1.1. This Policy describes how RITMO APLICATIVO LTDA, registered under CNPJ No. 63.677.137/0001-03, with its registered office at Rua Pais Leme, 215, Suite 1713, Pinheiros, São Paulo, SP, ZIP Code 05424-150 (Brazil), processes personal data through the Ritmo Platform, which comprises:
1.2. For purposes of Law No. 13,709/2018 (LGPD — Brazil's data protection law), Ritmo acts, as a general rule, as the Controller of the personal data processed to operate the Platform.
1.3. Privacy channel: privacidade@appritmo.com
1.4. User support channel: suporte@appritmo.com
2.1. Personal data: any information relating to an identified or identifiable natural person.
2.2. Sensitive personal data: data concerning health or sexual life, among other categories set out in the LGPD.
2.3. Processing: any operation performed with personal data, such as collection, use, access, storage, sharing, deletion, and anonymization.
2.4. Processor: a natural person or legal entity that processes personal data on behalf of Ritmo, under our instructions.
3.1. Account and authentication data
3.2. Profile photo (optional)
Image voluntarily submitted to compose the user profile.
3.3. Onboarding responses, which may include sensitive data
We collect onboarding responses to personalize content and training routines. Some responses may reveal sensitive personal data related to health and sexual life. The current onboarding data list is set out in Annex I.
3.4. Community
Content and interactions published by the user, such as posts, comments, and reactions. Content you choose to publish may reveal sensitive data at your own initiative.
3.5. Technical and security data (logs)
3.6. Payments and subscription
The subscription can be paid inside the app, through the App Store (Apple) or Google Play, or on the website, billed by Stripe. Older subscriptions made on the website may be billed by Asaas. These companies may collect and process the data required for billing, fraud prevention, and compliance with legal obligations, such as name, tax identification number, email address, phone number, and address, as applicable to the payment method.
Subscriptions made in the stores are managed by RevenueCat, which receives the proof of purchase from the store and, from the app, technical identifiers and the account email address.
Ritmo receives only the minimum information needed to confirm and manage the subscription, such as payment status, plan, dates, and technical identifiers, without access to full card details.
3.7. Cookies and pixels on the website
On the website, we may use cookies and similar technologies for:
These technologies may collect online identifiers and browsing data.
3.8. App usage events for ad measurement
When you use the app, we send Meta Platforms basic usage events, such as installation, app opens, completion of the initial questionnaire, and purchase confirmation, to measure the effectiveness of our advertising campaigns. These events are associated with pseudonymized identifiers, such as a random identifier generated by the app itself and, on Android, the device advertising ID. We do not send your name, email address, questionnaire answers, or any data about your health or training. On iOS, measurement is performed in aggregate through Apple's SKAdNetwork technology, without individual identification. You can reset or delete the advertising ID in your device settings.
4.1. Purposes
4.2. Legal bases
5.1. We do not sell personal data.
5.2. We share data only when necessary:
6.1. App and account data may be processed on infrastructure configured for the operation of the Platform.
6.2. The use of global measurement and advertising platforms, on the website and in the app, may involve processing or storage outside Brazil, constituting an international transfer in accordance with LGPD art. 33 and applicable mechanisms.
6.3. Payment processing by Stripe, subscription management by RevenueCat, usage statistics by PostHog, and email delivery by Resend also take place outside Brazil, under the same conditions as the previous clause.
7.1. We retain data for as long as necessary to provide the service and fulfill the purposes set out in this Policy.
7.2. Account deletion: you can delete your account inside the app, under Account > Delete account, or request it through the privacy channel. In the app, the deletion happens immediately.
7.3. Active subscription: deleting the account does not stop the billing. If your subscription still renews automatically, cancel it before deleting the account: in the App Store or Google Play, from the store's subscriptions screen; on the website, from the app itself. The app shows you the way. If you have already cancelled, you can delete the account at any time, and whatever access was left in the paid period ends with the deletion.
7.4. What we erase: the login account, the onboarding answers, progress, workouts, tests, achievements, the link with a partner doctor, and the messages sent through the app. We also ask the processors to erase your data: we remove your contact from Resend and request the deletion of your record at RevenueCat.
7.5. What we keep and for how long, with the email address replaced by a code that does not reveal it:
At the end of each period, these records are erased.
7.6. Automatic infrastructure backups may contain your data for up to 30 days after the deletion, until they are replaced.
8.1. We adopt reasonable technical and administrative measures to protect data, including access controls, permission management, and secure transmission.
8.2. Internal access is restricted to authorized individuals who are subject to confidentiality obligations.
8.3. Users also play an essential role in security: keeping a strong password, avoiding sharing credentials, and protecting the device.
9.1. In the event of an incident that may pose a relevant risk or harm, we will notify the competent data protection authority (in Brazil, the ANPD — Autoridade Nacional de Proteção de Dados) and the affected data subjects as required by applicable law.
10.1. Types of cookies and technologies:
10.2. You may manage your preferences through the website's cookie banner, as well as through your browser or device settings. Disabling certain cookies may affect website functionality.
11.1. Under the terms of the LGPD, you may request:
11.2. Channel: privacidade@appritmo.com
11.3. To protect your data, we may request identity verification before fulfilling a request.
12.1. The Platform is intended for users aged 18 and over, and we do not knowingly collect data from minors.
12.2. If we identify that a minor has registered, we may suspend or close the account and take steps to delete or anonymize the relevant data, subject to minimum legal retention requirements.
13.1. This Policy may be updated. Material changes will be communicated through a notice in the app or on the website and, where appropriate, by email.
14.1. This Policy: appritmo.com/en/privacy
14.2. Terms of Use: appritmo.com.br/termos
A. Multiple-choice questions, as per the current onboarding flow