Privacy policy

Version 1.2, effective 2026-10-18. This is an English translation of the Portuguese policy, which prevails in case of conflict. It covers the website gracefold.tech and, in general terms, the apps published by Gracefold. Each app has its own supplement: Efatah.

1. Who we are (controller)

GRACEFOLD TECH LTDA, a Brazilian limited liability company registered under CNPJ 69.276.507/0001-79, with registered office at SAUS Quadra 4, Bloco A, s/n, Sala 513 Parte 1002, Plano Piloto, Brasília/DF, CEP 70070-938, Brasil ("Gracefold", "we"). We are the controller of the personal data described in this policy under Brazilian Law No. 13,709/2018 (Lei Geral de Proteção de Dados, "LGPD").

Channel for data subjects: privacy@gracefold.tech, for any request or question about your data. Gracefold is a small-scale processing agent and therefore does not appoint a data protection officer ("encarregado") (ANPD Resolution CD/ANPD 2/2022, art. 11). If we start high-risk processing, we will appoint one and publish their name and contact here.

2. Scope

• the website gracefold.tech and its subdomains;
• e-mail communication with addresses under the gracefold.tech domain;
• in general terms, the apps Gracefold publishes on the Apple and Google stores. Each app may have a supplementary policy, which prevails in what is specific to it.

3. Data processed on the website

The website is static and informational. It uses no cookies, no audience analytics, no advertising and no forms.

When you visit the site, our hosting and network provider (Cloudflare) records, for security and operational reasons, technical request data: IP address, date and time, page requested, browser and operating system (user agent). These logs are used to protect the service from abuse and to diagnose failures, and are kept for a short period according to the provider's retention policy.

Legal basis: legitimate interest (LGPD, art. 7, IX) in the security and operation of the site, and compliance with the legal obligation to keep application access logs (Brazilian Internet Act, Law No. 12,965/2014, art. 15), where applicable.

4. Data processed by e-mail

When you write to one of our addresses (support, privacy, business contact), we process your e-mail address, your name if provided, and the content of the message, including attachments. We use this data only to reply, resolve the request and keep the support history.

• Legal basis: performance of a contract or preliminary procedures at the data subject's request (art. 7, V), compliance with a legal obligation (art. 7, II) for LGPD requests, and legitimate interest (art. 7, IX) in organizing support.
• Retention: support messages are kept for up to 12 months after the request is resolved; LGPD requests, for as long as needed to evidence compliance. They are then deleted unless a legal obligation requires retention.
• Processors: domain e-mail forwarding is provided by Cloudflare (Email Routing), and mailboxes are hosted by an e-mail provider contracted by Gracefold.

5. Data processed by the apps

Gracefold apps follow these principles. Details, including the list of third-party libraries, retention periods and features not yet released, are in each app's policy:

• they work without an account, sign-up, name, e-mail or phone number. If an app offers an account to save progress, it is optional, created with Apple or Google, keeps only what is needed (in Efatah: account identifier, optional name, e-mail and progress; never a photo) and can be deleted inside the app itself and on the web;
• account service e-mails are sent without prior request; news e-mails only with separate, unchecked consent, with an unsubscribe link in every message, and never to anyone who said they are under 12;
• they contain no advertising and no advertising, tracking or behavioural analytics SDKs;
• they store progress and preferences on the user's device, and only send them to our servers if the person links an account;
• they go online to download content from our servers, which produces the same technical logs described in section 3;
• they request system permissions (camera, microphone, notifications) only when a feature needs them, and explain why;
• they do not use users' data to train artificial intelligence models.

Efatah supplementary policy: efatah.app/privacy/.

Sensitive data

Our apps work with Bible and devotional content. Data that may reveal someone's religious belief is sensitive personal data (LGPD, art. 5, II, and art. 11). We only process it off the device with the data subject's specific, highlighted consent, given as an active choice with nothing preselected. Withdrawing it deletes that data from our servers. We never use it for advertising and never sell it.

6. Who we share data with

We do not sell personal data and do not share it for marketing. The data described here may be accessed by:

• Cloudflare, Inc. (United States): website hosting, content delivery network, DNS and e-mail forwarding;
• the e-mail provider contracted by Gracefold for its mailboxes;
• Apple and Google, as app store operators, when you install, update, buy or review an app, and as providers of the system services and libraries the apps use (for example, speech recognition), under their own privacy policies;
• other processors specific to each app, listed in that app's policy;
• public authorities, where required by law or court order.

7. International transfers

The providers above may store or process data outside Brazil, in particular in the United States. Such transfers take place under art. 33 of the LGPD, notably where necessary to perform a contract and on the basis of contractual clauses and the data protection commitments undertaken by the providers.

8. Your rights

Under art. 18 of the LGPD you may request, at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability, information on sharing, and information on the possibility of refusing consent;
• deletion of data processed on the basis of consent, and withdrawal of consent;
• review of decisions made solely on the basis of automated processing (we make no such decisions).

To exercise any right, write to privacy@gracefold.tech. We may ask for information to confirm the request comes from the data subject. We reply in simplified form immediately where possible, or with a full statement within 15 days (LGPD, art. 19). You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

9. Children and teenagers

The website is not directed at children. Gracefold apps may be used by children and teenagers under the responsibility of their parents or guardians, and we always process their data in their best interest (LGPD, art. 14): no advertising, no tracking, no social features and no request for identifying data. When an app offers an account, it asks for an age self-declaration before linking, and an account for a child under 12 should only be linked with the consent of a parent or guardian (art. 14, §1). Anyone who says they are under 12 never receives marketing e-mails. If you believe we process a child's data without a legal basis, write toprivacy@gracefold.tech and we will delete whatever is identified. Each app's rules are in its policy.

10. Security and incidents

We adopt technical and administrative measures proportionate to the size of the company and the nature of the data: restricted access to mailboxes, two-factor authentication on company accounts, encrypted transport (HTTPS) on the website and in the apps, and minimal collection. Today the company keeps no user database. When an app offers an optional account, the server will keep only what that app's policy describes, with restricted access.

If a security incident occurs that may cause relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects under art. 48 of the LGPD and the ANPD's incident-reporting regulation, and keep a record of the incident.

11. Changes to this policy

This policy may be updated to reflect changes to the website, the apps or the law. The current version, with number and date, is always on this page. Relevant changes will be highlighted here and, where appropriate, in the apps. When a change depends on consent, we will ask for it again.

12. Governing law and venue

This policy is governed by the laws of the Federative Republic of Brazil. The courts of Brasília/DF have jurisdiction, without prejudice to the consumer's right to bring claims in the courts of their own domicile.

13. Contact

GRACEFOLD TECH LTDA, CNPJ 69.276.507/0001-79, SAUS Quadra 4, Bloco A, s/n, Sala 513 Parte 1002, Plano Piloto, Brasília/DF, CEP 70070-938, Brasil.
Privacy and data subject requests (LGPD): privacy@gracefold.tech. Support: support@gracefold.tech.

Version history

• 1.2 (2026-10-18): the Santolingo app is now called Efatah, with the website efatah.app; nothing changes in how data is processed.
• 1.1 (2026-10-03): Gracefold as a small-scale agent with no DPO and the privacy@gracefold.tech channel; app principles updated for the optional account; sensitive data; children (LGPD, art. 14) with age self-declaration; service and news e-mails; Santolingo account with name and e-mail; incidents.
• 1.0 (2026-10-01): first published version.