This Privacy Policy explains how the Capilu app ("app") handles your personal data, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD) and other applicable laws.
By using the app, you confirm that you have read and understood this policy.
1Who controls your data
The app is developed and operated by Redarock (57.227.642 RODRIGO AUGUSTO FERREIRA FERNANDES, CNPJ 57.227.642/0001-45, Rio de Janeiro, Brazil), which is responsible for decisions about the processing of your personal data.
For any privacy matter, including contacting our data protection officer, use the email below.
Contact: redarock.apps@gmail.com
2Data we collect and why
- Account email and password: used to create your account, authenticate access and recover your password. The password is stored encrypted by the authentication provider and we cannot see it.
- Anonymous identifier created by the app, device platform and usage dates: used to keep your access and subscription without asking you to sign up. It contains no name, email or phone number.
- Hair profile and routine (questionnaire answers, cycles, washes, products with name and time, reminders and notes): used to build your routine, show your history and keep a copy so you lose nothing when you change phones.
- Hair and product photos, only if you turn on the cloud copy: used to keep a copy so you can get your photos back when you change phones. With the copy off, photos stay only on your device and never reach us. They are kept until you delete them or your account.
- Purchase history and subscription status: used to unlock purchased features. Payment details (such as cards) are handled by Google or Apple and never reach us.
- Technical data and crash reports (device model, OS, app version): used to find and fix errors.
- Technical usage records (creations requested, failures, purchases, reports and errors, without photo content), tied to your identifier: used to investigate and fix problems and prevent abuse. They are kept for 30 days and then deleted automatically.
We do not collect precise location, contacts, photos, microphone or camera data unless listed above.
3Legal bases
- Performance of a contract: to create your account and provide the app features.
- Legitimate interests: for security, fraud prevention and improving the app, always respecting your rights.
- Legal obligations: to keep records required by law.
4Who we share data with
We do not sell your data. We only share it with service providers that operate the app on our behalf, under contract and with data protection obligations:
5Sign-in and account
- You can use the app without signing up, with an anonymous identifier, and still subscribe.
- If you want an account, you can sign in with Apple, with Google or with email and password. We receive the identifier and email provided by that service; if you use Apple’s option to hide your email, we only receive the address Apple created.
6Scalp and health
- Your answers about scalp signs stay only on your device. They are never sent to us and do not go into technical records.
- The app does not collect health data for any other purpose. Health matters are for a dermatologist.
7International transfers
Our providers may store and process data on servers outside Brazil, such as in the United States. In those cases, transfers are made with appropriate safeguards as required by articles 33 to 36 of the LGPD.
8How long we keep data
- Profile, routine and, if you turned on the cloud copy, photos: until you delete them or your account.
- Technical usage and crash records: 30 days.
- When you delete your account in the app, your data is erased immediately; email requests are completed within 30 days.
- App access logs are kept for 6 months, as required by the Brazilian Internet Civil Framework (Law No. 12,965/2014, art. 15).
- Data may be kept longer only when required by law, to defend legal claims, or in anonymized form.
9Your rights
You may request at any time:
- Confirmation that we process your data and access to it.
- Correction of incomplete, inaccurate or outdated data.
- Anonymization, blocking or deletion of unnecessary or unlawfully processed data.
- Data portability.
- Deletion of your data and account.
- Information about who we share your data with.
- Withdrawal of consent, where applicable.
10How to delete your account
In the app, go to Settings > Delete account. You can also request deletion without opening the app at: https://redarock.com.br/en/apps/capilu/delete-account
11Security
We use technical and organizational measures to protect your data, such as encrypted connections (HTTPS), access control and database security rules. No system is completely secure, but we work to reduce risks and will report relevant incidents as required by law.
12Children
The app is not directed to children under 13, and we do not knowingly collect data from people under that age. If you are a parent or guardian and believe a child has given us data, contact us so we can delete it.
13Changes to this policy
We may update this policy. The last update date is shown at the top of this page, and material changes will be communicated in the app or by email.
14Contact and complaints
Contact us at the email below. You also have the right to lodge a complaint with the Brazilian Data Protection Authority (ANPD): https://www.gov.br/anpd
Contact: redarock.apps@gmail.com