Três Limões

Três Limões · Tuta

Privacy Policy — TUTA

Last updated: 23/09/2026

Effective date: this policy applies from the date of last update above.

Language: this is a translation of the Portuguese original, published at tuta.treslimoes.com.br/privacidade. The Portuguese version is the legally binding one; if the two ever diverge, the Portuguese text prevails.

1Who processes your data

TUTA is operated by BARBOSA E FOLLE DESENVOLVIMENTO DE SOFTWARE LTDA ("Três Limões", "we"), CNPJ 68.586.378/0001-52, registered at Av. Paulista, 91, Brazil.

For anything to do with your privacy — questions, requests for access, correction or deletion of data — write to us at privacidade@treslimoes.com.br.

Data Protection Officer: in accordance with Art. 41 of the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018), Três Limões appoints Logan Cunha Folle as the officer responsible for personal data processing. The channel is free and direct:

2What data we collect

Provided by you:

Data Required? What for
E-mail and password Yes Creating and accessing your account. The password is never stored in plain text — we keep only a hash (BCrypt), which not even we can reverse.
Name No Personalising your experience in the app.
Date of birth Yes, at sign-up Enforcing the minimum age of 12 (section 6), working out your age, used in the age-sliced rankings (section 3 below), and adjusting ads to your age: for users under 13 and under 18, the app asks Google for child or teen treatment, and does not ask about tracking anyone under 13. We may also use it to wish you a happy birthday.
City Yes, at sign-up City- and state-sliced rankings (section 3 below). You pick the city from an IBGE list and can change it in your profile.
Reviews (score, comment, attributes) — This is the core use of the app: rating products and helping other people decide.
Favourites — The list of products you marked to buy next time.
Product/brand/category suggestions — Forwarding to our team requests for what is missing from the catalogue.

Generated by your use of the app:

Data What for
IP address and timestamp of each request Application access logs, required by Art. 15 of Brazil's Internet Civil Framework. We keep only the IP and the moment — not the route accessed, the request content, or what you did there. Periods and conditions in section 7.
The device's advertising identifier (IDFA) Personalising the ads the app shows to people who do not subscribe. It only exists if you allow it in the iOS prompt (section 4); if you decline, it is not collected and ads carry on, without personalisation.
Your subscription status Knowing whether your account has access to curation and whether it should see ads. It comes from Apple — we never see your payment details (section 4).

Nothing beyond that. TUTA sustains itself in two ways, both described in section 4: subscription, bought inside the app through the App Store, and ads, shown to people who do not subscribe. Neither gives us any data about you that is not in the tables above.

What TUTA does not collect: photos or images uploaded by you; GPS location — the app never asks for location permission, and the only city it knows is the one you tell it yourself; payment data — the subscription purchase happens inside the App Store, between you and Apple, and no card ever passes through us. We also do not send e-mail or push notifications using your contact details.

One honest caveat about location: Google's ad service infers an approximate location from the IP address, as any service on the internet is able to do. That is not the device's GPS, it does not come from a permission the app requests, and it is described in section 4.

3How we use the data — the sliced rankings in particular

City and age group exist only to answer "what is well rated near me" and "what is well rated by people my age". A product with few reviews inside a small slice does not enter that slice's ranking — below three reviews, the number would say more about who opened the app than about the product, and it could even expose the opinion of an identifiable person. That protection is technical, not just a promise: the rule lives in the ranking calculation itself.

4Who we share with

  • Apple: the TUTA subscription is bought and charged inside the App Store. The payment contract is between you and Apple; from Apple we receive only the subscription status — whether it is active, which plan, and until when — never your card, cardholder name or any billing data. The legal basis is performance of the contract you enter into with us when you subscribe (Art. 7, V). Apple's own processing of your data is governed by Apple's privacy policy.

  • Google (AdMob): the banner shown to people who do not subscribe is served by Google's ad service, which receives, in order to deliver the ad and curb fraud, technical data about the device and its use: device identifier, approximate location (inferred from the IP, not from GPS), data about the ad itself, app interaction, crash data and performance data. The basis is the legitimate interest in sustaining a free app (Art. 7, IX).

    The advertising identifier (IDFA) is a separate case, and it depends on you. The first time a banner loads, iOS asks whether you allow tracking. If you allow it, the IDFA is shared with Google and the ads become personalised — basis: your consent (Art. 7, I), which is also what authorises that specific international transfer (Art. 33, VIII). If you decline — or do not answer — the IDFA is not collected, and ads carry on existing, just without personalisation. You can change that answer at any time in your iPhone Settings, under Privacy & Security → Tracking.

  • Infrastructure providers: the TUTA application runs on Fly.io, in the São Paulo region (GRU), and the data sits in a Neon database, in the sa-east-1 region, also in São Paulo. Your account, your reviews and your favourites are stored and processed in Brazil: there is no international data transfer (LGPD, Art. 33) in the running of the app. Both companies are foreign and operate regions in several countries — the Brazilian region is our choice, declared here because it is the region, and not the supplier's nationality, that determines where your data sits.

  • E-mail routing: messages sent to privacidade@treslimoes.com.br and suporte@treslimoes.com.br pass through Cloudflare's infrastructure before reaching our inbox, and that network operates outside Brazil — here there is indeed an international transfer (Art. 33). It happens because you decided to write to us, and delivering your message is precisely answering what you asked for: the basis is Art. 33, IX together with Art. 7, V (performance of a contract or preliminary procedures, at the data subject's own request). When the message is a request under section 5, Art. 33, IX together with Art. 7, II also applies: replying is a legal obligation of ours (Art. 18 of the LGPD), and keeping that channel open is required by Resolution CD/ANPD No. 2/2022. We do not rely on standard contractual clauses (Art. 33, II) — Cloudflare does not offer the clauses approved by the ANPD (Resolution CD/ANPD No. 19/2024), whose adoption deadline closed on 23/08/2025; the ground we use is one of those the resolution itself preserves because it does not depend on further regulation (Art. 1, sole paragraph). The rest of our domain infrastructure (DNS) processes no personal data of app users.

  • Website hosting: treslimoes.com.br and tuta.treslimoes.com.br are published on Cloudflare Pages — the websites, not the application. The access log any web server produces stays with Cloudflare, under the same international transfer as the item above; the institutional site's policy details that point.

  • Website audience measurement: the same Cloudflare, when you allow it, counts visits to treslimoes.com.br and tuta.treslimoes.com.br. It does not involve the app or your account in it, it uses no cookies and it only happens with your consent — the details are in section

5Your rights

Under the LGPD, you may request at any time, by writing to the officer's channel, dpo@treslimoes.com.br (section 1):

  • Confirmation that we process your data, and access to it;
  • Correction of incomplete, inaccurate or outdated data;
  • Anonymisation, blocking or deletion of unnecessary data;
  • Portability of your data;
  • Deletion of data processed on the basis of your consent;
  • Information about who we share your data with;
  • Withdrawal of the consent given for the optional field (name). City and date of birth are not included here: they are asked for at sign-up — the city for the city-sliced rankings, the date to enforce the minimum age (section 6) — and not on the basis of your consent. Both can be corrected in your profile.

You can also delete your account directly from the app, on the Account screen. That is the fastest route — the address above remains available as an alternative.

What happens when you delete your account: your reviews and favourites are deleted along with the account. Suggestions you sent stay in the system, but stop being linked to you — they concern the catalogue (what is still missing), not your identity.

Deleting your account does not cancel your Apple subscription. They are separate contracts: the subscription is yours with Apple, and only ends in your App Store settings. If you delete the account without cancelling, the billing continues. The app warns you about this on screen, before you confirm the deletion.

6Minimum age and teenagers

You must be at least 12 years old to create an account on TUTA. The rule is checked against the date of birth given, both at sign-up and when editing the profile — at sign-up alone, it would be enough to enter another date and correct it straight afterwards.

Twelve is where Brazilian law separates a child from an adolescent (Statute of the Child and Adolescent, Art. 2), and it is children's data that the LGPD treats most restrictively: Art. 14, §1 requires specific, prominent consent from at least one parent or legal guardian — something TUTA has no way to collect or verify. Enforcing the minimum age is what avoids that processing, rather than merely declaring it in a policy.

Teenagers remain an audience for the app: the content (rating and comparing products) is not unsuitable for that age range, and the "under 18" ranking slice exists for them. Teenagers' data is processed in their best interest.

Accounts created before the rule were not affected by it. If we learn that an account belongs to someone below the minimum age, it will be deleted — write to privacidade@treslimoes.com.br.

7Retention periods

  • API access logs (IP and timestamp of each request — not its content): kept for 6 months, under confidentiality, in a controlled environment. This is not a choice of ours — it is the minimum required by Art. 15 of the Internet Civil Framework (Law 12,965/2014) for anyone providing an internet application as a legal entity. It may be extended on request from the competent authority before the period ends (Art. 15, §2). Purging of anything past 6 months runs automatically.
  • Website logs (treslimoes.com.br, tuta.treslimoes.com.br, treslimoes.com): the infrastructure is Cloudflare's, which keeps its own periods — see Cloudflare's privacy policy. We neither collect nor retain those logs independently.
  • Subscription record (which plan, when it started, when it ended): survives account deletion, unlinked from you wherever possible, for as long as tax and accounting law obliges us to keep proof of a transaction. We keep no payment data at all — it never reaches us (section 4).
  • Database backups: when you delete your account (section 5), the data disappears from the live database immediately, but it may persist for up to 7 days inside existing backups, until they expire naturally — 3 days of continuous recovery (the workspace's current plan) plus up to 7 days of retention for point-in-time exports, which covers the worse case of the two mechanisms.

8Website audience measurement

The sites treslimoes.com.br and tuta.treslimoes.com.br may use Cloudflare Web Analytics to count visits: how many pages were opened, which country the visit came from, which address brought the person here, and how long the page took to load. It exists to tell us whether the site is being found, and nothing beyond that. Cloudflare already hosts the sites (section 4), so this adds no new supplier.

Measurement only happens if you allow it. On your first visit a notice with two options appears, and the script is only loaded after a yes. If you decline — or close it without answering — it does not load, and the site works exactly the same.

  • It uses no cookies. Cloudflare Web Analytics writes no cookie and no identifier to your device, and does not follow you across other sites. What it produces are aggregate counts, not a profile of you.
  • The only thing stored in your browser is your answer to the notice, so that we do not ask again on every page. It sits in the browser's own local storage, is not sent anywhere, and disappears if you clear the site's data.
  • Legal basis: consent (Art. 7, I). To change your mind, use Measurement preferences, in the footer of any page: the notice reappears and your new answer applies from the next page load. There is no need to clear anything in your browser.
  • International transfer: Cloudflare's network operates outside Brazil, so authorising measurement is authorising an international transfer (Art. 33). The ground here is Art. 33, VIII: consent is specific to that purpose and to that purpose only, it is requested prominently before any script loads, and the notice itself states in advance that the party counting the visits is Cloudflare, from outside the country. Declining changes nothing in how the site works.
  • Retention: the aggregate data stays with Cloudflare, under Cloudflare's own periods (section 7).

The TUTA app has no audience measurement. What it collects is in section 2.

9Changes to this policy

We may update this text as the app changes. Material changes will be communicated inside the app itself.

10Contact

BARBOSA E FOLLE DESENVOLVIMENTO DE SOFTWARE LTDA (Três Limões) CNPJ 68.586.378/0001-52 Av. Paulista, 91 E-mail: privacidade@treslimoes.com.br Data Protection Officer: Logan Cunha Folle — dpo@treslimoes.com.br