arise under provincial laws such as Quebec’s Law 25 or British Columbia and Alberta PIPA. You may complain to the OPC or your applicable provincial authority.

14. Changes to this Policy

We may update this Policy from time to time. We will communicate material changes and, where appropriate or legally required, ask for renewed acceptance. The current version and effective date appear above.

15. Contact

Privacy and data-protection: legal@avaqia.com. General: contato@avaqia.com. See also our Terms of Use.