Privacy Policy
Last updated: August 15, 2026 · Effective: August 15, 2026
This Privacy Policy explains how BARETTA ASSESSORIA COMERCIAL LTDA (“Nudge Buddy”, “we”, “us”), a company registered in Brazil under CNPJ 08.763.857/0001-75, with address at Avenida Barão de Monte Mor, 633, Real Parque, São Paulo — SP, CEP 05687-010, Brazil, collects, uses, shares, and protects your personal data when you use the Nudge Buddy website and application (the “Service”).
We are the data controller for the personal data described here. Nudge Buddy is a writing coach: you paste your own writing and we return questions, a score, and flags — we never write or rewrite your text.
If you are in Brazil, this Policy is designed around the Lei Geral de Proteção de Dados (LGPD, Law No. 13.709/2018). If you are in the European Economic Area or the United Kingdom, the GDPR/UK GDPR sections apply to you. If you are a California resident, see the California section. Where laws differ, we apply the protection most favorable to you.
1. A note on who this Service is for (age)
The Service is intended for people 13 years of age or older. We do not knowingly collect personal data from children under 13.
If you are under 18, you may use the Service only with the involvement and consent of a parent or legal guardian, who accepts these terms on your behalf. We may ask you to confirm your age and, where required by law, to provide evidence of parental/guardian consent. If we learn we have collected data from a child under 13, or from a minor without the required parental consent, we will delete it. Parents/guardians may contact us at privacy@nudgebuddy.app to review, correct, or delete a minor's data.
Because the Service is aimed in part at students, we ask parents, teachers, and schools to review this Policy with younger users.
2. The personal data we collect
a) Account data — your email address, a hashed password (we never see your plaintext password; authentication is handled by Supabase), and, optionally, your display name.
b) Your content — the text (“drafts”) you paste or import to be analyzed, the documents and versions you save, the folders you create, and the analyses/scores generated from your drafts. Your drafts are your writing; we treat them as confidential.
c) Onboarding preferences (optional) — what you mostly write, your role, and how you heard about us. Used to tailor your experience and understand our audience.
d) Usage & technical data — IP address, approximate location derived from IP, browser/device information, pages viewed, actions taken, and daily usage counts used to enforce fair-use limits and prevent abuse.
e) Cookies & similar technologies — see Section 9.
f) Waitlist data — if you join the Pro waitlist, your email address and the context in which you asked.
We do not intentionally collect sensitive personal data (LGPD Art. 5, II / GDPR Art. 9). Please do not paste highly sensitive information (health, biometric, financial account numbers, government IDs) into your drafts.
3. How we use your data, and our legal bases
| What we do | Personal data | Legal basis (LGPD / GDPR) |
|---|---|---|
| Create and secure your account; log you in | Account data | Performance of a contract (LGPD Art. 7, V / GDPR 6(1)(b)) |
| Analyze the draft you submit and return questions, scores, and flags | Your content | Performance of a contract; and, where required, your consent (LGPD Art. 7, I & V / GDPR 6(1)(a)&(b)) |
| Save your drafts, versions, folders, and reports so you can return to them | Your content | Performance of a contract |
| Enforce daily limits, detect abuse, and protect the Service | Usage & technical data | Legitimate interest / protection of credit and fraud prevention (LGPD Art. 7, IX / GDPR 6(1)(f)) |
| Product analytics to improve the Service | Usage data (see cookies) | Consent (LGPD Art. 7, I / GDPR 6(1)(a)) |
| Email you about the Pro waitlist you joined | Waitlist email | Consent (LGPD Art. 7, I / GDPR 6(1)(a)) |
| Tailor onboarding | Onboarding preferences | Consent |
| Comply with legal obligations and defend our rights | As needed | Legal obligation / regular exercise of rights (LGPD Art. 7, II & VI) |
We do not sell your personal data, and we do not use your drafts for advertising.
4. AI processing of your drafts (Anthropic)
To generate the analysis, the text you submit is sent to Anthropic, our AI model provider, and processed in the United States.
- Not used for training. Anthropic does not use inputs or outputs submitted through its API to train its models.
- Limited retention. Anthropic may retain API inputs and outputs for a limited period (generally up to 30 days) for trust-and-safety and abuse-monitoring purposes, after which they are deleted, unless a longer period is required by law.
- Anthropic acts as our data processor / sub-operator and processes your text only to return the analysis to you.
We also cache the analysis result for up to 24 hours (keyed by a one-way hash of your text) so that re-running identical text is instant and costs nothing; this cache auto-expires.
5. Who we share data with (sub-processors)
We share personal data only with service providers (“sub-operators” under LGPD / “processors” under GDPR) that help us run the Service, under contracts requiring them to protect it. We do not share your data with third parties for their own marketing.
| Provider | Purpose | Data | Location |
|---|---|---|---|
| Supabase | Database & authentication (stores your account, drafts, analyses) | Account data, content | Canada (ca-central-1) |
| Anthropic | AI analysis of your draft (see Section 4) | Your submitted text | United States |
| Upstash (Redis) | Rate-limit counters and 24h result cache | Usage counters, hashed text + analysis result | United States / global |
| Vercel | Application hosting and delivery | Technical/usage data, request logs | United States / global |
| PostHog | Product analytics (consent-gated) | Usage/analytics events (incl. your user ID and email for signed-in users) | United States |
| Resend | Transactional & lifecycle email (confirmation, activation, receipts) | Email address, name | United States |
| Cloudflare (Turnstile) | Bot/abuse protection on sign-in (if enabled) | IP address, challenge token | United States / global |
| Mercado Pago | Pro payment processing (Pix, boleto, card) and invoicing | Email, purchase identifier, and payment data | Brazil |
We may also disclose data when required by a valid legal request, to protect our rights or users' safety, or as part of a merger/acquisition (with notice).
6. International data transfers
Your data may be processed outside your country, including in Canada (where your account data, drafts, and analyses are stored) and the United States (AI analysis and certain infrastructure providers). Where we transfer personal data internationally, we rely on lawful transfer mechanisms — for LGPD, transfers permitted under Art. 33 (adequate level of protection, standard contractual clauses, or your consent); for GDPR/UK GDPR, an adequacy decision (Canada benefits from a partial adequacy decision) or Standard Contractual Clauses. You may request a copy of the safeguards at privacy@nudgebuddy.app.
7. How long we keep your data
- Drafts, documents, analyses, folders: kept until you delete them or close your account. Deleting a draft deletes its text and reports; deleting your account removes your content (see Section 8).
- Account data: kept while your account is active.
- Anthropic processing: see Section 4 (≤30 days at Anthropic; 24h in our cache).
- Usage/security logs & rate-limit counters: short-lived; counters expire within ~48 hours.
- Waitlist data: kept until Pro launches or you ask to be removed.
- We may retain limited data longer where required to comply with legal obligations or to resolve disputes.
8. Your rights
Subject to applicable law, you may:
- Confirm whether we process your data and access it;
- Correct incomplete, inaccurate, or outdated data;
- Delete / anonymize your data, and close your account (you can delete your account and its data from Account → Settings, or by contacting us);
- Port your data to another provider;
- Restrict or object to certain processing;
- Withdraw consent at any time (e.g., turn off analytics, or leave the waitlist) — this does not affect processing already carried out;
- Information about the entities we share data with;
- Lodge a complaint with a supervisory authority — in Brazil, the ANPD (autoridade nacional de proteção de dados); in the EEA/UK, your local authority.
California residents: you have the right to know, delete, correct, and to opt out of “sale”/“sharing” of personal information. We do not sell or share your personal information as those terms are defined under the CCPA/CPRA, and we do not discriminate against you for exercising your rights.
To exercise any right, contact privacy@nudgebuddy.app. We respond within the timeframes set by law (LGPD: without undue delay; GDPR: within 30 days). We may need to verify your identity first.
9. Cookies & tracking
- Essential cookies (always on): authentication/session cookies (Supabase) that keep you signed in. These are necessary for the Service to work and do not require consent. (Free daily limits are enforced server-side, not by a tracking cookie.)
- Analytics (consent-based): we use PostHog to understand product usage. Analytics only run after you consent via our cookie banner, and you can change your choice at any time. If you decline, the Service still works fully.
We honor Global Privacy Control (GPC) and “Do Not Track” signals where required.
10. Security
We use industry-standard measures: encryption in transit (HTTPS), hashed passwords, row-level security so each user can only access their own data, access controls, and rate limiting. No system is perfectly secure; if a breach affecting your personal data occurs, we will notify you and the competent authority as required by law (LGPD Art. 48).
11. Data controller & contact / DPO
Controller: BARETTA ASSESSORIA COMERCIAL LTDA — CNPJ 08.763.857/0001-75 — Avenida Barão de Monte Mor, 633, Real Parque, São Paulo — SP, CEP 05687-010, Brazil. Data Protection Officer (Encarregado, LGPD Art. 41): Frederico Vidigal Simon — privacy@nudgebuddy.app.
For any privacy question or to exercise your rights, write to privacy@nudgebuddy.app.
12. Changes to this Policy
We may update this Policy. If we make material changes, we will notify you (e.g., by email or an in-app notice) before they take effect. The “Last updated” date above always reflects the current version. Your continued use after an update means you accept the revised Policy, to the extent permitted by law.