Privacy Policy

Secretly Organize ("Secretly", "we", "us" or "our") is a personal business-management application operated by SECRET INTERMEDIACAO DE SERVICOS E NEGOCIOS LTDA, registered in Brazil under CNPJ 62.946.119/0001-09.

Secretly helps independent professionals organize appointments, clients, income, expenses, goals and other business information.

This Privacy Policy explains what information we collect through the Secretly Organize mobile application and website, how we use and protect that information, when it may be processed by service providers, how long we retain it and the rights available to you.

By using Secretly, you acknowledge the practices described in this Privacy Policy and agree to our Terms of Service.

1. Information we collect

Account information

When you create an account, we may collect:

• name;
• email address;
• authentication credentials;
• account identifiers.

If you use Sign in with Apple, we receive the information Apple makes available to us based on the permissions and privacy options you choose.

Passwords used for password-based authentication are handled through our authentication infrastructure and are not available to Secretly in plain text.

Profile photo

You may optionally upload a profile photo. Providing a profile photo is not required to use the core features of the Service.

Business information you enter

Secretly stores the information you choose to enter in order to organize your business, which may include:

• appointments and booking dates;
• appointment duration;
• appointment values and tips;
• income and expenses;
• earnings goals;
• client names or aliases;
• client phone numbers;
• client tags and notes;
• appointment history;
• other records you voluntarily create through the available fields.

We use this information only to provide the features of the Service, including displaying your records and calculating metrics, totals and summaries.

Technical and security information

We may collect limited technical information necessary to operate and secure the Service, such as device type, operating-system version, app version, authentication and security events, diagnostic information and error logs. We do not use this information for advertising.

Support communications

If you contact us for support, we may process the information you provide in your message and any information reasonably necessary to investigate and respond to your request.

Subscription information

If Secretly offers paid subscriptions through the Apple App Store, we may receive information necessary to verify your subscription, such as subscription status, product identifier and transaction identifiers. We do not receive your full payment-card information from Apple.

2. How we use information

We use personal information only for legitimate purposes related to operating Secretly, including:

• creating and authenticating your account;
• storing and syncing your records;
• displaying clients and appointment history;
• calculating income, expenses, profit, goals and other metrics;
• providing appointment reminders;
• maintaining account and application security;
• preventing abuse and unauthorized access;
• detecting and fixing technical problems;
• providing customer support;
• complying with applicable legal obligations.

Appointment reminders are generated as local notifications on your device. We do not send appointment information through an external advertising or marketing push-notification service.

We do not sell personal information. We do not share personal information with advertisers. Secretly does not display advertising. We do not use client records for advertising, profiling or marketing to your clients.

3. Legal bases under the LGPD

Depending on the processing activity, we process personal data on one or more legal bases permitted by the Brazilian General Data Protection Law — Lei Geral de Proteção de Dados Pessoais ("LGPD"), including:

• performance of a contract or procedures related to a contract, where processing is necessary to provide Secretly;
• legitimate interests, where necessary to secure, maintain and improve the Service and where those interests do not override the rights of data subjects;
• compliance with legal or regulatory obligations;
• exercise of rights in judicial, administrative or arbitration proceedings;
• consent, where consent is specifically required by applicable law.

Where processing relies on consent, consent may be withdrawn as provided by applicable law.

4. Information about your clients

You determine which client information you enter into Secretly and how you use that information.

For personal data about clients that you enter into Secretly, you generally determine the purposes and content of the processing. To the extent that Secretly processes those records solely to provide the Service according to your instructions, Secretly acts as a data processor ("operador") on your behalf.

You are responsible for ensuring that:

• you have an appropriate legal basis for processing client information;
• the information you record is necessary and appropriate for your legitimate business purposes;
• your processing complies with applicable privacy and data-protection laws;
• you respond appropriately to privacy requests from your clients when required by law.

Secretly does not independently contact, market to, advertise to or provide services to clients whose information you enter.

Sensitive client information

Secretly does not require sensitive personal data about your clients. The Service is not designed for storing sensitive personal information about third parties in free-form notes or other fields.

You must not use Secretly to record sensitive personal data about clients unless Secretly expressly provides a feature designed and legally supported for that purpose. This includes, in particular, information concerning:

• health or medical conditions;
• sexual life or sexual orientation;
• racial or ethnic origin;
• religious beliefs;
• political opinions;
• trade-union membership;
• genetic information;
• biometric information used for identification;
• other categories treated as sensitive personal data under applicable law.

Free-form fields technically allow you to enter text of your choosing. You are responsible for complying with this restriction and avoiding unnecessary or sensitive information.

5. Service providers

We use a limited number of service providers that process information on our behalf as necessary to operate Secretly. These currently include:

Amazon Web Services

Amazon Web Services ("AWS") provides infrastructure services used for functions such as application hosting, data storage, authentication infrastructure, image storage, and security and operational infrastructure.

Apple

Apple may process information when you use Sign in with Apple, download or update the application, or purchase a subscription through the App Store, if subscriptions are offered.

These providers process information according to their own legal obligations and their agreements with us. We require service providers acting on our behalf to use personal data only as necessary to provide their services and to maintain protections consistent with applicable privacy and data-protection requirements.

We do not authorize our infrastructure providers to use your business records or client records for their own advertising or marketing purposes.

6. International data transfers

Some service providers, including global technology providers such as Apple and AWS, may process or make personal data accessible from locations outside Brazil.

Where an international transfer of personal data occurs, we use applicable safeguards and transfer mechanisms required by the LGPD and regulations issued by the Brazilian National Data Protection Authority ("ANPD").

7. Data retention

We retain your account information and business records while your account remains active and for as long as necessary to provide the Service.

When you delete your account, we delete or de-identify personal information and business records associated with the account from our active production systems, except where retention is required by applicable law or necessary for the establishment, exercise or defense of legal claims.

Residual copies may remain temporarily in encrypted or access-restricted backups for up to 30 days after account deletion and will be removed through the normal backup-expiration process. Backup copies are maintained for disaster recovery and business-continuity purposes and are not used for advertising or ordinary application functionality.

Security and diagnostic logs may be retained for a limited period where reasonably necessary for security, fraud prevention, troubleshooting or legal compliance.

8. Account deletion

You may delete your Secretly account through the Settings section of the app. You may also contact us regarding deletion at support@secretly.com.br.

Deleting your account deletes the account itself, not merely disables it. Associated personal data and business records will be handled according to the retention process described above.

If you created your account using Sign in with Apple, Secretly will also take the steps required to revoke the associated authentication credentials or tokens when the account is deleted.

9. Security

We use reasonable administrative, technical and organizational measures designed to protect personal information against unauthorized access, alteration, disclosure, loss or destruction. These measures include, where applicable:

• encryption of data in transit;
• authentication and access controls;
• restricted access to production systems;
• separation of infrastructure permissions;
• logging and monitoring of security-related activity;
• security procedures for infrastructure access.

No system for storing or transmitting information can be guaranteed to be 100% secure. If we become aware of a security incident involving personal data, we will take appropriate steps and provide notifications where required by applicable law.

10. Your privacy rights

Subject to the requirements and limitations of applicable law, you may have rights including:

• confirmation that we process your personal data;
• access to your personal data;
• correction of incomplete, inaccurate or outdated information;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed information;
• portability where applicable and regulated;
• information about entities with which your personal data has been shared;
• deletion of personal data processed on the basis of consent, where applicable;
• information about the consequences of refusing consent;
• withdrawal of consent;
• review of certain automated decisions where applicable;
• opposition to processing in circumstances provided by law.

To exercise a privacy right regarding your Secretly account, contact support@secretly.com.br. We may need to verify your identity before completing certain requests.

Rights relating to client records

If you are a client whose information was entered into Secretly by an independent professional, you should normally direct your request to the professional who entered and controls that information. Where Secretly acts as that professional's data processor, we will reasonably assist the professional in responding to valid requests as required by applicable law.

11. Children and minors

Secretly is not specifically directed to children.

12. No advertising or sale of data

Secretly:

• does not display third-party advertising;
• does not sell personal data;
• does not rent client lists;
• does not share business or client data with advertisers;
• does not use business or client data to build advertising profiles.

If these practices ever materially change, this Privacy Policy will be updated before the new processing begins and any consent required by law will be obtained.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time to reflect changes to the Service, our practices or applicable law. When we do, we will update the "Last updated" date at the top of this document.

If a change materially affects how we process personal information, we will provide an appropriate notice through the app, by email or through another appropriate method before or when the change takes effect, as required by law.

14. Contact and data controller

Secretly Organize is operated by:

SECRET INTERMEDIACAO DE SERVICOS E NEGOCIOS LTDA CNPJ: 62.946.119/0001-09 Brazil

Privacy and support contact: support@secretly.com.br

Website: secretly.com.br