Privacy Policy

The privacy and security of our users' data — especially children's and adolescents' data — are fundamental to Smart Allowance (Mesada Inteligente). This Privacy Policy describes how we collect, use, store, and protect your personal information. We apply the law of where you are: the GDPR in the European Economic Area, the UK GDPR in the United Kingdom, COPPA in the United States, and the LGPD (Law No. 13,709/2018) in Brazil.

1. Who We Are

Smart Allowance is a digital platform offered under the Software as a Service (SaaS) model, accessible via the web and mobile devices, designed for organizing family chores, gamification, points tracking, rewards, and allowance management, with an educational focus.

We help parents encourage household chores, studying, and responsibilities through a gamified points and rewards system.

Data Controller: MESADA INTELIGENTE FINANCIAL EDUCATION LTD.
EIN: 64.501.665/0001-61
Address: Rua Cabo Antonio Pinton, 231 - Parque Novo Mundo - São Paulo - SP, Brazil
Privacy Email: contact@smartallowance.app

2. Information We Collect

2.1. Data of Parents/Guardians

• Registration Data: Full name, email address, and phone number (optional).
• Payment Data: Detailed in section 2.4 below.
• Usage Data: Access logs, IP address, device type, browser, and interactions with the platform.

2.2. Data of Children and Adolescents

IMPORTANT: Data of children and adolescents is collected ONLY with the specific and prominent consent of at least one parent or legal guardian.

• Basic Data: Name, date of birth, and profile photo (optional).
• Activity Data: Completed tasks, accumulated points, and evidence photos of completed tasks (submitted voluntarily).
• Access Data: Encrypted access code or login credentials (controlled by the parents).
• Technical Data: Access logs and type of device used.

2.3. Data Collected Automatically

• Cookies and Similar Technologies: We use essential cookies for the platform to function and analytics cookies (Google Analytics) to improve our services.
• Browsing Data: Pages visited, time spent, clicks, and interactions.
• Device Data: Model, operating system, browser version, and screen resolution.

2.4. Payment and Processing Data

We collect no payment data at all. Your subscription is handled entirely by the App Store or Google Play: Apple or Google collects and holds your payment details under their own privacy policies. We never see your card number, and all we receive is a confirmation that the subscription is active, tied to an anonymous purchase token.

3. How We Use Your Data

We use the collected data exclusively for the following legitimate purposes:

• Service Delivery: Creating and managing accounts, enabling the creation and tracking of tasks, and calculating points and rewards.
• Personalization: Tailoring the family experience and offering tips and age-appropriate task suggestions.
• Communication: Sending notifications about tasks, approvals, and goals achieved, as well as important account notices.
• Customer Support: Answering questions, resolving technical issues, and providing assistance.
• Improvements and Analytics: Understanding how the platform is used to improve features and develop new ones.
• Security: Preventing fraud, abuse, and unauthorized access; ensuring the security of the platform.
• Legal Compliance: Responding to legal requests, protecting rights, and fulfilling legal obligations.

3.1. Legal Basis for Processing

The GDPR requires us to name the legal basis for each purpose (Article 6). Ours are:

• Performance of a contract (Art. 6(1)(b)) — creating and running your account, managing chores and points, processing your subscription. Without this we cannot provide the service.
• Consent (Art. 6(1)(a), and Art. 8 for children) — processing a child's data, which the parent or guardian consents to at registration, and any non-essential cookies. You can withdraw consent at any time, and doing so does not affect processing carried out before the withdrawal.
• Legitimate interests (Art. 6(1)(f)) — keeping the platform secure, preventing fraud and abuse, and understanding aggregate usage to improve features. We weigh these against your rights and do not rely on this basis for children's data.
• Legal obligation (Art. 6(1)(c)) — tax and accounting records, and responding to lawful requests from authorities.

4. Data Sharing

Your data may be shared only in the following situations:

4.1. Service Providers

We share data with companies that help us operate the platform, always under confidentiality agreements and strict terms of use:

• Amazon Web Services (AWS): Hosting and server infrastructure (sa-east-1 region, São Paulo).
• App Store and Google Play: For subscriptions bought in the apps. Apple and Google are the sellers, hold the payment details themselves, and share with us only the status of the subscription.
• Analytics Tools (Google Analytics): Aggregated browsing data and access metadata (only on public pages: landing page and sign-up).

4.2. Legal Requirements

We may disclose data when:

• Required by law, court order, or a competent authority.
• Necessary to protect the rights, property, or safety of Smart Allowance, its users, or third parties.
• Necessary to prevent fraud or illegal activities.

4.3. Business Transactions

In the event of a merger, acquisition, or sale of assets, data may be transferred, but it will remain protected by this Privacy Policy.

5. Special Protection for Children and Adolescents

5.1. Parental Consent

A child never signs up on their own. A parent or legal guardian creates the family account, adds each child, and gives specific and prominent consent for that child's data to be processed. This consent is requested during registration and can be withdrawn at any time.

The age at which a person can consent on their own behalf differs by jurisdiction, and we apply the rule of the user's location:

• Brazil (LGPD, Article 14): parental consent for anyone under 18.
• European Economic Area (GDPR, Article 8): parental consent for anyone under 16, or under the lower age set by the member state, which may be as low as 13.
• United Kingdom (UK GDPR): parental consent for anyone under 13.
• United States (COPPA): verifiable parental consent for anyone under 13.

Because a guardian creates and controls every child profile on Smart Allowance, parental consent is obtained in all cases, whatever the child's age.

5.2. Best Interests of the Child

All decisions regarding the processing of children's and adolescents' data give priority to the best interests of the child, as required by Article 14 of the LGPD and Recital 38 of the GDPR.

5.3. Appropriate Transparency

We strive to present privacy information in a clear, accessible way suited to the understanding of different age groups.

5.4. Data Minimization

We collect only the data strictly necessary for the platform to function. We do not require excessive information from children.

5.5. Parents' Rights

Parents/guardians have full control over their children's data and may:

• Access all data collected.
• Request the correction of information.
• Request the deletion of the account and of all data.
• Revoke consent at any time.
• Export the data in a structured format (portability).

6. Data Security

We implement robust technical, administrative, and physical measures to protect your data:

• Encryption: Data stored in an encrypted database; communications over HTTPS/TLS.
• Access Control: Data access restricted to authorized personnel only.
• Monitoring: Security logs and monitoring of suspicious access.
• Backups: Regular backups in a secure environment.
• Infrastructure: Servers on AWS with international security certifications (ISO 27001, SOC 2).
• Testing: Periodic security audits and tests.

Important: In the event of a security incident that may pose risks to users, we will promptly notify those affected and the ANPD (Autoridade Nacional de Proteção de Dados — the Brazilian National Data Protection Authority), as required by the LGPD.

7. Data Retention

We keep your data only for as long as necessary for:

• While your account is active: For as long as you keep your account active.
• Legal obligations: For the period required by law (e.g., tax data for 5 years).
• Dispute resolution: Until legal disputes are fully resolved.
• After cancellation: Data may be kept in anonymized form for statistical analysis.

You may request the complete deletion of your data at any time. Minors' data will be deleted immediately upon request by their parents/guardians.

8. Your Rights

These rights are granted by the GDPR and the UK GDPR where they apply to you, and by the LGPD in Brazil:

• Confirmation and Access: Confirm whether we process your data and access it.
• Correction: Correct incomplete, inaccurate, or outdated data.
• Anonymization, Blocking, or Deletion: Request the anonymization, blocking, or deletion of unnecessary or excessive data.
• Portability: Receive your data in a structured, interoperable format.
• Information About Sharing: Know with whom we share your data.
• Revocation of Consent: Withdraw your consent at any time.
• Objection: Object to processing in specific cases.
• Review of Automated Decisions: Request a review of decisions made solely on the basis of automated processing (GDPR Article 22). We do not make decisions with legal or similarly significant effects by automated means.
• Restriction of Processing: Ask us to limit how we use your data while a dispute about it is resolved (GDPR Article 18).
• Complaint to a Supervisory Authority: Lodge a complaint with the data protection authority of your country — the ANPD in Brazil, the authority of your member state in the EEA, or the Information Commissioner's Office (ICO) in the UK. You may do this without contacting us first, though we would rather hear from you and put it right.

To exercise any of these rights, write to contact@smartallowance.app. We answer within 30 days, as required by the GDPR, and may ask you to confirm your identity before acting on a request. Exercising your rights is free; we only charge for requests that are manifestly unfounded or excessive, as the GDPR permits.

9. Cookies and Tracking Technologies

9.1. Types of Cookies We Use

Essential Cookies: Required for the platform to function (authentication, session, security). They cannot be disabled.

Preference Cookies: Store language preferences, theme, and personalized settings.

9.2. Analytics Cookies (Public Pages Only)

We use Google Analytics exclusively on public pages (landing page and sign-up) for marketing analysis and experience improvements. These cookies are NOT used in the authenticated areas of the platform where children's data and tasks are processed.

9.3. Managing Cookies

You can manage cookies through your browser settings. Note that disabling essential cookies may affect the platform's functionality.

10. International Data Transfers

Your data is stored on servers in the sa-east-1 (São Paulo) region of Amazon Web Services (AWS). We are a Brazilian company and our infrastructure is in Brazil.

If you are in the European Economic Area, your data is protected by an adequacy decision when it reaches Brazil. On 26 January 2026 the European Commission adopted an adequacy decision for Brazil under Article 45 of the GDPR, recognising that Brazilian law provides a level of protection essentially equivalent to the GDPR's. Personal data may therefore flow from the EEA to Brazil without any further safeguard or authorisation: Standard Contractual Clauses are no longer required for this transfer. The Commission reviews the decision at least every four years, and Brazil's National Data Protection Authority (ANPD) recognised the European Union reciprocally in Resolution No. 32/2026.

Whatever the legal basis, the technical and organisational measures described in section 6 apply to your data at all times — encryption in transit and at rest, access control, and providers certified to ISO 27001 and SOC 2.

If you are in the United Kingdom: the UK has not adopted an adequacy regulation for Brazil, and Smart Allowance is not distributed through the app stores in the United Kingdom. If you access the service from there anyway, we apply the same security measures described in section 6 and, where a restricted transfer under the UK GDPR is involved, the safeguards required by Article 46 of the UK GDPR.

You may request a copy of the safeguards that apply to your data by writing to contact@smartallowance.app.

Analytics data from public pages (landing and sign-up) may be processed by Google Analytics — aggregated and statistical only, limited to public pages, and never covering children's activity inside the platform.

11. Representative in the European Union (GDPR Article 27)

Smart Allowance is established in Brazil and offers its service to users in the European Economic Area. As required by Article 27 of the GDPR, we have designated a representative in the Union. Data subjects and supervisory authorities may address the representative on all matters relating to the processing of personal data, in addition to or instead of contacting us in Brazil.

Contacting the representative does not limit any of the rights described in section 8, including your right to lodge a complaint directly with the supervisory authority of your member state.

12. Changes to this Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, in legislation, or in the services we offer.

Notice of Changes: Significant changes will be communicated by email or through an in-platform notification at least 10 days in advance.

We recommend reviewing this policy regularly. The date of the last update is indicated at the top of this page.

13. Governing Law and Jurisdiction

Smart Allowance is operated from Brazil, and this policy is governed by Brazilian law, in particular:

• The Brazilian General Data Protection Law (LGPD — Lei Geral de Proteção de Dados, Law No. 13,709/2018)
• The Brazilian Internet Civil Framework (Marco Civil da Internet, Law No. 12,965/2014)
• The Brazilian Consumer Protection Code (Código de Defesa do Consumidor, Law No. 8,078/1990)
• The Brazilian Child and Adolescent Statute (Estatuto da Criança e do Adolescente, Law No. 8,069/1990)

This does not take away rights you have where you live. If you are a consumer in the European Economic Area or the United Kingdom, you keep the protection of the mandatory rules of your own country, including the GDPR or UK GDPR, and you may bring proceedings before your local courts.

14. Contact and Data Protection Officer (DPO)

If you are in the European Economic Area, you may also address our representative in the Union — see section 11.

---

Last updated: August 22, 2026
Version 1.1