Privacy Policy

Data Controller: Breno Nascimento, independent developer (individual).

Contact: breno564nascimento@gmail.com — Phone: +55 77 98887-1958.

Because this operation is conducted by an individual independent developer, the Controller also acts as Data Protection Officer (DPO) for all purposes of applicable data protection law.

We collect the following categories of personal data:

(a) Images/photos you submit: you upload photos from your library or camera so they can be edited by AI. These images may contain faces. They are handled in-memory only for processing and ARE NOT stored on our servers after the edited result is generated.

(b) Account data: authentication is handled by Firebase Authentication. By default you are signed in anonymously, which generates a temporary user ID (UID). If you optionally sign in with Google or Apple, we also receive a unique UID, your email, and name (when provided).

(c) Usage and subscription data: we record your credit balance and subscription status in Firestore (Firebase database), and dates of feature use.

(d) Advertising identifiers (free plan only): the Google AdMob SDK collects advertising identifiers (IDFA on iOS, AAID on Android) and context data to serve ads. Ads are shown only on the free plan.

(e) Device integrity token: we use Firebase App Check, which involves a cryptographic token associated with the device, to verify the authenticity of calls to our backend.

What we collect and when: When you upload a photo that contains a face to use an editing feature (for example, aging a portrait, changing hair color, restoring an old photo, or creating a professional headshot), the facial content of that image (such as facial features, expression, skin tone and hair) is read transiently by the artificial-intelligence model while it generates your result. We do not use the TrueDepth camera, ARKit, Face ID or any depth sensor, and we collect no other face data.

How we use it: Face data is used solely to generate the edited image you requested. We do not use it for advertising, profiling, behavioral analysis, or to train our own or anyone else's models.

We do not create biometric identifiers: The app does not create or store faceprints, facial templates, face embeddings, or any other biometric identifier or mathematical signature of a face. We do not perform facial recognition, identity verification, face-based authentication, or age/gender estimation, and we never match faces across images or against any database.

Sharing and third-party protection: To perform the transformation, your photo is sent over an encrypted connection (TLS) to the Google Gemini API, which acts as our data processor. No other third party receives face data, and we never sell, rent or disclose it. Google, as our processor, is contractually required under the Gemini API Terms (https://ai.google.dev/gemini-api/terms) to provide the same or an equivalent level of protection for this data as set out in this Privacy Policy, and to use it only to perform the requested processing.

Retention: We do not store your images or face data. Photos are processed in memory by our Cloud Functions and discarded immediately after the result is returned; the result is saved only on your device if you choose to save it. As our processor, Google may retain inputs for up to 30 days solely for abuse monitoring, after which Google deletes them; there is no retention of face data beyond that window.

Consent, revoking consent and deletion: We ask for your explicit consent to process facial content when you first open the app, before any image is uploaded, and you must agree before using any AI feature. You can revoke your consent at any time by (1) ceasing to upload photos, and/or (2) deleting your account in Settings > Delete Account, which erases your account data from our servers. Because we do not retain your images or any face data after processing, there is no stored face data for us to delete; any transient copy held by Google for abuse monitoring is deleted by Google within 30 days.

Minors: If you upload images that include minors, you confirm that you are their legal guardian and consent to the processing on the same terms.

To edit your photos, NovaFoto relies on the Google Gemini API (Google's AI service). We want to be fully transparent about this sharing:

• WHAT is shared: the photo you select for editing, including any faces present in that photo.

• WITH WHOM: Google Gemini — Google's AI API. Google's processing is governed by the Gemini API Terms: https://ai.google.dev/gemini-api/terms

• WHY: to generate the edited image you requested. The photo is sent only so the AI can produce your result.

• We DO NOT store a copy of your images on our servers; the image is discarded after processing.

• Consent: we obtain your explicit consent during onboarding before any photo is sent for AI processing. If you do not consent, the photo is not sent.

Other processors we use: Google Firebase (Authentication, Firestore, Cloud Functions, App Check) for app infrastructure; Google AdMob for ads (free plan only); and Apple App Store / Google Play for subscription and payment processing. We do not sell your personal data to third parties.

We use your data to: (a) provide and operate the AI photo-editing service; (b) authenticate and maintain your account; (c) manage credits and subscriptions; (d) process purchases and renewals through the app stores; (e) serve ads (free plan); (f) prevent fraud, abuse, and security violations; (g) respond to your support requests; (h) comply with legal and regulatory obligations.

This Policy complies with the Brazilian General Data Protection Law (LGPD - Law 13.709/2018) and equivalent laws. We process your data based on: (a) performance of a contract (LGPD Art. 7, V) for all operations necessary to deliver the service, including sending photos to Google Gemini to produce your requested result; (b) consent (LGPD Art. 7, I) — obtained at onboarding — for sending your photos (including facial data) to the AI service, and for collecting advertising identifiers via AdMob; (c) legitimate interests (LGPD Art. 7, IX) in fraud prevention, abuse mitigation, and service security; (d) compliance with legal obligations (LGPD Art. 7, II) where applicable.

These bases also align with the GDPR (Art. 6), CCPA, and equivalents.

Images/photos: NOT retained. Your photos are processed ephemerally — sent for AI processing to generate your result and then discarded. We do not keep copies of your images (or the faces in them) on our servers, databases, or file storage after the result is generated.

Account and associated data: kept while your account exists, and deleted when you delete your account (see the next section).

Subscription and payment data: retained for the period required by legal and tax obligations (up to 5 years under applicable tax law).

Technical logs: retained for up to 90 days for security and diagnostic purposes.

You can delete your account and data at any time, directly inside the app:

In the app: Settings → Delete account. This deletion is IMMEDIATE and PERMANENT — it removes your Firestore document and your Firebase Authentication record right away.

By email (alternative): if you prefer, you can also request deletion by emailing breno564nascimento@gmail.com, and we will delete your account and data.

Note: your uploaded photos are not retained in any case (see Data Retention), so account deletion concerns your account record and associated usage data.

If you are on the free plan, NovaFoto shows ads via Google AdMob. Paid plans do not show ads.

To opt out of personalized ads / limit ad tracking:

iOS: Settings → Privacy & Security → Tracking — turn off tracking for NovaFoto (App Tracking Transparency).

Android: Settings → Google → Ads — reset or delete your advertising ID, and turn on "Opt out of Ads Personalization."

You have the right to: (a) confirm whether processing exists; (b) access your data; (c) correct incomplete, inaccurate, or outdated data; (d) delete your data; (e) data portability to another provider; (f) withdraw consent (including consent to send photos to the AI service); (g) be informed about entities with which we share your data; (h) object to or restrict certain processing.

These rights derive from applicable data protection law (LGPD Art. 18, GDPR Arts. 15–22, CCPA, and equivalents).

To exercise any of these rights, send a request to breno564nascimento@gmail.com. You can also delete your account immediately from within the app (Settings → Delete account). We will respond to requests within the legal deadline or justify any extension.

NovaFoto works on a credit model — it is NOT unlimited use. The free plan includes 3 credits, and paid plans provide 15, 50, or 80 credits per billing cycle.

Subscriptions are processed by the App Store (Apple) and Google Play. We do not receive your credit card or payment method data — that is handled exclusively by the stores.

The app is not directed at children under 13. We do not knowingly collect data from children under 13.

For minors between 13 and 17, we require consent from a parent or legal guardian, as required by applicable law. If we become aware that we collected data from a minor without proper consent, we will delete it immediately. Please notify us at breno564nascimento@gmail.com.

We adopt technical and organizational measures to protect your data, including: encrypted transport (HTTPS/TLS); authentication via Firebase tokens; device integrity verification via App Check; environment segregation; audit logs.

No system is fully secure. In the event of an incident affecting your personal data, we will notify you and the competent data protection authority as required by applicable law.

Our processors (Google and Apple) handle data primarily outside Brazil (notably in the United States and global datacenters). We perform international transfers based on the legal grounds available under applicable data protection law (e.g., GDPR Chapter V standard contractual clauses, LGPD Art. 33), relying on contractual safeguards and technical/organizational measures provided by these processors.

This Policy may be updated periodically. Material changes will be communicated via a new app version and/or notice within the app. We recommend reviewing this Policy regularly.

If you believe your rights have not been properly addressed, you may file a complaint with the competent data protection authority in your jurisdiction (e.g., ANPD in Brazil, your national supervisory authority in the EU/EEA, or the relevant US state authority).

This Policy was last updated on July 16, 2026.

For any question regarding this Policy or the processing of your data, contact us at breno564nascimento@gmail.com or by phone at +55 77 98887-1958.