Privacy Policy
Effective 22 August 2026
Broto identifies plant species and suggests diagnoses from photos. To do that we need to process some of your data. This policy explains what we collect, why, who we share it with, and how you can remove everything whenever you want.
Who processes your data
The data controller is:
| Legal name | 61.021.870 Ghabriel Elias Fonseca de Souza |
| Company ID (CNPJ) | 61.021.870/0001-31 |
| Address | Rua Cerejo Cruz, 583, Centro, Boa Vista/RR, 69.301-060, Brazil |
| Contact | falecombroto@gmail.com |
Write to that address to exercise any of the rights described in this policy.
Data we collect
| Data | Why we collect it | Legal basis |
|---|---|---|
| Name and email | Create and authenticate your account, and send confirmation and password recovery emails. | Performance of contract |
| Plant photos | Send to the vision model that identifies the species and assesses leaf health, and keep the plant's history in your account. | Performance of contract |
| Plant records | Nickname, room, watering interval, care history and reminders. | Performance of contract |
| Brotinho conversations | Your questions and the assistant's replies. We send them to the AI provider along with the data of the plant you asked about. | Performance of contract |
| Species searches | The term you type into search is sent to the AI provider to find the species. | Performance of contract |
| Analysis feedback | When you mark an analysis as helpful or not, we keep the answer to improve the service. | Legitimate interest |
| Device data | Operating system, app version, language and time zone — so reminders arrive at the right time and we can support you. | Legitimate interest |
| Subscription status | To know whether your account is free or Pro and how many analyses remain. | Performance of contract |
What we do not collect
We do not ask for your precise location. We do not read your calendar, your contacts or your gallery — only the photo you choose to send. We do not sell your data to anyone.
Who we share it with
We share only what the app needs to work, with providers acting as processors:
- Amazon Web Services — server, database and photo storage.
- Cloudflare — delivery and protection of the traffic between the app and the server.
- Brevo — sending the signup confirmation and password recovery emails.
- DeepSeek — artificial intelligence provider. Receives the photo to identify the species and assess its health, your Brotinho messages along with the data of the plant in question, and the term you type into search. Everything is sent by our server, never directly from your device.
- RevenueCat — manages subscription status.
- PostHog — error monitoring. It only receives the technical report of an app failure: the error message, the screen where it happened, the device model and the OS version. It does not receive your name, your email or your photos, and we do not use it to track what you do in the app.
- Apple and Google — process the payment. We never receive or store your card details.
International transfers
Some of these providers process data outside Brazil. Transfers rely on the safeguards set out in article 33 of the Brazilian General Data Protection Law and on the contracts signed with each provider.
How long we keep it
Your data is kept for as long as your account exists. When you delete your account in the app, we remove plants, photos, history and reminders from our servers within 30 days.
Some things go sooner, without you having to ask: Brotinho conversations unused for 30 days are deleted, delivered reminders disappear after 14 days, and analyses you did not save as a plant disappear after 7 days.
Records we are legally required to keep — such as application access logs, for the period set by the Brazilian Internet Civil Framework — are preserved separately even after deletion.
Your rights
Brazilian data protection law lets you, at any time:
- confirm that we process your data and access what we hold;
- correct incomplete or outdated data;
- request anonymisation, blocking or deletion of unnecessary data;
- request portability of your data;
- know who we share your data with.
Portability takes no request: in the app, under Profile › Export my data, you download a JSON file right away with plants, tasks, care history, analyses, Brotinho conversations, reminders received and links to your photos.
Account and data deletion is described in Delete account and data. For anything else, write to falecombroto@gmail.com — we answer within 15 days.
Children
Broto is not directed at children under 13 and we do not knowingly collect their data. We do not ask for age at sign-up, so we have no way of spotting it on our own. If you are the guardian of a child under 13 with a Broto account, write to falecombroto@gmail.com: we delete the account and its data.
Changes to this policy
When we change something relevant, we tell you inside the app before the change takes effect. The effective date at the top of this page always indicates the current version.