Privacy Policy
Your privacy matters to us
Effective April 28, 2026 · Last updated: June 20, 2026
1. Introduction
Borali is a cultural and entertainment discovery platform that connects users to places, events, and artists in their city. The platform serves different user profiles: people looking to discover bars, live music venues, restaurants, and events; venue managers promoting their lineup; and artists building their presence and performance schedule.
To deliver features such as personalised recommendations, check-ins, reviews, stories, and connections between users, Borali collects and processes certain personal data. This Privacy Policy describes which data is collected, for what purposes, how long it is retained, and what rights you hold as a data subject.
Borali is the controller of the personal data processed under this policy, in compliance with Brazil's Lei Geral de Proteção de Dados (LGPD, Law No. 13,709/2018), the Google Play Store and Apple App Store guidelines, and the European Union's General Data Protection Regulation (GDPR) to the extent applicable.
By using the Borali app, you acknowledge that you have read and agree to the terms of this policy. If you do not agree, please refrain from using the app.
2. Data we collect
We only collect data necessary for the app to function, as detailed below.
| Category | Data collected | Purpose | Legal basis |
|---|---|---|---|
| Account | Name, e-mail, profile photo, @username | Authentication and profile | Contract performance (Art. 7, V) |
| Location | Latitude/longitude, city, state, neighborhood | Nearby events and places; check-ins | Consent (Art. 7, I) |
| Contact (optional) | WhatsApp, Instagram | Shown on user-created place/artist pages | Consent (Art. 7, I) |
| Preferences | Interests, filters, user profile type | Feed personalization | Contract performance (Art. 7, V) |
| Activity | Check-ins, favorites, followed accounts, story views | Gamification and social features | Legitimate interest (Art. 7, IX) |
| User content | Reviews, photos, stories, created events and places | Public display within the app | Consent (Art. 7, I) |
| Diagnostics | Crash reports, device information | App stability and improvement | Legitimate interest (Art. 7, IX) |
Location: precise GPS location is collected only while you are actively using the app or performing a check-in. We never continuously track your location in the background without your knowledge.
3. How we use your data
We use your data solely for the following purposes:
- Creating and managing your Borali account
- Authenticating you securely (Google login)
- Displaying relevant events, places, and artists near you
- Processing check-ins and awarding achievements
- Displaying your published content (reviews, stories, created places)
- Sending push notifications about events you are interested in
- Personalizing your feed based on your preferences
- Diagnosing and fixing errors to keep the app stable
- Preventing fraud and ensuring platform security
- Complying with applicable legal obligations
We do not sell your data or use it for third-party targeted advertising.
4. Third-party services
Borali integrates third-party services to function properly. Each provider has its own privacy policy.
| Service | Purpose | Policy |
|---|---|---|
| Google Sign-In | Authentication via Google account (OAuth 2.0) | policies.google.com |
| Firebase Crashlytics | App crash and error reporting | firebase.google.com |
| Mapbox | Interactive map rendering | mapbox.com |
| Storage (Cloudflare R2) | Storage of user-uploaded images and media | cloudflare.com |
| Google Gemini AI | AI-powered features within the app | ai.google.dev |
Google Sign-In: when authenticating via Google, your name, email, and profile photo are transferred to Borali according to the permissions you grant on Google's consent screen.
5. Device permissions
The app may request the permissions below. All are optional; you may deny or revoke them at any time in your OS settings, though this may limit some features.
- Camera Take photos for stories, avatars, and app-created content.
- Gallery / Photos Select images from your device library for upload.
- Location (while in use) Find nearby events and places while you are using the app.
- Location (always) Used for automatic check-ins and proximity features. Only requested when explicitly enabled by you.
- Notifications Receive alerts about events, check-ins, and app updates.
- Internet Required for all online features of the app.
6. Data sharing
We do not sell your personal data. We may share it only in the following circumstances:
- Service providers: the services in Section 4 receive only the data necessary to perform their specific functions, under data processing agreements with each provider.
- Public content: reviews, ratings, and public profiles are visible to other users according to your settings.
- Legal obligation: when required by law, court order, or competent authority.
- Rights protection: to investigate violations of our terms, prevent fraud, or protect user safety.
In the event of a merger or acquisition, your data may be transferred to the new controller, bound by this same policy.
7. Data retention
Data will be retained for as long as necessary to fulfil the purposes described, while the account is active (where applicable), or as required by legal obligations.
8. International data transfers
Some of the third-party services listed in Section 4 process data on servers located outside Brazil. These services operate under their respective international data transfer compliance mechanisms and appropriate contractual clauses.
- Google (Firebase, Sign-In, Gemini): data processed in the United States, subject to EU Standard Contractual Clauses and the Data Privacy Framework (DPF).
- Cloudflare R2: data stored in Cloudflare's global data centers, subject to Cloudflare's privacy policy and contractual safeguards.
- Mapbox: data processed in the United States, under Mapbox's privacy policy.
By using Borali, you agree to the transfer of your data to the countries where these service providers operate, always with the adequate safeguards provided under LGPD (Art. 33).
9. Your rights (LGPD Art. 18)
As the owner of your personal data, you have the following rights guaranteed by the LGPD. To exercise them, contact us at the email in Section 13.
10. Data security
We implement technical and organizational measures to protect your data, including:
- Encrypted communication: all communication between the app and our servers uses HTTPS/TLS.
- Secure tokens: short-lived JWT tokens (access: 1h, refresh: 90 days), stored encrypted on-device via Android Keystore / iOS Keychain.
- Access control: production data accessible only to authorized team members.
- Monitoring: observability via OpenTelemetry for anomaly detection.
No system is 100% secure. In the event of a relevant incident, we will notify you and the ANPD within legal timeframes.
11. Minors
Borali is intended for users aged 13 and older.
We do not knowingly collect data from children under 13. If you are under 18, you may only use Borali with the consent and involvement of a parent or legal guardian.
If we become aware we collected data from a child under 13 without proper consent, we will delete it immediately. Report to contato@borali.app.
12. Changes to this policy
We may update this policy periodically. For material changes:
- We will publish the new version on this page with the updated date at the top.
- We will send an in-app notification or email for substantial changes.
- We will request new consent when required by law.
Continued use of Borali after changes implies acceptance of the updated policy.
13. Contact & Data Protection Officer
For questions, requests, or complaints about your data, contact our Data Protection Officer. We will respond within 15 business days. You may also file a complaint with the ANPD at gov.br/anpd.