Privacy Policy

This is a translation of the Portuguese original. If there is any difference between versions, the Portuguese version prevails.

This policy explains how mapamentaldevida (mapamentaldevida.com.br) handles your personal data, in accordance with Brazil’s General Personal Data Protection Law (LGPD, Law No. 13,709/2018), the Brazilian Internet Civil Framework (Law No. 12,965/2014) and the other rules listed in the Legal basis section. These laws apply to every user of the site, in Brazil or abroad, because the service is operated from Brazil.

In short: your data is stored on Google Firebase infrastructure; we do not access, read or use your personal information or the content of your map; only you see what you write; we do not sell data; and you can download or delete everything whenever you want.

1. Who is responsible

The data controller is Mizael Cardozo, responsible for mapamentaldevida, based in Brasília, Brazil, who can be reached at contato@mapamentaldevida.com.br. The same channel acts as the data protection officer contact (LGPD art. 41).

2. Where your data lives: Google Firebase

mapamentaldevida does not run its own servers or database. All storage is done on Google Firebase, the cloud platform of Google LLC, which acts as processor of the data (LGPD art. 5, VII), meaning it processes the data only to provide the contracted service, under the Firebase and Google Cloud Data Processing and Security Terms. Three services are used:

• Firebase Authentication: sign-up and login (name, email, password and sign-in with Google, X or Facebook). The password is stored by Google in encrypted form, and no one at mapamentaldevida can see or recover it.
• Cloud Firestore (database): your profile and map content, hosted in Google’s region in São Paulo, Brazil (southamerica-east1).
• Cloud Storage: the photos, videos and documents you upload, hosted on Google servers in the United States (us-east1). Photos are reduced on your own device before upload.

Data is encrypted in transit (HTTPS/TLS) and at rest on Google’s servers. Google’s privacy policy is available at policies.google.com/privacy and Firebase’s privacy information at firebase.google.com/support/privacy.

3. We do not access your data

mapamentaldevida was built so that only you have access to your map. We make the following commitments:

• We do not access, read, copy or use the personal information of people who sign up or the content of their maps (dreams, goals, amounts, notes, photos, videos and documents).
• The security rules of the database and file storage allow each account to read and write only its own content. The site has no screen, function or report that shows other users’ data.
• Your address (mapamentaldevida.com.br/user/yourusername) requires login: anyone who opens the link without being you only sees a private-map notice.
• To follow the beta, we only look at aggregate numbers, such as the number of sign-ups, without opening the content of any account.
• The only information that reaches us is what you send us yourself: your beta survey answers and the messages you send to the contact email.

Exceptions. As the technical owner of the Firebase account, the controller, as with any cloud service, is able to access the administrative console. That access is protected by two-step verification and will only be used, on a one-off, logged basis limited to the minimum necessary, in three situations: (a) when you ask for technical help and authorize access; (b) to comply with the law, a court order or a request from a competent authority; or (c) to investigate and contain a security incident. Outside these cases, no data is consulted.

4. What data is processed

• Account data: name, email, password (encrypted) and the username you choose for your address.
• Sign-in with Google, X or Facebook: if you choose this option, these platforms share only your name, email and an identifier. We do not receive your password or your posts on those networks.
• Map content: what you write (dreams, projects, goals, notes, deadlines, amounts of money), the connections between them, the files you upload and the summary you import.
• Beta survey: the answers, your username, the number of days of use and the number of items on the map. Your email only accompanies the answers if you tick that you agree to be contacted.
• Technical data: IP address, browser type, date and time of access and error logs, generated automatically by the hosting services to keep the site secure and working.

We do not ask for sensitive data (LGPD art. 5, II). If you write information about health, religion or other sensitive topics in your map, it is stored only for you, with the same protections as the rest of the content, and on your own initiative.

5. Purposes and legal bases

• Creating and maintaining your account, saving and displaying your map, sending confirmation and new-password emails: performance of the contract (Terms of Use) you accept when signing up (LGPD art. 7, V).
• Beta survey: legitimate interest in improving the product (LGPD art. 7, IX, and art. 10), limited to what is strictly necessary. Contact by email about your answers depends on your consent (art. 7, I, and art. 8), which you can withdraw at any time.
• Access logs, security and fraud prevention: compliance with a legal obligation (LGPD art. 7, II, and art. 15 of the Internet Civil Framework) and legitimate interest.
• Complying with court orders and defending rights: compliance with a legal obligation and regular exercise of rights in proceedings (LGPD art. 7, II and VI).
• Organize with AI (optional): when you click this button, the text of the summary you uploaded is processed automatically to build the map, at your request (performance of the contract). No one at mapamentaldevida reads this text.

We follow the principles of LGPD art. 6, especially purpose limitation, necessity and transparency: we do not use your content for advertising, we do not build behavioral profiles, we do not make automated decisions about you and we do not sell or rent personal data.

6. Providers and sharing

Data is processed only by the providers (processors) needed for the site to work:

• Google LLC (Firebase): login, database and file storage.
• Netlify, Inc.: hosting of the pages and receipt of beta survey answers.
• Google, X and Meta (Facebook): only if you choose to sign in with one of these accounts.
• Anthropic PBC: only if you use the “Organize with AI” button, to process the text you sent. Under Anthropic’s commercial terms, this content is not used to train models.

Other than that, we only share data when required by law, court order or a request from a competent authority, always limited to what is required (art. 10 and art. 22 of the Internet Civil Framework).

7. International transfer and retention

The database is in Brazil, but part of the data (login, uploaded files, hosting and the optional AI) is processed in the United States. This international transfer is based on LGPD art. 33, especially the contractual data protection safeguards offered by the providers (item II), and on ANPD Resolution CD/ANPD No. 19/2024, which regulates international transfers and standard contractual clauses. The chosen providers follow recognized security standards, such as ISO/IEC 27001 and SOC 2 certifications.

We keep your data while your account exists. When you delete your account, the map, history, files and profile are deleted immediately; automatic backup copies at the providers may take up to 30 days to be discarded. Access logs are kept for 6 months, in a controlled and secure environment, as required by art. 15 of the Internet Civil Framework. Data may be kept longer only in the cases of LGPD art. 16, such as compliance with a legal obligation.

8. Security and incidents

We adopt the technical and administrative measures required by LGPD art. 46: encrypted connection (HTTPS), data encrypted on Google’s servers, encrypted passwords, per-user access rules on the database and file storage, two-step verification on the administrative console and the principle of not accessing users’ content.

No system is completely immune to failures. If a security incident occurs that may pose a relevant risk or harm to you, we will notify you and Brazil’s National Data Protection Authority (ANPD), as required by LGPD art. 48 and Resolution CD/ANPD No. 15/2024 (within 3 business days of becoming aware of the incident), explaining what happened, which data was affected and the measures taken.

9. Browser storage

We do not use advertising cookies or third-party tracking tools. We use only one functional cookie that stores your chosen language, plus your browser’s local storage to keep you logged in and remember map preferences, such as the last tab opened. You can clear this data in your browser settings; you will just need to log in again.

10. Your rights

Under LGPD art. 18, you can, at any time and free of charge:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary or excessive data;
• receive your data in a portable format (on the map, under “Download backup”);
• request deletion of data processed with your consent and withdraw that consent;
• know with whom we share your data;
• object to processing carried out in breach of the law;
• file a complaint with the ANPD (gov.br/anpd) and with consumer protection bodies.

To exercise any right, use the site itself or write to the contact email. A simplified confirmation is given immediately, and a full answer within 15 days, as provided in LGPD art. 19.

11. How to delete your data

Inside your map, click your name and then Delete my account. This permanently deletes the account, the map, the history, the survey answers and all uploaded files. If you prefer, download a backup first.

You can also request deletion by email at contato@mapamentaldevida.com.br, stating the account email. If you signed in with Google, X or Facebook, you can also remove mapamentaldevida’s access in the security settings of those platforms.

12. Minors

mapamentaldevida is intended for people aged 18 and over. People between 13 and 17 may only use the site with the consent and supervision of a parent or legal guardian, always in their best interest, as required by LGPD art. 14 and Brazil’s Child and Adolescent Statute (Law No. 8,069/1990). If we learn of an account belonging to a child under 13, it will be deleted.

13. Legal basis

This policy and the processing of data at mapamentaldevida are grounded in the following Brazilian rules:

• Federal Constitution of 1988, art. 5, X (inviolability of private life), XII (secrecy of data) and LXXIX (fundamental right to personal data protection, added by Constitutional Amendment No. 115/2022).
• General Personal Data Protection Law (LGPD), Law No. 13,709/2018, especially arts. 6 (principles), 7 and 10 (legal bases and legitimate interest), 8 (consent), 9 (transparency), 14 (children and adolescents), 15 and 16 (end of processing), 18 and 19 (data subject rights), 33 to 36 (international transfer), 37 to 41 (records, processor and data protection officer), 46 to 49 (security and incident notification) and 52 (sanctions).
• Internet Civil Framework (Marco Civil da Internet), Law No. 12,965/2014, arts. 3, 7 and 8 (privacy and user rights), 10 (protection of logs and data) and 15 (retention of access logs for 6 months), regulated by Decree No. 8,771/2016 (security and confidentiality standards).
• Consumer Defense Code, Law No. 8,078/1990, arts. 6, III (clear information) and 43 (databases).
• Child and Adolescent Statute, Law No. 8,069/1990.
• Civil Code, Law No. 10,406/2002, art. 21 (inviolability of private life).
• ANPD Resolutions: CD/ANPD No. 2/2022 (small-scale processing agents), No. 15/2024 (security incident notification), No. 18/2024 (data protection officer) and No. 19/2024 (international data transfer).

The courts of Brasília, Federal District, Brazil, are chosen to settle matters related to this policy, without prejudice to your right, as a consumer, to file suit in your place of residence where the law grants it.

14. Changes to this policy

We may update this policy, especially during the beta. Important changes will be announced by email or on the site before they take effect. The date of the version in force is always at the top of this page.

15. Contact

Questions, requests or complaints: contato@mapamentaldevida.com.br. See also the Terms of Use.