Privacy policy

Version 1.0, effective 2026-10-01. This is an English translation of the Portuguese policy, which prevails in case of conflict. It covers the website gracefold.tech and, in general terms, the apps published by Gracefold. Each app has its own supplement: Santolingo.

1. Who we are (controller)

GRACEFOLD TECH LTDA, a Brazilian limited liability company registered under CNPJ 69.276.507/0001-79, with registered office at SAUS Quadra 4, Bloco A, s/n, Sala 513 Parte 1002, Plano Piloto, Brasília/DF, CEP 70070-938, Brasil ("Gracefold", "we"). We are the controller of the personal data described in this policy under Brazilian Law No. 13,709/2018 (Lei Geral de Proteção de Dados, "LGPD").

Data protection officer (LGPD, art. 41): Gracefold's management, reachable at privacy@gracefold.tech.

2. Scope

• the website gracefold.tech and its subdomains;
• e-mail communication with addresses under the gracefold.tech domain;
• in general terms, the apps Gracefold publishes on the Apple and Google stores. Each app may have a supplementary policy, which prevails in what is specific to it.

3. Data processed on the website

The website is static and informational. It uses no cookies, no audience analytics, no advertising and no forms.

When you visit the site, our hosting and network provider (Cloudflare) records, for security and operational reasons, technical request data: IP address, date and time, page requested, browser and operating system (user agent). These logs are used to protect the service from abuse and to diagnose failures, and are kept for a short period according to the provider's retention policy.

Legal basis: legitimate interest (LGPD, art. 7, IX) in the security and operation of the site, and compliance with the legal obligation to keep application access logs (Brazilian Internet Act, Law No. 12,965/2014, art. 15), where applicable.

4. Data processed by e-mail

When you write to one of our addresses (support, privacy, business contact), we process your e-mail address, your name if provided, and the content of the message, including attachments. We use this data only to reply, resolve the request and keep the support history.

• Legal basis: performance of a contract or preliminary procedures at the data subject's request (art. 7, V), compliance with a legal obligation (art. 7, II) for LGPD requests, and legitimate interest (art. 7, IX) in organizing support.
• Retention: support messages are kept for up to 12 months after the request is resolved; LGPD requests, for as long as needed to evidence compliance. They are then deleted unless a legal obligation requires retention.
• Processors: domain e-mail forwarding is provided by Cloudflare (Email Routing), and mailboxes are hosted by an e-mail provider contracted by Gracefold.

5. Data processed by the apps

Gracefold apps follow these principles, detailed in each app's policy:

• they do not require an account, sign-up, name, e-mail or phone number;
• they contain no advertising and no tracking or behavioural analytics SDKs;
• they store progress and preferences only on the user's device;
• they access the network only to download content from our servers, which produces the same technical logs described in section 3;
• they request system permissions (camera, microphone, notifications) only when a feature needs them, and explain why.

Santolingo supplementary policy: gracefold.tech/en/privacy/santolingo/.

6. Who we share data with

We do not sell personal data and do not share it for marketing. The data described here may be accessed by:

• Cloudflare, Inc. (United States): website hosting, content delivery network, DNS and e-mail forwarding;
• the e-mail provider contracted by Gracefold for its mailboxes;
• Apple and Google, as app store operators, when you install, update or review an app, under their own privacy policies;
• public authorities, where required by law or court order.

7. International transfers

The providers above may store or process data outside Brazil, in particular in the United States. Such transfers take place under art. 33 of the LGPD, notably where necessary to perform a contract and on the basis of contractual clauses and the data protection commitments undertaken by the providers.

8. Your rights

Under art. 18 of the LGPD you may request, at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability, information on sharing, and information on the possibility of refusing consent;
• deletion of data processed on the basis of consent, and withdrawal of consent;
• review of decisions made solely on the basis of automated processing (we make no such decisions).

To exercise any right, write to privacy@gracefold.tech. We may ask for information to confirm the request comes from the data subject. We reply in simplified form immediately where possible, or with a full statement within 15 days (LGPD, art. 19). You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

9. Children and teenagers

The website is not directed at children and does not knowingly collect personal data from anyone under 18. Gracefold apps may be used by minors under the responsibility of their parents or guardians; as the apps require no account and collect no identifying data, no personal data of children is collected beyond the technical logs described in section 3. If you believe we process a child's data without a legal basis, write to the data protection officer and we will delete whatever is identified.

10. Security and incidents

We adopt technical and administrative measures proportionate to the size of the company and the nature of the data: restricted access to mailboxes, two-factor authentication on company accounts, encrypted transport (HTTPS) on the website and in the apps, and no user database kept by the company. If a security incident occurs that may cause relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects under art. 48 of the LGPD.

11. Changes to this policy

This policy may be updated to reflect changes to the website, the apps or the law. The current version, with number and date, is always on this page. Relevant changes will be highlighted here and, where appropriate, in the apps.

12. Governing law and venue

This policy is governed by the laws of the Federative Republic of Brazil. The courts of Brasília/DF have jurisdiction, without prejudice to the consumer's right to bring claims in the courts of their own domicile.

13. Contact

GRACEFOLD TECH LTDA, CNPJ 69.276.507/0001-79, SAUS Quadra 4, Bloco A, s/n, Sala 513 Parte 1002, Plano Piloto, Brasília/DF, CEP 70070-938, Brasil.
Data protection officer: privacy@gracefold.tech. Support: support@gracefold.tech.

Version history

• 1.0 (2026-10-01): first published version.