Skip to content
subfaro
← Back to home

Privacy policy

Version 1.1 — effective October 22, 2026

This policy explains how Subfaro handles personal data on the website (subfaro.com), the web app (app.subfaro.com), the Android and iOS apps and the AI assistant integration. It follows Brazil's General Data Protection Law (LGPD, Law No. 13,709/2018), the Brazilian Internet Civil Framework (Law No. 12,965/2014) and Consumer Protection Code and, for people using Subfaro outside Brazil, the rules in section 9.

In short: we keep what Subfaro needs to work — your account, your preferences and the subscriptions you add. We never ask for your bank login, and card details for Pro are handled only by Stripe. We don't sell personal data, don't share it for advertising and don't use ad trackers. You can export or delete everything from inside the app.

1. Who is responsible

Subfaro is provided by GZ SEGURANÇA E DEFESA CIBERNÉTICA LTDA, a Brazilian company registered under CNPJ 40.988.106/0001-60, based in Cascavel, Paraná, Brazil, which acts as the controller of the personal data described here.

  • Data Protection Officer (Encarregado): [DPO name to be defined]
  • Privacy contact and rights requests: privacidade@subfaro.com

2. What we collect

  • Account: name, email and password. The password is stored only as a bcrypt hash; no one on the team can read it.
  • Preferences: language, country used for prices, currency, how many days ahead you want reminders and your IOF and card spread percentages.
  • Subscriptions you add: service, plan, price, dates (start, next payment, trial end), the name of the payment method (for example "credit card" or "Pix" — never the card number), the people you share it with, notes and custom categories.
  • Channels you follow: YouTube and Twitch channels you add to Subfaro.
  • Connected AI assistants: the OAuth authorizations you granted, access tokens (stored only as a hash) and the log of changes each assistant made to your account.
  • Billing data (Pro plan): your Stripe customer and subscription IDs, plan, subscription status and renewal date. Card details are collected and stored only by Stripe, which is PCI-DSS certified — never by Subfaro.
  • Technical data for security: IP address, used to limit abusive attempts (rate limiting), and request logs, kept for a short time.

What we don't collect or do:

  • We never ask for your bank login or password, statements or bills, and we never receive or store card numbers.
  • We don't sell personal data and don't share it for advertising.
  • We don't use ad trackers or advertising cookies (see the Cookie policy).

3. What we use it for, and on what legal basis

  • Providing the service you signed up for — creating and keeping your account, showing your subscriptions, totals, charts and real cost (exchange rate, IOF and spread), updating plan prices, generating alerts and insights and syncing your devices. Basis: performance of a contract (LGPD art. 7, V).
  • Security and preventing fraud and abuse — rate limiting, technical logs and investigating misuse. Basis: legitimate interest (art. 7, IX), always limited to what's necessary.
  • Connecting an AI assistant and, if we ever add them, optional cookies. Basis: your consent (art. 7, I), which you can withdraw at any time.
  • Billing the Pro plan — managing the subscription, renewals, cancellations and refunds. Basis: performance of a contract (art. 7, V).
  • Meeting legal, regulatory and tax obligations (such as keeping invoice records). Basis: art. 7, II.

4. Who we share it with

We share only what's necessary, with these processors and third parties:

  • Render (United States) — hosting for the platform and database. Your data is stored in the US (see section 6).
  • Stripe (United States) — processes Pro plan payments. It acts as a processor for billing and as an independent controller for fraud prevention and its own legal obligations, under Stripe's privacy policy. Your payment data is also transferred to the US.
  • scrape.do and an exchange-rate service — used to check public plan prices and exchange rates. We only send public page addresses and currency codes; no personal data.
  • Google's favicon service — receives only a website domain (for example "netflix.com") to show the icon of a custom subscription.
  • AI assistant providers, such as Anthropic (Claude), only if you connect an assistant. They process what the assistant reads under their own privacy policies (see section 5).
  • Public authorities, when required by law or court order.

5. AI assistants (MCP)

You can connect Subfaro to an AI assistant that supports MCP (Model Context Protocol), like Claude, to check and add subscriptions by chatting. Connecting is optional and only happens with your explicit consent, on a Subfaro screen.

  • You choose the access: read-only or read and edit. Even with edit access, the assistant can add and change subscriptions but can't delete subscriptions or change your account. It never gets your password.
  • What the assistant reads: subscription names, prices, dates and your spending summary. That data is then also processed by the assistant's provider, under that provider's privacy policy.
  • Everything is logged: every change the assistant makes shows up in Account, with an option to undo it.
  • Disconnect whenever you want, from Account. Access is revoked immediately.
  • Access tokens are stored only as a hash and expire automatically.

6. International transfers

Because Subfaro's infrastructure (Render) and payment processing (Stripe) are in the United States, your data is transferred outside Brazil. We do this with appropriate contractual safeguards, under LGPD art. 33, and require the provider to apply security measures consistent with this policy.

7. How long we keep it

  • Your data is kept for as long as your account exists.
  • When you delete your account in the app or on the web, your data is erased from our systems immediately and drops out of backups within 30 days.
  • Invoice records and tax data for the Pro plan are kept for the period required by law, even after the account is deleted.
  • Technical request logs are kept for a short time, for security only. Application access records (IP, date and time) are kept for the period required by article 15 of the Brazilian Internet Civil Framework.

8. Your rights (Brazil)

Under the LGPD (art. 18), you can at any time:

  • confirm that we process your data and access it;
  • correct incomplete or outdated data (directly in the app);
  • ask for unnecessary data to be anonymized, blocked or deleted, or delete your whole account in the app;
  • take your data elsewhere (portability) — export your subscriptions as CSV in Account;
  • know who we share your data with;
  • withdraw consent (for example, by disconnecting an AI assistant) and object to processing;
  • complain to Brazil's National Data Protection Authority (ANPD).

For requests you can't complete in the app, write to privacidade@subfaro.com. We reply within 15 days.

9. Users outside Brazil

United States (including California)

You have the right to know what personal information we collect and why, to ask us to delete and correct it, and not to be discriminated against for exercising these rights. We do not sell or share personal information for cross-context behavioral advertising, and we don't use sensitive personal information to infer characteristics. You can exercise your rights in the app or at privacidade@subfaro.com; we may verify your identity through your account email.

European Economic Area and United Kingdom

Where the GDPR or UK GDPR applies to you, our legal bases are performance of a contract (Art. 6(1)(b)), legitimate interests (Art. 6(1)(f)) and consent (Art. 6(1)(a)), as in section 3. You have the rights of access, rectification, erasure, restriction, portability and objection, the right to withdraw consent and the right to complain to your local data protection authority. Transfers to Brazil and the US rely on contractual safeguards.

10. Cookies

Today we only use strictly necessary cookies and local storage. Details are in the Cookie policy.

11. Security

We use encrypted connections (HTTPS) everywhere, bcrypt-hashed passwords, tokens stored as hashes, restricted access to our systems and limits against abusive attempts. No system is bulletproof; if an incident could put you at risk, we'll notify you and the ANPD, as the law requires.

12. Minimum age

Subfaro is meant for people aged 18 or over. We don't knowingly collect data from minors.

13. Changes to this policy

If we change anything important, we'll let you know in the app or by email before it takes effect. The version and effective date are at the top of this page.

14. Contact

GZ SEGURANÇA E DEFESA CIBERNÉTICA LTDA — CNPJ 40.988.106/0001-60 — Cascavel, Paraná, Brazil. Privacy and data subject requests: privacidade@subfaro.com.

This English version is provided for convenience. For users in Brazil, the Portuguese version prevails.