Privacy Policy

The controller of your personal data is CODERABR DESENVOLVIMENTO DE SOFTWARES LTDA, CNPJ 65.494.300/0001-10, headquartered at Avenida Cristóvão Colombo, 2144, sala 408, 3º andar, Floresta, Porto Alegre/RS, CEP 90560-001, Brazil. It decides how and why data is processed on the Platform.

For any privacy matter, contact us at contato@oficialburnout.com (see "Contact and data protection officer").

We collect only what the Platform needs to work:

• Account data: email, password (stored only in encrypted form, as a hash — nobody can read it, not even us), display name, @handle, profile photo, bio and city, if you provide them. If you sign in with Google or Apple, we receive that account’s identifier and the email the provider shares. We also record the date you accepted the Terms.
• Content you post: cars (make, model, version, year, nickname, spec sheet, modifications and photos), posts, captions, comments, likes, tags of people and cars in photos, the people and cars you follow, clubs, and the meets you create or mark attendance at.
• Reports, blocks and the moderation history linked to your account.
• Technical data: access logs (IP address, date and time), request identifier, device type, operating system, app version and error logs. When you tap "Report" on an error screen, we receive the error code, the screen and any comment you write. In audit logs, the IP address is stored in encrypted form (hash).

Photos: when we receive a photo, we automatically remove its metadata (EXIF), including any GPS location the camera may have recorded.

We do not ask for or collect: tax ID (CPF), license plate, chassis number or vehicle registration (RENAVAM), payment data, your device contacts, advertising identifiers, or sensitive personal data (such as racial origin, religion, political opinion, health or biometrics). If you choose to publish something like that in a post or comment, it becomes public by your own decision.

• To create and maintain your account, sign you in and protect access (including blocking repeated wrong-password attempts).
• To show your profile, cars, posts, comments and meet attendance to other people, as the Platform works.
• To build the feed, search, map, in-app notifications, meets and clubs.
• To send emails required for your account: verification codes, password recovery and important notices about the Platform or these documents.
• To moderate the community: review reports, remove content, apply suspensions and prevent fraud, spam and abuse.
• To investigate and fix errors, and to improve the Platform.
• To comply with legal and regulatory obligations and to exercise rights in judicial, administrative or arbitration proceedings.

We do not sell, rent or hand over your personal data for third-party advertising.

We process personal data under the legal bases of Article 7 of the LGPD:

• Performance of a contract (item V): to provide the Platform you requested when creating your account.
• Compliance with a legal obligation (item II): for example, keeping access logs as required by the Internet Civil Framework.
• Legitimate interest (item IX): security, fraud and abuse prevention, moderation and improvement of the Platform, always respecting your rights and expectations.
• Consent (item I): for the use of your device’s location and access to the camera and photo library, which you grant and revoke in your device settings.
• Regular exercise of rights (item VI): to defend Burnout in legal proceedings.

The app may ask for permission to use your device’s location. It is optional and is used to center the map and show distances; without it, the map opens on the whole of Brazil.

To show what exists in an area, the app sends our server the map area on your screen — not your exact position. We do not collect location in the background, we do not keep a history of your location and we do not show your position to other people.

The locations shown on the Platform are the ones people choose to publish: a meet’s meeting point, set by whoever creates it, and a club’s headquarters, visible only to its members. Map images come from a map provider (MapTiler, with OpenStreetMap data), which receives your IP address and the area requested in order to deliver those images.

• Other people on the Platform: your public profile (name, @handle, photo, bio, city), your cars and everything you post are visible as the Platform works. Think about it before posting.
• Providers that operate the Platform on our behalf, only as needed for the service: server hosting and file storage, email delivery, maps, sign-in with Google and Apple, and the app stores (Apple App Store and Google Play).
• Authorities: when there is a court order, a request from a competent authority or a legal obligation, including to help investigate crimes.
• Corporate transactions: in a merger, acquisition, consolidation or sale of assets, data may be transferred to the successor, which will remain bound by this Policy.

We use technical and administrative measures to protect data: encrypted connections (TLS), passwords and codes stored in encrypted form, access to systems restricted to those who need it, and audit logs of every change. No system is 100% secure; if a security incident may cause relevant risk or harm, we will notify Brazil’s National Data Protection Authority (ANPD) and the people affected, as required by Article 48 of the LGPD.

We keep data while your account exists. After that:

• Access logs: kept for 6 months, as required by Article 15 of the Internet Civil Framework, or longer under a court order.
• Audit logs, reports and moderation history: kept for as long as needed for security, fraud and repeat-abuse prevention, and legal defense, within the legal time limits.
• Verification and password-recovery codes expire and are never reused.
• Data we must keep by law, or to exercise rights, is kept only for that purpose.

Under Article 18 of the LGPD, you may request at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• portability of your data to another provider, under ANPD regulations;
• deletion of data processed based on your consent, and information about the consequences of not consenting;
• information about whom we share your data with;
• withdrawal of consent;
• objection to processing carried out in breach of the LGPD.

You can do much of this in the app itself (edit your profile, delete posts and cars, delete your account). For anything else, write to contato@oficialburnout.com from your account’s email. We may ask for information to confirm your identity. You may also file a complaint with the ANPD.

You can delete your account in the app under Ajustes › Excluir minha conta (Settings › Delete my account). From the request, you have 14 days to change your mind: during that time your account keeps working and you can cancel the deletion in the same place.

After that, the deletion cannot be undone: your profile, cars and posts are taken down; comments and likes you left are unlinked from you; and your @handle becomes unavailable to others. We keep only what the law requires or what is needed for security and legal defense, as described in "Storage, security and retention".

The website oficialburnout.com does not use advertising or tracking cookies. The app stores on your device only what is needed to keep you signed in (such as the session token) and your preferences.

If we ever start using analytics or advertising tools, this Policy will be updated first and, where the law requires, we will ask for your consent.

The Platform is for people aged 18 or over only. We do not knowingly collect data from children or teenagers, and there is no parental-consent route.

If we identify an account belonging to someone under 18, it will be closed and its data deleted. If you know of such a case, let us know at contato@oficialburnout.com.

Some providers (such as the app stores, sign-in with Google and Apple, and the map provider) may process data on servers outside Brazil. In those cases, the transfer follows Article 33 of the LGPD — for example, when necessary to perform the contract with you, or with contractual data-protection safeguards.

We may update this Policy to reflect changes to the Platform or the law. The date of the version in force is at the top of this page. Relevant changes will be announced in the app or by email before they take effect.

Controller: CODERABR DESENVOLVIMENTO DE SOFTWARES LTDA, CNPJ 65.494.300/0001-10, Avenida Cristóvão Colombo, 2144, sala 408, 3º andar, Floresta, Porto Alegre/RS, CEP 90560-001, Brazil.

Channel of the officer in charge of personal data processing (Article 41 of the LGPD) and privacy support: contato@oficialburnout.com. We reply within 15 days.