MeuPastor

Privacy Policy

Last updated: April 20, 2026

This Privacy Policy explains how Meu Pastor App, operator of the meupastor.app domain ("Meu Pastor App", "we", "us"), collects, uses, shares, and protects personal data of users of MeuPastor (the "Service").

MeuPastor is operated from Brazil and complies with Brazil's General Data Protection Law (Lei nº 13.709/2018 — "LGPD"). Where applicable, we also reference the EU General Data Protection Regulation ("GDPR") and U.S. state privacy laws (CCPA/CPRA and similar).

1. Data controller and contact

Meu Pastor App is the controller of personal data processed through the Service. To exercise your rights or ask any privacy-related question, contact our Data Protection Officer:

2. What data we collect

2.1 Account data

  • Name, email, password (stored as a cryptographic hash).
  • If you sign in with Google: name, email, and profile picture from Google.

2.2 Usage and session data

  • IP address, user agent (browser), access timestamps, session identifiers, and audit logs of relevant events (login, plan changes, etc.).
  • Daily interaction quota (number of messages sent) for the purpose of enforcing free-plan limits.

2.3 Conversation content (sensitive personal data)

The Service stores the content of your text and voice messages with the pastoral AI, along with the cited Bible references. This content may reveal religious beliefs and is therefore classified as sensitive personal data under LGPD Art. 5(II) and as a special category of personal data under GDPR Art. 9. We process it only with your specific, explicit consent, collected at signup.

2.4 Payment data

If you subscribe to a paid plan, your card details are collected and processed directly by Stripe Payments Europe, Ltd. and Stripe, Inc. (independent controllers). Meu Pastor App only receives and stores the Stripe customer ID, subscription ID, plan, and status — we do not receive or store full card data.

3. Legal bases and purposes

  • Performance of contract: creating and maintaining your account, authenticating sessions, processing subscriptions, generating pastoral AI responses.
  • Compliance with legal obligations: audit logs, tax obligations, responding to lawful requests from authorities.
  • Legitimate interest: platform security, fraud prevention, Service improvement using aggregated/anonymized data.
  • Explicit consent: processing of conversation content (sensitive data) and transmission to Google (United States) for AI response generation.

4. Sharing and sub-processors

We share data only with the following parties, strictly for the purposes listed:

  • Google LLC (United States) — Gemini API for response generation and embeddings. Message content is sent for this purpose. We use the paid tier of the API; under Google's terms for the paid tier, Google contractually agrees not to use your conversations to train AI models.
  • Chroma (Trychroma, Inc.) — vector database hosted in the European Union, used only to store Bible verse embeddings. We do not store your personal text in this service.
  • Stripe Payments Europe, Ltd. / Stripe, Inc. — payment processing and subscription management.
  • Resend, Inc. — transactional email delivery (verification, password reset, notifications).

We do not sell or rent your personal data. We share with third parties only as listed above or when required by law, court order, or competent authority.

5. International data transfers

Some of our processors are located outside Brazil (Google in the United States, Stripe in Ireland/United States, Chroma in the European Union). These transfers rely on the ANPD Standard Contractual Clauses (Resolution CD/ANPD No. 19/2024) and on transfer impact assessments, in accordance with LGPD Art. 33.

For users in the European Economic Area, transfers to the United States rely on the EU-U.S. Data Privacy Framework (DPF) where applicable, and otherwise on the European Commission's Standard Contractual Clauses (Module 2).

6. Retention

  • Account data: while your account is active, plus up to 5 years after closure for legal-obligation and litigation-defense purposes.
  • Conversation content: kept while your account is active. You may delete individual conversations at any time; deleting your account removes all history.
  • Audit logs: 5 years, per Brazil's Marco Civil da Internet.
  • Payment data (Stripe): per Stripe's policy and applicable tax obligations (up to 5 years).

7. Your rights

You have the right, free of charge, to: confirm processing; access your data; correct incomplete or inaccurate data; request anonymization, blocking, or deletion of data processed in non-conformity with applicable law; request portability; revoke consent; and obtain information about the parties with whom we share your data. EU users have additional rights under GDPR Arts. 15–22, including the right to lodge a complaint with a supervisory authority. California residents have rights under the CCPA/CPRA including the right to know, delete, correct, opt out of sale/sharing, and limit use of sensitive personal information. We honor Global Privacy Control signals.

To exercise any of these rights, write to [email protected]. We respond within 15 days.

8. Security

We adopt technical and administrative measures to protect your data, including TLS encryption in transit, password hashing, access control, audit logging, and periodic permission reviews. In the event of a security incident likely to result in risk or harm, we will notify you and the relevant authority (e.g., ANPD) as required by applicable law.

9. Children

The Service is not directed to anyone under 18. We do not knowingly collect data from minors. If you are a legal guardian and become aware that a minor has provided us data, write to [email protected] so we can delete it.

10. Cookies

We use only strictly necessary cookies for the Service to function (in particular, the authentication session cookie). For details, see our Cookie Policy.

11. Changes

We may update this Policy periodically. Material changes will be communicated by email or by a prominent notice in the Service.

12. Complaints

If you believe your rights are not being properly respected, you may file a complaint with Brazil's Autoridade Nacional de Proteção de Dados (ANPD) at gov.br/anpd or, if you are in the EU, with your local supervisory authority.