Privacy Policy

34. Who processes your data

• Guia Lupa as controller: data about your account, Platform use, subscriptions and credits, the affiliate program, support, moderation, security and Platform communications.
• Professional as controller and Guia Lupa as processor: data that the professional and their team register and use in the dashboard about their clients (records, notes, history, finances, packages, receipts, certificates and WhatsApp conversations from the professional's number). In these cases, requests about the data should be made to the professional, and Guia Lupa helps forward them.
• White Label business: receives data about your interactions with its brand, like any professional on the Platform.
• Data Protection Officer (DPO): contact details are in the Controller and contact section.

35. Data we process

Data you provide

• Registration and sign-in: name, display name, email, photo, phone and sign-in data with Google, Apple or email and password. The password is managed by the authentication service and is not stored by Guia Lupa.
• Additional data: date of birth, gender, city and, when necessary, CPF or another ID document (for example, for receipts, certificates and the affiliate program).
• Addresses: up to three saved addresses, with a name, and the address of home visits. The postal code (CEP) is looked up in a public service (ViaCEP) to complete the address.
• Appointments and services: professional, service, date, time, location, notes, status, reviews, packages, plans and subscriptions purchased from professionals.
• Interactions: favorites, blocks, added brands, likes, comments, reviews, replies, reports, searches and filters.
• Support: messages, attachments, service ratings and protocol numbers.
• Professionals: business data (trade name, CPF or CNPJ, address, service area, public contacts, social networks), professional registrations (title, council, number and state), team and permissions, services, prices, hours, days off and holidays, portfolio, showcases, stories, chosen music, tags, captions, testimonials, Pix key, financial entries, charges, products for clients, and WhatsApp, AI and White Label brand settings.
• Clients registered by professionals: name, phone, email, date of birth, address, record notes, appointment history, payments, packages, receipts and certificates.
• Shop: products, photos, prices, costs, stock and stock movements, categories and suppliers registered by the professional; client orders (products, quantities, amounts, fulfillment option, delivery address, note, status and history) and the payment receipt uploaded by the client (image or PDF, stored privately).
• Affiliates: registration data, CPF or CNPJ, address, social networks, Pix key, invoices, agreement acceptance, coupons, QR Codes, referrals, commissions and disputes.
• Guia Lupa team: access data, roles and audit logs of administrative actions.

Data generated by use

• Device and access: IP address, port, date and time, device, operating system, app version, language, notification (push) identifiers, active sessions, installation source (when the app is opened through a brand link) and security logs.
• Location: with your permission, the device's approximate or precise location to show nearby professionals and calculate distances; without it, the chosen region.
• Usage: screens and features used, views of profiles, showcases and stories, clicks, searches without results and recent areas, for operation, professionals' statistics and service improvement.
• Consents and preferences: records of acceptance of this document (version, date, IP and device), permissions granted and withdrawn, theme, language and notification preferences.
• Subscriptions and purchases: plan, status, dates, store, purchase identifiers and receipts provided by Google Play, the App Store and the subscription management service. We do not receive your card number.
• Artificial intelligence and voice: text requests, audio recorded while you hold the assistant button (up to the time limit shown), transcripts, answers and confirmed entries.
• WhatsApp: messages, audio, media, delivery and read status and transcripts of conversations from the number connected by the professional, and messages sent by the Platform.
• Camera, microphone and photos: used only when you trigger the feature (scanning a QR Code, taking or choosing photos and videos, recording a request to the assistant). Content is only sent if you confirm.

Data received from third parties

• Google and Apple: name, email, photo and identifier when you sign in with those accounts. With Apple, you can hide your email.
• Professionals who register you as a client.
• App stores and the subscription management service: status of subscriptions, renewals, refunds and offers.
• Meta/WhatsApp: messages and delivery status.
• Affiliates: the coupon or QR Code used for your subscription.

36. Sensitive and health data

• Certificates, statements, records and notes from health professionals may contain health data, which is sensitive data under the LGPD.
• This data is processed for health protection, in procedures performed by health professionals, to comply with legal or regulatory obligations and, where required, with specific consent. The ICD code only appears on the certificate with the patient's authorization.
• Access is restricted to the responsible professional, the team members they authorize and the patient. The professional decides whether the certificate link shows the full document or only its authenticity.
• We ask professionals not to record unnecessary sensitive information in free-text fields or conversations.
• We do not use health data for advertising, profiling or any purpose other than the one that justified its collection.

37. How we use data

• Creating and maintaining your account, authenticating access, confirming your phone and maintaining sessions.
• Showing professionals by region, category and service, profiles, showcases, stories and brands.
• Making, confirming, reminding, rescheduling and cancelling appointments and managing waiting lists and recurrences.
• Linking to your account records created by professionals with your confirmed phone.
• Providing professionals with management tools, team features, privacy between professionals, White Label branding, WhatsApp and AI.
• Issuing receipts and certificates and allowing authenticity verification.
• Processing subscriptions, credits, coupons, commissions, closings and affiliate payments.
• Sending notifications, emails, WhatsApp messages and SMS about the account, appointments, security, invitations, subscriptions and charges.
• Responding to support requests, reviewing reports, moderating content and disputes.
• Preventing fraud, abuse and unauthorized access and protecting the Platform and users.
• Complying with legal and regulatory obligations and exercising rights in proceedings.
• Improving the Platform, fixing errors, measuring use and maintaining the catalog of categories and search terms, preferably with aggregated data.
• With your permission: WhatsApp messages with news and offers, AI features, use of the device's location and usage statistics.

38. Legal bases

39. Who we share with

We do not sell personal data. We only share what is necessary, with:

• Professionals and their teams: when you book, purchase, add a brand or are registered by them, they receive your name, phone, email, home visit address and booking details, according to each member's permissions.
• Other users: what is public by nature, such as professional profiles, reviews (with your display name and photo), comments and likes on stories.
• Affiliates: the affiliate sees the subscribers who used their coupon with an abbreviated name, plan and subscription status, without access to client data.
• Authorities: when there is a legal obligation, court order or request from a competent authority, or to protect rights, always within the limits required.
• Corporate transactions: in the event of a merger, acquisition or reorganization, with the protections of this document maintained.
• Providers that operate the Platform, under contract and only for these functions, listed in the table below.
• Shop orders: when you place an order, the business receives your name, phone number, the products, the fulfillment option, the delivery address, the note and the receipt you upload, in order to fulfill the order.

40. International transfer

Some providers (such as Google, Apple, Amazon Web Services, Meta, RevenueCat and xAI) may store or process data outside Brazil, including in the United States and the European Union. In these cases, we adopt the safeguards provided for in the LGPD (art. 33) and ANPD regulations, such as contractual clauses and choosing providers with adequate protection standards.

41. What is visible to others

• Published professional profile: trade name, logo, cover, presentation, categories, city and service area, address (full only when the professional allows), public contacts, social networks, services, prices, available times, portfolio, showcases, stories, team, displayed professional registrations and reviews.
• Clients: your display name and photo appear on reviews and comments you post. Your phone, email and address are not public.
• Certificates and receipts: anyone with the link or QR Code can open the document or the authenticity confirmation, as chosen by the professional.

42. If a professional registered you

• Professionals may register clients manually, including people without a Guia Lupa account. In this case, the professional is the controller and is responsible for the legal basis and for informing you.
• If you confirm on Guia Lupa the same phone used in that record, you will see in your account the appointments, packages, receipts and certificates linked to it. The professional's internal notes remain visible only to them and the authorized team.
• Requests to access, correct or delete this data should be made to the professional. If you contact us, we will help forward them.
• When you delete your account, appointments, receipts and records remain with the professionals, without any link to your account.

43. Location and device permissions

• The device's location is only used with your permission, while you use the app, to show nearby professionals and calculate distances. You can deny or withdraw permission at any time.
• Camera, microphone, photos, Face ID or biometrics and motion sensors are used only for the purposes described in the device's permission requests.
• Professionals who use routes only see the addresses of home visits that they themselves have on their calendar.

44. Artificial intelligence, voice and automated decisions

• When you use an AI feature, we send the provider the text or audio of the request and the data needed to answer it (for example, available times, services or dashboard entries you have access to). Audio is transcribed to text.
• The knowledge base used by training and the assistant contains the Platform manual, not users' personal data.
• Conversations with the AI Assistant remain in your history and can be deleted in Privacy and data › Clear my data.
• We do not use AI to make decisions affecting your rights without the possibility of human review. You can request a review of automated decisions through the DPO contact (LGPD, art. 20).
• AI features depend on your permission and can be turned off at any time.

45. Cookies and on-device storage

The website and the app store in the browser or device only what is necessary to keep you signed in, protect the session, remember preferences (theme, language, city, chosen brand, recent searches and areas) and speed up loading. We do not use advertising cookies or tracking across third-party apps and websites. Website fonts and libraries may be loaded from third-party services, which receive technical access data. You can clear this data in your browser or in Privacy and data › Clear my data.

46. How long we keep data

We may keep data longer when necessary to comply with the law, resolve disputes, prevent fraud or exercise rights, always for the minimum time necessary.

47. Your rights and how to exercise them

Under the LGPD (art. 18), you may request: confirmation that we process your data; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; portability; deletion of data processed based on consent; information about who we share with; information about the possibility of not consenting and its consequences; withdrawal of consent; objection to processing; and review of automated decisions.

Many of these controls are in the app and on the website. Others can be requested from the DPO. We may verify your identity before responding, to protect you, and we respond within the legal deadlines. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD) and consumer protection bodies.

48. Privacy controls, clearing data and deleting the account

Under Account › Privacy and data (app) or My account › Privacy (website), you can:

• Grant or withdraw permissions for WhatsApp, news and offers, AI assistant, location and usage statistics.
• View and end sessions open on other devices and sign out of all of them.
• Clear my data: deletes favorites, saved addresses, notifications, AI assistant conversations, date of birth, gender and location, as well as recent searches and areas on the device or browser. The account, appointments and receipts remain.
• Delete account: immediately (permanent) or scheduled for 30 days (signing in again during that period cancels the request). On deletion, name, email, phone, ID document, photo, addresses and location are erased; sessions, devices, favorites, notifications, conversations, two-factor authentication, blocks and brand links are removed; and the sign-in account is deleted. A protocol number is generated.
• For security, clearing and deleting require a 6-digit code sent to the confirmed phone (WhatsApp or SMS), valid for 10 minutes with limited attempts, or, without a confirmed phone, the confirmation word.
• Situations that prevent immediate deletion are shown beforehand: professional profile with an active subscription (cancel in the store and contact support), affiliate with commissions, administrators and scheduled appointments (cancel them first).
• You can also request deletion without the app, by emailing the DPO.

49. Security and incidents

• We use encrypted connections (HTTPS), encryption of sensitive data in the database, links with unguessable tokens, role- and permission-based access control verified on the server, two-factor authentication in the administrative and affiliate areas, confirmation codes with expiry and limited attempts, and audit logs.
• Guia Lupa team members who access data have access limited to what is necessary and a duty of confidentiality.
• No system is completely immune to incidents. If an incident occurs that may cause relevant risk or harm, we will notify the affected data subjects and the ANPD, as required by law and regulations.
• You also help: do not share verification codes, keep your device protected, use a strong password and end sessions you do not recognize.

50. Children and adolescents

Guia Lupa is not intended for people under 18 without the assistance of a legal guardian and is not directed at children. When a professional serves children or adolescents and registers their data, they must do so in the child's best interest and with the consent of a parent or guardian, where required (LGPD, art. 14, and the Brazilian Child and Adolescent Statute). If you become aware of minors' data being processed improperly, contact the DPO so it can be removed.

57. Controller and contact

Questions, requests, complaints, notices and exercise of personal data rights: contato@guialupa.com.br or through support in the app (Account › Support; for professionals, More › Support) and on the website (My account › Support). Each request receives a protocol number.

The identification details of the party responsible for the Platform and of the data protection officer appear in the box below.