Privacy in Rotina Play
Rotina Play is an app for families with children. Here we explain, in plain language, what data it uses and how you control it.
This is an English translation. The official version is in Portuguese: read it in Portuguese. If the two differ, the Portuguese version prevails.
Last updated: [A CONFIRMAR: publication date]
This page complements the Cattus Labs Privacy Policy, which applies to all our apps and to the website. If anything differs between the two, what is written here applies to Rotina Play.
In short
- Only the parent or guardian has an account. Children have no login, e-mail or password.
- To identify a child, we use only a nickname and an age range.
- The app has no ads, no third-party analytics tools and no links out of the app in the child area.
- Data is stored on servers in Brazil.
- You can see, correct and delete your child’s data whenever you want.
Who is responsible for the data
Rotina Play belongs to Cattus Labs LTDA, CNPJ 65.359.675/0001-77, Fortaleza – CE – Brazil. For anything about personal data, write to hello@cattuslabs.ai.
What data the app uses
[A CONFIRMAR with the product owner: list according to the CATT-41 inventory.]
About the parent or guardian
- E-mail and password, to sign in. [A CONFIRMAR: does sign in with Apple or Google come at launch or in a later version?]
- Name. [A CONFIRMAR: is the parent’s name collected?]
- The record of the consent you gave for your child’s data: date, time and the version of the text you accepted.
- Access logs (IP address, date and time), which the law requires us to keep.
About the child
- A nickname and an age range, to identify the profile.
- The routines, tasks and achievements created in the app, which are how the app works.
What we don’t ask for: the child’s full name, date of birth, photo, voice, location or contacts.
Technical data from third parties: Apple and Google may send us app crash reports, depending on your device settings. [A CONFIRMAR: does Rotina Play use Apple’s and Google’s crash reports? Does it use any other error reporting service?]
What we use it for
- To make the app work and save the child’s progress.
- To keep the parent’s account and prove that consent was given.
- To answer support requests.
- To fix errors and protect the app.
- To meet legal obligations.
We don’t use the data for advertising, we don’t sell data and we don’t build profiles of children for commercial purposes.
Parental consent
A child’s data is only used with the specific, highlighted consent of a parent or legal guardian, as required by article 14 of Brazil’s General Data Protection Law (LGPD). Consent is requested before the child’s profile is created. [A CONFIRMAR: on which sign-up screen.] You can withdraw consent at any time, as easily as you gave it; when you withdraw it, the child’s data is deleted.
[A CONFIRMAR: how the app checks that the person consenting is an adult (age gate, confirmed e-mail, Apple and Google age signals, as in CATT-38).]
Where data is stored and who can access it
Data is stored in Supabase, on servers in São Paulo, Brazil. We also use these providers, which process data only on our behalf and following our instructions:
- Supabase (on Amazon Web Services infrastructure): database and sign-in.
- Expo: delivery of app updates.
- Apple and Google: app distribution and, if used, crash reports.
[A CONFIRMAR: final list of Rotina Play providers.]
We don’t share data with advertisers. We only hand data over to authorities when the law or a court order requires it.
How long we keep it
For as long as the account exists. When you delete the account or a child’s data, we delete that data within [A CONFIRMAR] days. Access logs are kept for 6 months, as required by Brazil’s Internet Civil Framework (Marco Civil da Internet), and then deleted. [A CONFIRMAR with legal counsel: how long the consent record is kept after deletion.]
Your rights and your child’s rights
As a parent or guardian, you can at any time:
- see your child’s data and your own;
- correct anything that is wrong;
- withdraw consent and delete your child’s data;
- delete your account;
- ask for a copy of the data;
- find out who we share it with.
In the app, this is in the parent area. By e-mail, write to hello@cattuslabs.ai. We reply within 15 days. See the step-by-step guide in Delete account and data. You can also file a complaint with Brazil’s National Data Protection Authority (ANPD).
Protecting children inside the app
- The child area has no ads, no purchases and no links out of the app.
- Links to the website, to e-mail and to this policy are in the parent area, protected by [A CONFIRMAR: PIN or other check].
- [A CONFIRMAR: does the app have purchases or a subscription? If so, are they only in the parent area?]
- Inside the app, children find a simple, age-appropriate explanation of what the app keeps. [A CONFIRMAR: “what the app keeps about you” screen, planned in CATT-41.]
Security
We use encrypted connections, access control and other technical measures to protect the data. If an incident puts you or your child at risk, we will notify you and the ANPD.
Changes
If this page changes in a relevant way, we will let you know in the app. If a change involves new data about the child, we will ask for your consent again.