Privacy Policy

1.Who processes your data

SemFood is an entertainment app that simulates the experience of ordering food for delivery. No order placed in the app is real. No food is prepared, sold or delivered. No amount shown on an order is charged to you.

The controller of the personal data processed in SemFood is SemFood. This policy explains what data we collect, why, who we share it with, where it is stored and what your rights are, under Brazil's General Data Protection Law, Law No. 13,709/2018 (LGPD), and, where applicable, the data protection laws of the country you are in.

To exercise any right or ask any question, write to contato@semfood.com.br.

2.Data we collect

Account data. Phone number, name and password. The password is stored only as an irreversible code (hash), never as plain text. Your phone number identifies your account and is not verified at sign-up.

Email, if you provide it. It is optional and used only to send receipts for simulated orders. It is not used for sign-in or advertising.

Location and address. With your permission, we use your device's location to build the simulated catalog for your area and draw the fictional delivery route. You can decline the permission and enter an address manually; the app works either way. Addresses you enter or save are stored in your account. You can revoke the permission at any time in your operating system settings.

Activity in the simulation. Simulated orders, items chosen, simulated amounts, use of the daily limit, ratings and badges. Used to run the product, apply the daily limit and improve the experience.

Courier chat messages. The courier in the chat is an artificial intelligence, not a person. The messages you write there are sent to an artificial intelligence provider to generate the reply.

Technical data. Device model and operating system, app version, language, time zone, IP address, notification identifier and access logs, which in Brazil are required by the Marco Civil da Internet (Brazil's Internet Civil Framework, Law No. 12,965/2014). When an error occurs, we log a technical error report, from which we strip passwords, credentials and card numbers.

Subscription and payment data. Plan purchased, expiry date and identifiers provided by the app store or payment processor. We do not collect, receive or store card numbers or payment credentials: that data stays with Google, Apple, the subscription manager and, where applicable, Mercado Pago.

We do not collect sensitive personal data and we do not use your data for automated decisions with legal effects on you.

3.Why we process this data

Performance of the service (LGPD, art. 7, V): keeping your account, building the catalog for your area, processing simulated orders, applying the daily limit and managing your subscription.

Compliance with legal obligations (art. 7, II): keeping access logs and responding to requests from authorities.

Legitimate interest (art. 7, IX): security, fraud and abuse prevention, bug fixing and product improvement, always respecting your expectations and your rights.

Consent (art. 7, I): access to your device's location, sending notifications and sending receipts to the email you provide. You can withdraw this consent at any time.

4.Who we share it with

We do not sell, rent or hand over your personal data for third-party advertising. We share only what is necessary with the providers that help us run the service, listed in the next section.

We may also share data when required by law, court order or a request from a competent authority, and in the event of a corporate reorganization, merger or acquisition, in which case this policy will continue to apply.

5.Where your data is stored

Server and database: Contabo, in Germany. This is where your account, your addresses and your history of simulated orders are stored.

Receipt emails: Resend, in the United States. Receives your email address and the content of the receipt, only if you provided an email.

Error reports: Sentry, in the United States. Receives the technical error report, without passwords, credentials or card numbers.

Courier chat: Groq, in the United States. Receives the messages you write in the chat and the fictional order details.

Stores, subscriptions and notifications: Google (Google Play and Firebase Cloud Messaging) and Apple (App Store and Apple Push Notification service), to distribute the app, bill the subscription and deliver notifications; and RevenueCat, in the United States, which manages the status of store subscriptions and receives only your account identifier.

Payments outside the stores, in Brazil: Mercado Pago, which processes the payment and tells us only the result.

Maps, addresses and routes: from our server, we query the public OpenStreetMap services (Nominatim, to convert coordinates into addresses and vice versa, and Overpass, to find commercial locations) and OSRM, to calculate the route. They receive coordinates and address text, not your identity. Map images are loaded by your device directly from OpenFreeMap, which receives your IP address, like any website you visit.

6.International transfers

Since our server is in Germany and some providers operate in other countries, your data is transferred outside Brazil. These transfers follow article 33 of the LGPD, based on the performance of our contract with you and on appropriate contractual safeguards, including standard contractual clauses where applicable.

7.How long we keep it

We keep your data for as long as your account exists. After your account is deleted, the data is erased within 30 days, except for: (a) access logs, kept for 6 months as required by article 15 of the Marco Civil da Internet; (b) data needed to comply with legal, tax or regulatory obligations; and (c) data needed to exercise legal rights in judicial, administrative or arbitration proceedings.

Anonymized data, which cannot identify you, may be kept indefinitely for statistical purposes.

8.Your rights

You may, at any time, request: confirmation that we process your data; access to your data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary data or data processed unlawfully; portability; information about sharing; information about the possibility of not consenting and its consequences; and withdrawal of consent.

To exercise any of these rights, write to contato@semfood.com.br. We will respond within the legal deadline. We may ask for additional information to confirm your identity before fulfilling the request, as a security measure.

To delete your data, see the data deletion page.

9.If you are in the European Economic Area or the United Kingdom

If you are in the European Economic Area (EEA) or the United Kingdom, the processing of your data also complies with the General Data Protection Regulation (GDPR) and, in the United Kingdom, the UK GDPR. This section supplements the ones above.

Legal bases. Performance of a contract (GDPR art. 6(1)(b)) to keep your account, process simulated orders and manage your subscription; legitimate interests (art. 6(1)(f)) for security, abuse prevention and bug fixing; consent (art. 6(1)(a)) for the use of your device's location, notifications and sending receipts to your optional email; and legal obligation (art. 6(1)(c)) for keeping records required by law. You can withdraw consent at any time, without affecting processing carried out before the withdrawal.

Your rights. Access, rectification, erasure, restriction of processing, portability and objection to processing based on legitimate interests, as well as the right to lodge a complaint with the data protection authority of the country where you live or work. To exercise them, write to contato@semfood.com.br; we respond within one month.

Transfers. Your data is stored on a server in Germany. When it is accessed from Brazil, where the controller is located, or processed by providers in the United States, the transfer relies on an adequacy decision, where one exists, or on standard contractual clauses approved by the European Commission (with the UK addendum, where applicable).

Retention. Retention periods are those in the "How long we keep it" section.

Automated decisions. We do not make decisions based solely on automated processing, including profiling, that produce legal effects concerning you or similarly significantly affect you.

10.If you are in California

If you are a California resident (United States), the California Consumer Privacy Act, as amended by the California Privacy Rights Act (CCPA/CPRA), gives you the rights below. This section supplements the ones above.

Categories of data collected in the last 12 months: identifiers (account identifier, phone number, optional email, IP address); delivery addresses provided and device location; app activity (simulated orders, use of the daily limit); and technical data and error reports. The purposes and recipients are those described in this policy.

We do not sell or share your personal information, as those terms are defined in the CCPA/CPRA: we do not exchange it for money or other value and we do not use it or disclose it for cross-context behavioral advertising. We also do not use sensitive personal information to infer characteristics about you.

Your rights: to know what data we collect and how we use it; to access it; to correct it; to delete it; and not to be discriminated against for exercising these rights. To exercise them, write to contato@semfood.com.br. We may verify your identity before fulfilling the request, and you may submit it through an authorized agent.

11.Security

We take reasonable technical and organizational measures to protect your data, including encrypted transport (HTTPS), passwords stored only as hashes, access control and environment segregation.

Even so, no system is completely secure. To the maximum extent permitted by applicable law, we are not responsible for unauthorized access resulting from unforeseeable events, force majeure, third-party failures or your own fault, such as sharing your credentials or using a compromised device.

12.Children and teenagers

SemFood is not intended for children under 13 and we do not knowingly collect data from this age group. Between 13 and the age of majority in your country, use requires the permission of a parent or legal guardian. Where the law sets a higher age for consenting to data processing (for example, 16 in parts of the European Economic Area), that age applies.

If we learn that we have collected data from a child, or from a teenager without the required permission, we will delete that data. Parents and guardians can write to us at contato@semfood.com.br.

13.Cookies and similar technologies

We use only strictly necessary or preference cookies and local storage: the session, which keeps you signed in, and your choices of address, language, time zone and theme. None of them are used for advertising or to track your browsing on other websites. Blocking the session cookie prevents you from signing in.

14.Changes to this policy

We may update this policy at any time. The current version is always the one published on this page, with the date of the last update shown at the top. Material changes will be announced in the app.