Privacy Policy

Last updated: May 12, 2026 Your privacy matters to us. This Privacy Policy describes how Sothen Consultoria em Tecnologia da Informacao Ltda. (Brazilian company, CNPJ 47.585.487/0001-85) collects, uses, stores, shares, and protects the personal information of users of the Rastro app. By using Rastro, you agree to the practices described in this Policy, in compliance with the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and the Brazilian Internet Civil Framework (Law 12,965/2014). 1. Data Controller Sothen Consultoria em Tecnologia da Informacao Ltda. CNPJ: 47.585.487/0001-85 Website: sothen.me Contact/DPO: contato@rastro.day 2. Data We Collect Data from your authentication provider (Google/Apple): name, email, profile picture, unique identifier. Data generated by your use of the app: routines you create, check-in records, notification and language preferences, subscription status. Technical data: push notification token (FCM), basic device information. We do not collect: sensitive data, precise location, contacts, browsing history, or media content. 3. Purposes Authenticate and identify you, provide app features, send notifications according to your preferences, process your subscription, ensure security and improvement of the App, provide support, and comply with legal obligations. 4. Legal Basis Performance of a contract, consent, legitimate interest, and compliance with legal obligations (Art. 7 of the LGPD). 5. Sharing We do not sell your data. We share it only with: Google and Apple (authentication and payments), Firebase (identity and notifications), cloud infrastructure providers, and public authorities when required by law. 6. International Transfers Some partners process data outside Brazil. We ensure that any transfer complies with the LGPD. 7. Storage and Security Encryption in transit (HTTPS/TLS) and at rest, strict access controls, continuous monitoring. In the event of an incident, we will notify you and the Brazilian Data Protection Authority (ANPD). 8. Retention Data is kept only for as long as necessary. After account deletion, data is removed within 30 days, except where legal obligations require otherwise. 9. Your Rights (Art. 18 of the LGPD) Confirmation, access, correction, anonymization, portability, deletion, information about sharing, withdrawal of consent, and objection. Contact: contato@rastro.day 10. Children and Teenagers Rastro is not intended for children under 13. 11. Cookies Rastro is a mobile app and does not use cookies. 12. Changes This Policy may be updated. Relevant changes will be communicated through the App. 13. Contact Email: contato@rastro.day Website: sothen.me ANPD: gov.br/anpd Sothen Consultoria em Tecnologia da Informacao Ltda. — CNPJ 47.585.487/0001-85