Privacy Policy

The controller of the personal data processed in BolsoVerde is Samuel da Cruz Santana, CPF no. 041.318.995-31.

For anything about your data, including exercising your rights, write to contato@bolsoverde.com. This is the channel for data subjects.

Account data: e-mail, name, profile photo (optional) and password, if you create one. The password is stored only in hashed form, never as text. If you sign in with Google, we receive your name, e-mail and photo from Google.

Business and financial data you enter yourself: accounts and opening balances, transactions (description, amount, date, category, payment method and attached receipts), sales channels and their fees, sales, payouts, cash register, transfers, bills, budgets, goals, recurring items, tax set-aside, business profile, tax regime, PIX key and charges.

Data about other people that you register, such as customers' name, phone and notes, and the customer of each sale, when you enter one.

Technical data: IP address, browser and device (user agent), date and time of each access to your account, and product usage records such as "added a channel" or "recorded a sale", without financial amounts. The usage measurement of the website and the app, which stores neither the IP address nor the user agent, is described in section 9.

Support messages: the topic and text you write in the help form, together with the page you were on, your browser and, if there is one, the error code. The message reaches our support inbox by e-mail and is kept there, not in the Service's database.

WhatsApp conversations: if you message us on WhatsApp, we receive your number, your profile name and the messages you send. The conversation stays in the WhatsApp Business app on the support phone, not in the Service's database.

Subscription payment data: the card is entered on the page of Stripe, our payment processor, and never goes through BolsoVerde's servers. From Stripe we receive only what is needed to manage the subscription: the customer and subscription identifiers, its status (trialing, active, canceled or with a pending payment) and the dates the trial ends and the next charge happens.

To provide the Service: create and keep your account, store and compute your information, send sign-in codes, the account and subscription e-mails (welcome, start of the trial or subscription, and a notice a few days before the trial ends) and the e-mails you turn on (summaries, alerts and reminders), and answer your support messages, by e-mail or on WhatsApp, including those from people who have not created an account yet. Legal basis: performance of a contract or of steps prior to it, at your request (art. 7, V, LGPD).

To charge and manage the subscription: start the free trial, renew the charge, warn about declined payments and process cancellations. Legal basis: performance of a contract (art. 7, V, LGPD).

To keep the Service secure and improve it: log access, prevent fraud and abuse, and understand how the website and the app are used (the usage measurement in section 9). Legal basis: legitimate interest (art. 7, IX), respecting your rights and expectations.

To meet legal obligations and respond to authorities when the law requires it (art. 7, II and VI).

We do not sell your data, we do not use your financial data for advertising and we do not use artificial intelligence to process your information.

We share data only with the service providers BolsoVerde needs to run, who process it under our instructions: Amazon Web Services (application server, usage measurement server and storage of profile photos and receipts, in the São Paulo region), Neon (the Service's and the usage measurement's databases, also in the Amazon Web Services São Paulo region), Vercel (hosting of the website and of the usage measurement dashboard), Resend (e-mail delivery), ImprovMX (forwarding of e-mails sent to contato@bolsoverde.com), Google (Gmail, the inbox where we read and answer support messages), Sentry (error monitoring: receives technical data about the app's errors and performance, with personal data removed, and does not record your screen) and Stripe (subscription payment processing). Stripe also processes card data to prevent fraud, under its own policy. If you choose to sign in with Google, Google processes the sign-in data under its own policy. If you message us on WhatsApp, the conversation goes through WhatsApp, owned by Meta, which processes that data under its own policy. If you allow ad measurement in the cookie notice, Google also receives, through Google Ads, the data described in section 8 and processes it under its own policy.

We may also share data when required by law, court order or a request from a competent authority.

We never sell or rent your data.

Some of these providers process data outside Brazil, mainly in the United States. The transfer is necessary to provide the Service you signed up for (art. 33, IX, LGPD) and is made to providers that contractually commit to protecting the data.

While your account exists, we keep the data to provide the Service.

When you delete your account, we immediately erase your data from the database and the related files (photo and receipts). Database backups are discarded automatically within 6 hours. If there is an active subscription, it is canceled first, so no further charges happen.

Messages sent to support stay in the support inbox and are not erased with the account. To have them erased, ask at contato@bolsoverde.com.

WhatsApp conversations stay in the support app and are not erased with the account. To have them erased, ask at contato@bolsoverde.com.

Access logs (IP, browser, date and time) are erased automatically after 90 days.

Usage measurement data (section 9) is erased automatically 13 months after the end of the month in which it was recorded. When you delete your account, the data linked to it is erased right after; if the measurement is unavailable at that moment, the request is recorded and retried every day until it completes.

Subscription payment records and invoices are kept by Stripe for the period tax law requires, even after the account is deleted. BolsoVerde deletes its subscription data together with the account.

We keep data longer only when a law requires it.

Under the LGPD (art. 18) you can ask for: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary or excessive data; portability; deletion of your data; and information about who we share it with. You can also object to processing based on legitimate interest.

Much of this you can do yourself in the Service: edit your data, download a full copy in Settings > Your Data > Download My Data, and delete your account at any time.

For any other request, write to contato@bolsoverde.com. We reply within 15 days. You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

Without your permission we use only essential cookies: a session cookie, not accessible to scripts, to keep you signed in and, for Google sign-in, a temporary security cookie. The browser also stores interface preferences such as the light or dark theme, your answer to the cookie notice and, for the usage measurement (section 9), which uses no cookies, the random visit identifier and, after you sign in, your account's internal identifier, both only in the open tab, as well as your choice to turn the measurement off, if you turn it off.

Only if you allow ad measurement in the cookie notice, the site's public pages load the Google Ads tag, which sets cookies to measure whether the visit came from one of our ads and whether it ended in a sign-up or a subscription. Inside the app it loads only at sign-up and when a subscription starts, to record that result.

Google receives the page address, the ad click identifier, that result and the technical data every browser sends (such as IP address and browser type). It never receives your sales, your balance or other financial data, and we do not use this data to personalize ads.

You can change this choice any time under “Cookies”, in the site footer. If you refuse, we delete the Google Ads cookies.

To understand how the website and the app are used and to improve them, we measure usage with Pyxis, a measurement tool that the controller built and runs. No third-party analytics company receives this data. The legal basis is legitimate interest (section 3).

What we record: the pages opened, by path only and with numbers and codes replaced by a template (for example, "/vendas/:id", never the full address); actions such as "used the calculator", "clicked Create account", "created the account" or "recorded a sale"; the result of save operations and of failures to load information (success or error, the error code and how long it took); the device type and the browser and operating system families, without the full version; the country and the state or region you are in, worked out from the IP address at that moment, never the city; and where the visit came from: the domain of the website you came from, the campaign parameters (utm) and whether the visit started with an ad click, without keeping that click's code.

What we never record: name, e-mail, phone, CPF or CNPJ, amounts you type (not even in the calculator), text you write, your customers' data, the IP address and the browser's full identification string (user agent). The IP address is used only at the moment of sending, to limit abuse and to work out the country and the state or region, and is not kept; the user agent is read on the spot and reduced to the device type, the browser and the system.

The measurement uses no cookies and no identifier that recognizes you on another day. Each visit gets a random identifier, kept only in the open tab, which changes after 30 minutes of inactivity and is erased when the tab is closed. After you sign in to your account, the visit is linked to the account's internal identifier (never to your e-mail), so we can understand the path of use, for example at which step of sign-up or of first use people stop.

Only the controller accesses this data, through a dashboard protected by sign-in. It is stored at Amazon Web Services and Neon, in the São Paulo region, and the dashboard is hosted by Vercel (section 4). It is erased automatically 13 months after the end of the month in which it was recorded, it is erased together with your account when you delete it, and it is part of the copy you download in Settings > Your Data > Download My Data.

We honor the browser's "Do Not Track" and Global Privacy Control signals: with either of them on, nothing is measured. You can also turn the measurement off in this browser with the control below; the choice stays in the browser until you turn it back on.

We use encrypted connections (HTTPS), passwords stored only as hashes, a protected session cookie, a temporary lock after several failed sign-in attempts and restricted access to data. No system is fully immune to incidents; if one occurs that may pose a relevant risk to you, we will notify you and the ANPD as the law requires.

BolsoVerde is intended for people aged 18 or over and does not knowingly collect data from children or teenagers.

We may update this Policy. Relevant changes will be announced by e-mail or in the Service, and the date of the last update appears at the top of this page.

Samuel da Cruz Santana — contato@bolsoverde.com.