Privacy Policy

This policy describes the processing of personal data on the X Secret platform, in compliance with Law No. 13,709/2018 (LGPD) and the Brazilian Internet Bill of Rights (Law No. 12,965/2014).

• User account data: the Platform acts as controller.
• Data collected through links (including location): the user who created the link is the controller and the Platform acts as processor, handling the data according to that user's instructions and within the limits of the law.

Data protection officer (DPO): privacidade@dog-feliz.lovable.app.

a) From the person who creates an account: the name provided, email, account identifier, password in encrypted (hashed) form or the social login provider identifier, creation date, access records and acceptance of the terms (date, time and version accepted).

b) From whoever opens a link, upon consent: latitude, longitude, estimated accuracy, approximate address obtained by reverse geocoding, date and time of the visit, location points collected during the sharing session, browser language and the record of the consent given.

c) Minimum technical data: application and security logs necessary for operation and for preventing fraud and abuse, kept in accordance with art. 15 of the Brazilian Internet Bill of Rights.

We do not collect sensitive data (art. 5, II, of the LGPD), nor financial or biometric data.

• The link screen states the destination and asks for explicit confirmation before any collection;
• After confirmation, the browser itself asks for a second authorisation — without it, nothing is collected;
• While the link page stays open, the position may be updated periodically, for a maximum of 8 hours;
• Sharing ends automatically at the end of the period, when the page is closed or when the permission is revoked in the browser or operating system;
• Accuracy depends on the device and the network and may vary from a few metres to several kilometres.

• Location and history of points — purpose: share the position with whoever created the link. Legal basis: consent (art. 7, I, and art. 8 of the LGPD);
• Registration and authentication — purpose: create and maintain the account. Legal basis: performance of a contract (art. 7, V);
• Record of acceptance of the terms — purpose: proof of consent and compliance with a legal obligation (art. 7, II, and art. 37);
• Security, fraud and abuse prevention — legal basis: legitimate interest (art. 7, IX) and compliance with a legal obligation;
• Responding to authorities — legal basis: compliance with a legal obligation or regular exercise of rights (art. 7, II and VI).

We do not sell personal data. We share only what is necessary with: (i) the user who created the link, the intended recipient of the location sharing; (ii) cloud infrastructure, database and authentication providers, acting as processors under contract; (iii) the map service and the reverse geocoding service, which receive only the coordinates to display the map and the address; (iv) public authorities, upon legal request or court order.

Some providers may process data outside Brazil. In such cases, the international transfer complies with arts. 33 to 36 of the LGPD, with contractual clauses and adequate safeguards.

We use strictly necessary cookies and local storage: keeping the authenticated session, storing the chosen language and recording that a link's consent notice has already been answered on the device. We do not use advertising or behavioural profiling cookies. Cookies can be deleted in the browser settings, which may require signing in again.

• Location data and history of points: kept while the link exists and the controlling user wishes, and deleted immediately when the link or account is deleted, or when consent is withdrawn;
• Account data: kept while the account is active and for up to 6 months after closure, unless a longer legal period applies;
• Application access logs: kept for 6 months (art. 15 of the Brazilian Internet Bill of Rights);
• Records of acceptance of the terms: kept for as long as needed to prove consent and defend rights.

Any person whose data is processed may request, free of charge:

• confirmation that processing exists and access to the data;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability to another provider;
• deletion of data processed on the basis of consent;
• information about with whom the data was shared;
• information about the possibility of refusing consent and the consequences of doing so;
• withdrawal of consent at any time;
• objection to processing based on legitimate interest;
• review of automated decisions, where applicable.

Requests may be sent to privacidade@dog-feliz.lovable.app. We reply within 15 days and may ask for information to confirm your identity. Where processing was carried out by a controlling user, we will forward the request to them and support the response. You may also lodge a complaint with the Brazilian data protection authority (ANPD) or your local supervisory authority.

We adopt technical and administrative measures proportionate to the risk: encryption in transit (HTTPS), hashed passwords, access control through row-level rules in the database, least privilege, environment segregation and audit logging. No system is entirely immune; in the event of a relevant security incident, we will notify affected data subjects and the authority within a reasonable period, in accordance with art. 48 of the LGPD.

The Service is not intended for people under 18. Processing data of children and adolescents is only allowed in their best interest and with specific and highlighted consent from at least one parent or legal guardian (art. 14 of the LGPD). If irregular processing is identified, the data will be deleted.

If you received a link and believe your location was requested without your consent, or you are being stalked, write to privacidade@dog-feliz.lovable.app. We will investigate, may disable the link and the responsible account and will cooperate with the authorities. In a situation of immediate risk, contact your local emergency services (in Brazil, the police on 190 or the Women's Assistance Hotline on 180).

This policy may be updated. Relevant changes will be announced on the Platform or by email, and the update date above will be revised. Where the change requires it, we will ask for new consent.