Privacy Policy

1. Who we are

ParensUP is a family routine organization app developed and published by Danilo Ascencio Peres (developer "Danilo Ascencio" on the Google Play Store), partner and owner of DAP DIGITAL LTDA, the company that operates the app, registered under CNPJ No. 43.073.684/0001-64, headquartered at Rua Pais Leme, 215, Conjunto 1713, Pinheiros, São Paulo/SP, ZIP 05424-150, Brazil. DAP DIGITAL is the controller of personal data processed in ParensUP, under art. 5, item VI, of the Brazilian General Data Protection Law (LGPD).

For privacy and data protection matters, contact our Data Protection Officer (DPO), Danilo Ascencio Peres, at: privacy@parensup.com.

2. Who this Policy applies to

This Privacy Policy applies to all ParensUP users, including:

• Legal guardians who create an account in the app;
• Children and teenagers whose profiles are created by those legal guardians;
• Anyone who interacts with our services in Brazil, the United States, the European Union, the United Kingdom, or other countries where the app may be accessed.

3. What data we collect

We collect only the data necessary for the app to function. In general, this data is provided directly by the legal guardian at the time of use.

• Legal guardian data: name, email, password stored in encrypted form, and account preferences.
• Child profile data: name or nickname, avatar, and age or age range, all entered by the legal guardian.
• Routine data: tasks, goals, rewards, occurrences, and progress recorded in the app.
• Device and usage data: device model, operating system, anonymous session identifier, error reports, and technical events used for diagnostics, security, and app improvement.
• Premium subscription data: transaction confirmations received from Google Play or the Apple App Store. ParensUP does not collect or store credit card data.

We do not automatically collect any data beyond what is strictly necessary for the app to function, for its security, and for its continuous improvement.

4. What data we do not collect

To reinforce our commitment to transparency, we expressly declare that ParensUP does not collect:

• Biometric data, such as fingerprint, facial recognition, or voice recognition;
• Precise real-time location data, such as GPS;
• Contacts, photos, or files stored on the device, except those you voluntarily add to the app;
• Sensitive personal data, such as racial or ethnic origin, religious beliefs, union affiliation, data related to health, sexual life, or sexual orientation, under Art. 11 of the LGPD;
• Financial information, such as credit card numbers or bank data. Premium subscriptions are processed entirely by Google Play or the Apple App Store.

Although we do not request sensitive personal data, ParensUP offers free-text fields to describe tasks, rewards, and occurrences. The content the legal guardian enters in these fields is their sole responsibility. Sensitive data incidentally recorded (for example, references to health, religion, or eating habits) is not handled in a differentiated way by ParensUP, but follows the same security measures applied to other data. We recommend that the guardian avoid including, in these fields, sensitive information that is not necessary to organize the routine.

5. Why we use the data (purposes)

We use personal data only for legitimate, specific purposes related to the app's operation, including:

• Enabling account creation, profile synchronization, routine display, and progress tracking;
• Sending notifications authorized by you, such as task reminders and alerts;
• Processing Premium subscriptions through Google Play or the Apple App Store;
• Generating progress reports and statistics for legal guardians;
• Analyzing aggregated and, where possible, anonymized data to identify flaws, fix errors, and improve app performance;
• Handling support requests and enabling the exercise of data protection rights;
• Complying with legal, regulatory, or competent authority requirements.

6. Legal bases for data processing

The processing of personal data performed by ParensUP is based on applicable legal grounds, including those provided in art. 7 of the LGPD and, where applicable, art. 6 of the GDPR:

• Consent, when there is a valid expression from the data subject or the legal guardian, subject to the note below for data of children and teenagers;
• Contract performance, when processing is necessary to deliver the requested services, such as the use of the app and the Premium subscription;
• Compliance with a legal or regulatory obligation, when processing is required by law or by a competent authority;
• Legitimate interest, for purposes of service security, fraud prevention, technical support, and app improvements, always respecting the fundamental rights and freedoms of the data subject.

For the processing of personal data of children, the applicable legal basis is the specific, prominent consent given by at least one parent or by the legal guardian, under art. 14, §1, of the LGPD. The legal bases of contract performance and legitimate interest are not used as grounds for processing children's data.

7. Children and teenagers

ParensUP is a family routine organization app intended for use by legal guardians and the children or teenagers in their family. Data about children and teenagers is always provided by an adult legal guardian when creating a child or teenager profile within their own account. The child or teenager does not create an account directly. To create a ParensUP account, the legal guardian must be at least 18 years old or have reached the age of majority applicable in their country of residence.

Optionally, the legal guardian may enable an individual login so that the child or teenager can access the app on their own device. This login consists of a user identifier generated automatically by the system and a password set by the legal guardian. The child or teenager will only access the profile created by the guardian, without needing to provide new personal data.

When creating the child's or teenager's profile, the legal guardian declares to act in that capacity and authorizes the processing of personal data under the terms of this Policy. The processing of personal data of children is carried out in their best interest, as provided in art. 14 of the LGPD, and, where applicable, based on specific and prominent consent given by at least one parent or legal guardian.

Consent is requested during the account and child or teenager profile creation flow, through the legal guardian's registration and validation of the provided email address. When required by applicable law, ParensUP may adopt additional appropriate mechanisms to verify the legal guardian's authorization.

The legal guardian may, at any time, edit or delete the child's or teenager's profile directly in the app, and may also request complete deletion of the data as indicated in Section 17.

ParensUP operates in compliance with the Digital Statute of Children and Adolescents (Brazilian ECA Digital). By design (privacy by design), the app does not allow social interaction between minors, does not display advertising, does not offer open chat, and adopts the legal guardian as the only agent authorized to create and manage the content linked to the child's or teenager's profile. Parental supervision features — including the creation, editing, and deletion of tasks, rewards, occurrences, and profiles — are integrated into the core of the product.

When more than one legal guardian is linked to the same family profile, any authorized guardian may edit data, record tasks and occurrences, and exercise the rights set out in this Policy on behalf of the child or teenager. In the event of conflict between guardians (including cases of shared custody or family disputes), ParensUP may, upon a justified request, suspend disputed changes until the presentation of a document proving exclusive legal representation.

We do not serve targeted advertising to children or teenagers, do not sell their personal data, and do not share this data with third parties for commercial purposes.

8. Sharing with third parties

We do not sell, rent, or share personal data with third parties for marketing purposes. We share data only with contracted operators and service providers who support the app's operation, always under contractual obligations of confidentiality, data protection, and information security, and, where applicable, through appropriate legal instruments for international data transfers, in particular the Standard Contractual Clauses approved by the Brazilian Data Protection Authority (ANPD Resolution CD/ANPD No. 19/2024) and, where the GDPR applies, the European Commission's Standard Contractual Clauses.

Currently, we may share data with the following operators and service providers:

• Cloudflare (Cloudflare, Inc., United States): hosting, content delivery (CDN), attack protection, and aggregated visit metrics for the institutional website, without tracking cookies.
• Heroku (Salesforce, Inc., United States): hosting of the application server and the PostgreSQL database that stores account, profile, and routine data.
• Google Firebase (Google LLC, United States): authentication, aggregated usage analytics, error diagnostics (Crashlytics), and push notifications (Firebase Cloud Messaging).
• RevenueCat (RevenueCat, Inc., United States): management and validation of Premium subscriptions, receiving the account identifier and the transaction metadata reported by the app stores.
• Google Play Billing (Google LLC, United States) and Apple App Store (Apple Inc., United States): processing of Premium subscription payments on Android and iOS devices, respectively.
• Mailgun (Mailgun Technologies, United States): sending of transactional emails, such as account verification, password reset, and operational app notifications.
• Sentry (Functional Software, Inc., United States): server-side error monitoring and logging for technical diagnostics and bug fixing.
• New Relic (New Relic, Inc., United States): server performance monitoring (APM) to track latency, availability, and application health.
• Formspree (Formspree, Inc., United States): receipt of messages submitted through the contact form and of feedback comments submitted by users on the Help Center articles of the institutional website.
• Google Analytics (Google LLC, United States): audience measurement and aggregated analysis of institutional website usage, through cookies and exclusively based on your consent, without the use of advertising features or ad association.

In addition, the child's or teenager's profile data may be shared among authorized guardians linked to the same family, to the extent necessary for the operation of essential app features.

9. Data retention and deletion

We keep personal data only for as long as necessary to fulfill the purposes described in this Policy, subject to applicable legal bases and, where required, legal or regulatory retention periods, under art. 16 of the LGPD.

In general:

• Active account: data is kept while the account remains active and the app is in use;
• After account deletion: primary data may be removed within 30 days, and data stored in encrypted backups may be removed within 90 days, according to the technical backup replacement cycle;
• Technical records, logs, and error reports: may be kept for up to 90 days for security, fraud prevention, audit, and technical diagnostics purposes;
• Data related to subscriptions and tax obligations: may be kept for the applicable legal period, including to comply with tax and accounting obligations;
• Aggregated and anonymized data: may be kept indefinitely, provided it does not allow direct or indirect identification of the data subject.

For personal data of children and teenagers, we apply stricter criteria: the data is kept exclusively while the profile is active in the legal guardian's account and is not used for secondary purposes. After deletion of the profile or account, the same timeframes described above apply, with no extension based on legitimate interest or any subsequent reuse.

You may request the complete deletion of your account and the data linked to it at any time, directly in the app, under Settings > Legal and privacy > Delete account. After confirmation, we begin the deletion process within the timeframes described in this Section.

10. International data transfers

Your personal data may be processed and stored on servers located outside Brazil, including in the United States, where some of our service providers operate, such as cloud infrastructure, authentication, usage analytics, and technical processing.

When international data transfers occur, we will adopt appropriate measures to ensure the protection of that information, in compliance with art. 33 of the LGPD, Chapter V of the GDPR where applicable, and other applicable data protection regulations. These measures may include entering into the Standard Contractual Clauses approved by the ANPD (ANPD Resolution CD/ANPD No. 19/2024), the European Commission's Standard Contractual Clauses (where the GDPR applies), and adopting technical and organizational safeguards, such as encryption in transit and at rest.

11. Data security

We adopt reasonable technical and organizational measures to protect personal data against unauthorized access, loss, destruction, alteration, disclosure, or any form of improper or unlawful processing.

These measures include, among others, the use of encryption in transit and at rest, access controls aligned with each role's needs, security monitoring, technical logging, and continuous updates to our systems and tools.

Although no system is completely immune to risk, we continuously work to improve our security mechanisms in order to reduce the likelihood of incidents and protect the information processed by ParensUP.

12. Security incidents

If a security incident occurs that may cause relevant risk or harm to data subjects, we will take the appropriate measures required by applicable law, including notifying the Brazilian Data Protection Authority (ANPD) and the affected data subjects, when required by art. 48 of the LGPD.

Whenever necessary, this communication may include information about the nature of the affected data, the risks involved, the technical and administrative measures adopted to mitigate the incident's effects, and, where applicable, guidance for the data subjects.

13. Your rights as a data subject

Under art. 18 of the LGPD, you — or the legal guardian, in the case of child or teenager data — may exercise the following rights regarding your personal data:

• Confirmation of processing: know whether we process your data;
• Access to data: request access to the personal data we hold about you;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion: where applicable, especially when data is unnecessary, excessive, or processed in non-compliance with the law;
• Portability: request delivery of the data in a structured format, subject to commercial and industrial secrets and applicable regulations;
• Information about sharing: know which public or private entities your data may be shared with;
• Information about the possibility of not giving consent and the consequences of that refusal, when consent is the applicable legal basis;
• Withdrawal of consent, when processing is based on this legal basis.
• Petition the ANPD: submit a complaint to the Brazilian Data Protection Authority regarding the processing of your personal data.
• Objection: object to processing carried out under any of the legal grounds that dispense with consent, in case of non-compliance with the LGPD.

For your convenience, two of these rights are available directly in the app, under Settings > Legal and privacy: full account deletion and download of your data in a structured format.

To exercise the remaining rights, or if you prefer to submit your request through another channel, contact us at: privacy@parensup.com.

We respond to requests within up to 15 business days, except in cases where applicable law requires a different period.

14. Region-specific rights

In addition to the rights provided by Brazilian law, some users may have additional rights under the laws of the country or region where they are located.

Users in the United States (COPPA — Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501–6506): ParensUP collects data from children under 13 only after the legal guardian's registration and confirmation of consent through the email address provided. The data collected about the child is limited to name or nickname, age or age range, avatar, and routine data entered by the guardian. ParensUP does not condition the child's participation in the app on the disclosure of more information than is strictly necessary. The legal guardian may, at any time: (i) review the data collected about the child; (ii) refuse authorization for any future collection or use; (iii) request deletion of the data, directly in the app or through the channel indicated in Section 17. For more information or to exercise these rights, contact the Data Protection Officer at privacy@parensup.com.

Users in the European Union and the United Kingdom (GDPR): when the GDPR applies to the data processing performed by ParensUP, the data subject may exercise the rights set out in arts. 15 to 22 of the GDPR, as applicable, and may also lodge a complaint with the competent data protection authority in their country.

Users in California (CCPA/CPRA) and in other U.S. states with state privacy laws: the data subject may exercise the rights of access, correction, deletion, portability, and the right to know the categories of personal data collected, the business purposes, and the categories of third parties with whom the data has been shared. The categories of personal information that ParensUP collects correspond to identifiers, commercial information (subscription information), internet or other electronic activity (app usage events), and data voluntarily provided by the legal guardian. ParensUP does not sell or share personal data of users, including personal data of minors under 18, for cross-context behavioral advertising across third-party sites or apps, regardless of consent. This statement also applies to the requirements of the state laws of Connecticut (SB 3), Maryland (MODPA), New York (Child Data Protection Act), and Texas (TDPSA), where applicable.

15. Cookies and identifiers

ParensUP's mobile app, being native, does not use browser cookies.

The ParensUP institutional website uses two visit analytics tools: Cloudflare Web Analytics, which does not use cookies, does not collect individual IP addresses, and does not track visitors across sites; and Google Analytics (Google LLC), which uses cookies to measure audience and understand how the site is used, in order to improve its performance and your browsing experience, without the use of advertising features or ad association.

Google Analytics cookies are used only with your consent, requested through the cookie notice shown on your first visit to the site. You may accept or decline their use and, later, review or change this choice at any time through the "Cookies" link available in the site footer. If consent is not granted, no Google Analytics cookies will be installed.

The website also stores in the browser only your theme preference (light or dark), via local storage (localStorage), exclusively for interface personalization purposes, with no tracking purpose.

Within the app, technical identifiers or instance identifiers may be used, without any behavioral advertising purpose, to enable essential features, security, fraud prevention, technical diagnostics, and aggregated usage analytics.

ParensUP does not use advertising identifiers to display targeted ads to children and does not engage in behavioral advertising for children.

16. Changes to this Policy

This Privacy Policy may be updated periodically to reflect legal, regulatory, operational, or feature-related changes to ParensUP.

When material changes occur, we may notify users through the app, by email, or through other appropriate channels. The date of the latest update will always appear at the beginning of this document.

Continued use of ParensUP after the updated version of this Policy takes effect may be interpreted in accordance with applicable law and the nature of the change made. Where required by law, we will request renewed consent or adopt other appropriate measures before the changes take effect.

17. Contact

For questions, requests related to the exercise of rights described in Section 13, or complaints about this Privacy Policy, contact us through the following channel:

Email: privacy@parensup.com

We respond to requests within up to 15 business days, except in cases where applicable law requires a different period.

In Brazil, you may also contact the Brazilian Data Protection Authority (ANPD) through the official channels available on its institutional portal.

ParensUP has designated the email address above as the official channel of communication with the data subject, pursuant to ANPD Resolution No. 2/2022.