Privacy Policy

1. Controller and data protection officer

The controller of your data is TECHLAB SOLUÇÕES DIGITAIS LTDA, CNPJ 57.243.879/0001-10, Rua São Cristóvão, 817, Sala 03, Zona 08, Maringá/PR, Brazil, postal code 87050-490.

You can reach our data protection officer (encarregado) at [email protected]. You can also contact us through Help in the app.

2. Data we process

• Account: email, the name you choose, display name, language and, if you sign in with Google or Apple, the identifier and email provided by that account.

• What you do in the service: favorite cafés, lists and the lists you follow, reviews and photos, check-ins (the café and the time, never your position), participation in stamp events, outdated-info reports, help requests and notification preferences.

• Device and access: push notification identifier, IP address, user agent (browser or device), date and time of access and technical error logs.

• People who run coffee shops: name and email of whoever manages the page, their team role and a record of actions taken in the dashboard. The coffee shop's contact details shown publicly are business data.

We do not ask for sensitive data and ask you not to include it in reviews or help requests.

3. Why we use it and on what legal basis

• Performance of a contract (art. 7, V): creating and keeping your account, signing in with an email code, saving favorites and lists, publishing reviews, recording check-ins and stamps, answering your help requests and sending emails the service needs.

• Legitimate interest (art. 7, IX): security, fraud and abuse prevention, rate limiting, content moderation, aggregated statistics for coffee shops and improving the service, including product usage analytics: in the app, a random identifier kept on the device (never linked to your account, name or email) lets us count repeat use; on the website, nothing is stored. You can switch analytics off in Profile › Usage analytics, or object through Help.

• Consent (art. 7, I): push notifications. You can withdraw consent at any time in your device or app settings.

• Legal obligation (art. 7, II): keeping application access logs for 6 months, as required by art. 15 of Brazil's Internet Civil Framework (Law No. 12,965/2014), and complying with orders from authorities.

4. Location

With your permission, the app uses your device's location to show cafés near you and to confirm a check-in. For a check-in, the position is used only at that moment to verify that you are near the café, and it is not stored.

If you search for an address, the search text is sent to Google to find the place.

5. What is public and who sees what

• Public: your reviews and photos, with your display name, and the lists you make public (anyone with the link can see and follow them).

• Coffee shop staff: when they scan your QR code at an event, they see your name or initials. They also see outdated-info reports about their own café.

• Our team: outdated-info reports, help requests and content held by moderation.

Coffee shops only see aggregated numbers of views and taps per day. We keep no record of who viewed each page: to avoid counting the same person twice, we use, for 30 minutes and only in memory, a hashed identifier that changes every day.

6. Automated moderation

Every public text and photo (reviews, replies, list names, display names and café updates) is analyzed before publication by an artificial intelligence model from Anthropic (Claude), acting as a processor. Content that is held back is reviewed by a person on our team, and you can ask for a decision to be reviewed through Help (art. 20 of the LGPD).

7. Who we share data with

We do not sell personal data and we do not show third-party ads. We share data only with processors that help us provide the service, under contract and only for that purpose:

• Oracle Cloud Infrastructure: hosting, database and file storage, in São Paulo, Brazil.

• Cloudflare: delivery and protection of the site and the API (every request passes through it, IP address included), with servers in several countries.

• Resend: transactional email, United States.

• Expo, Apple and Google: push notification delivery, United States.

• Google: maps and address search, United States.

• Anthropic: content moderation, United States.

• Sentry: error monitoring, with personal data removed, European Union.

• PostHog: product usage analytics, on servers in the European Union: without capturing what is typed into fields, without profiles of people and without location from the IP address. In the app, a random identifier not linked to your account; on the website, no identifier stored. In the coffee shops' dashboard, the shop's team is identified (by the account's internal number) so we can improve the tool.

We may also share data when the law requires it or by order of a competent authority, and to defend rights in legal proceedings.

8. International transfers

Some processors handle data outside Brazil, mainly in the United States and the European Union. These transfers follow the mechanisms of art. 33 of the LGPD, such as standard contractual clauses, and we require these processors to provide a level of protection compatible with Brazilian law.

9. Cookies and on-device storage

On the website, we use a session cookie that is needed to keep you signed in. In the app, the session is kept in the device's secure storage.

We do not use advertising cookies or cross-site tracking.

10. How long we keep data

• Account data: while the account exists. After a deletion request, the account stays deactivated for 30 days and is then erased.

• Inbox messages: 90 days.

• “Download my data” file: 7 days.

• Help requests: until the account is erased.

• Access logs (each sign-in, with IP address, device and time): 6 months, as required by law, even if the account is erased sooner. Security logs of actions taken by coffee shop teams and our team may be kept longer, while needed for security and the defense of rights.

• Technical request logs (the content of each request to the service and of its answer, to investigate failures): 30 days, without passwords, codes or keys, without your location, and with name, email and phone hidden. To handle a help request of yours, these may be visible for up to 3 days, with a record of who asked and why.

• Aggregated coffee shop statistics: kept, since they do not identify people.

• Backups: kept for up to 365 days, on Oracle Cloud in São Paulo; erased data leaves them when that period ends and is not restored in the meantime.

Reviews from an erased account are deleted or kept anonymized, as you choose when deleting the account.

11. Your rights

Under art. 18 of the LGPD, you, as the data subject, may request: confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or data processed in breach of the law; portability; deletion of data processed on the basis of consent; information about who we share data with; information about the option not to consent; and withdrawal of consent.

In the app you can download your data yourself (“Download my data”, which emails you a link to a JSON file valid for 7 days), edit your name, adjust notifications and delete your account. For other requests, write to [email protected] or use Help. We may verify your identity before responding.

You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

12. Security

We use encrypted connections, access control, two-step authentication for our team, audit logs and private storage for files that are not public. We remove location data (EXIF) from uploaded photos. No system is completely secure: if an incident occurs that may cause relevant risk or harm, we will notify you and the ANPD, as the law requires.

13. Minors

Café Map is not intended for people under 18, and we do not knowingly create accounts for them. If we learn that an account belongs to a minor, it will be deleted.

14. Changes to this Policy

This Policy is versioned. When it changes materially, the app will ask you to read and accept the new version before continuing.