Privacy Policy
Your privacy matters to us
Effective April 28, 2026 · Last updated: August 6, 2026
1. Introduction
Borali is a cultural and entertainment discovery platform that connects users to places, events, and artists in their city. The platform serves different user profiles: people looking to discover bars, live music venues, restaurants, and events; venue managers promoting their lineup; and artists building their presence and performance schedule.
To deliver features such as personalised recommendations, check-ins, reviews, stories, and connections between users, Borali collects and processes certain personal data. This Privacy Policy describes which data is collected, for what purposes, how long it is retained, and what rights you hold as a data subject.
Borali is the controller of the personal data processed under this policy, in compliance with Brazil's Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018), the Google Play Store and Apple App Store guidelines, and the European Union's General Data Protection Regulation (GDPR) to the extent applicable.
By using the Borali app, you acknowledge that you have read and agree to the terms of this policy. If you do not agree, please refrain from using the app.
2. Data we collect
We only collect data necessary for the app to function, as detailed below.
| Category | Data collected | Purpose | Legal basis |
|---|---|---|---|
| Account | Name, e-mail, profile photo, @username | Authentication and profile | Contract performance (Art. 7, V) |
| Location | Latitude/longitude, city, state, neighborhood | Nearby events and places; check-ins | Consent (Art. 7, I) |
| Contact (optional) | WhatsApp, Instagram | Shown on user-created place/artist pages | Consent (Art. 7, I) |
| Preferences | Interests, filters, user profile type | Feed personalization | Contract performance (Art. 7, V) |
| Activity | Check-ins, favorites, followed accounts, story views | Gamification and social features | Legitimate interest (Art. 7, IX) |
| User content | Reviews, photos, stories, created events and places | Public display within the app | Consent (Art. 7, I) |
| Messages | Content of direct conversations, voice messages, delivery and read receipts, blocks and reports | Delivering your conversations and handling reports | Contract performance (Art. 7, V) |
| Diagnostics | Crash reports, device information | App stability and improvement | Legitimate interest (Art. 7, IX) |
| Subscription | Plan, status, period dates, amount and currency paid, transaction identifier | Unlocking paid plan features and showing your statement | Contract performance (Art. 7, V) |
Location: precise GPS location is collected only while you are actively using the app or performing a check-in. We never continuously track your location in the background without your knowledge.
3. How we use your data
We use your data solely for the following purposes:
- Creating and managing your Borali account
- Authenticating you securely (Google login)
- Displaying relevant events, places, and artists near you
- Processing check-ins and awarding achievements
- Displaying your published content (reviews, stories, created places)
- Sending push notifications about events you are interested in
- Personalizing your feed based on your preferences
- Diagnosing and fixing errors to keep the app stable
- Preventing fraud and ensuring platform security
- Complying with applicable legal obligations
We do not sell your data or use it for third-party targeted advertising.
4. Third-party services
Borali integrates third-party services to function properly. Each provider has its own privacy policy.
| Service | Purpose | Policy |
|---|---|---|
| Google Sign-In | Authentication via Google account (OAuth 2.0) | policies.google.com |
| Firebase Crashlytics | App crash and error reporting | firebase.google.com |
| Mapbox | Interactive map rendering | mapbox.com |
| Storage (Cloudflare R2) | Storage of user-uploaded images and media | cloudflare.com |
| Google Gemini AI | AI-powered features within the app | ai.google.dev |
| RevenueCat | Subscription processing and validation | revenuecat.com |
| Google AdMob | Ad delivery | policies.google.com |
Google Sign-In: when authenticating via Google, your name, email, and profile photo are transferred to Borali according to the permissions you grant on Google's consent screen.
Sign in with Apple: when signing in with Apple you may choose to hide your email. Apple then generates a unique forwarding address, and that is what Borali receives and stores, not your personal email.
5. Device permissions
The app may request the permissions below. All are optional; you may deny or revoke them at any time in your OS settings, though this may limit some features.
- Camera Take photos for stories, avatars, and app-created content.
- Gallery / Photos Select images from your device library for upload.
- Location (while in use) Find nearby events and places while you are using the app.
- Location (always) Used for automatic check-ins and proximity features. Only requested when explicitly enabled by you.
- Notifications Receive alerts about events, check-ins, and app updates.
- Microphone Recording voice messages in conversations and dictating your query in smart search. Voice messages are stored as part of the conversation. Search audio is processed by your device's speech recognition service — Apple on iOS, Google on Android — subject to their privacy policies: Borali receives only the transcribed text and neither records nor stores that audio.
- Internet Required for all online features of the app.
6. Data sharing
We do not sell your personal data. We may share it only in the following circumstances:
- Service providers: the services in Section 4 receive only the data necessary to perform their specific functions, under data processing agreements with each provider.
- Public content: reviews, ratings, and public profiles are visible to other users according to your settings.
- Legal obligation: when required by law, court order, or competent authority.
- Rights protection: to investigate violations of our terms, prevent fraud, or protect user safety.
In the event of a merger or acquisition, your data may be transferred to the new controller, bound by this same policy.
7. Data retention
We keep your data for as long as your account exists and for as long as the purposes described require. Deleting your account anonymises it: name, email, photo, location and login links are irreversibly removed. Associated records that do not identify you — such as public content you posted and your subscription history — remain without the identifying data. Messages you sent remain in the conversations of the people who received them, attributed to an anonymous profile, so that their own history stays intact. Specific legal retention periods, where applicable, take precedence.
8. International data transfers
Some of the third-party services listed in Section 4 process data on servers located outside Brazil. These services operate under their respective international data transfer compliance mechanisms and appropriate contractual clauses.
- Google (Firebase, Sign-In, Gemini): data processed in the United States, subject to EU Standard Contractual Clauses and the Data Privacy Framework (DPF).
- Cloudflare R2: data stored in Cloudflare's global data centers, subject to Cloudflare's privacy policy and contractual safeguards.
- Mapbox: data processed in the United States, under Mapbox's privacy policy.
By using Borali, you agree to the transfer of your data to the countries where these service providers operate, always with the adequate safeguards provided under LGPD (Art. 33).
9. Your rights (LGPD Art. 18)
As the owner of your personal data, you have the following rights guaranteed by the LGPD. To exercise them, contact us at the email in Section 13.
10. Data security
We implement technical and organizational measures to protect your data, including:
- Encrypted communication: all communication between the app and our servers uses HTTPS/TLS.
- Secure tokens: short-lived JWT tokens (access: 1h, refresh: 90 days), stored encrypted on-device via Android Keystore / iOS Keychain.
- Access control: production data accessible only to authorized team members.
- Monitoring: observability via OpenTelemetry for anomaly detection.
No system is 100% secure. In the event of a relevant incident, we will notify you and the ANPD within legal timeframes.
11. Minors
Borali is intended for users aged 13 and older.
We do not knowingly collect data from children under 13. If you are under 18, you may only use Borali with the consent and involvement of a parent or legal guardian.
If we become aware we collected data from a child under 13 without proper consent, we will delete it immediately. Report to contato@borali.app.
12. Changes to this policy
We may update this policy periodically. For material changes:
- We will publish the new version on this page with the updated date at the top.
- We will send an in-app notification or email for substantial changes.
- We will request new consent when required by law.
Continued use of Borali after changes implies acceptance of the updated policy.
13. Contact & Data Protection Officer
For questions, requests, or complaints about your data, contact our Data Protection Officer. We will respond within 15 business days. You may also file a complaint with the ANPD at gov.br/anpd.