Privacy policy

Who the controller is

BeGreatOS is run by Robison Puglielli, an individual, who is the controller of the personal data processed on the site and in the app. For any privacy matter, write to privacy@begreatos.com.

This site

The begreatos.com site uses no cookies, has no forms and stores nothing in your browser. It is delivered by Cloudflare, which processes your IP address to serve the pages.

Visits are measured with Cloudflare Web Analytics, which counts page views in aggregate, without cookies and without identifying visitors.

Your account and sign-in

Sign-in to the app, at app.begreatos.com, is handled by Auth0, which keeps your sign-in credentials and the profile details you provide, such as your name and email. BeGreatOS never receives your password.

To identify you, BeGreatOS's database keeps only an internal identifier linked to your Auth0 account, without your name. The app uses one essential session cookie to keep you signed in; it is not used for advertising or tracking.

Data you record

Everything you enter in the app is kept so that you can use it:

• accounts, cards, transactions and categories;
• goals, habits and their progress;
• exercises and workouts;
• vehicles, refuelings and maintenance;
• grocery purchases, products and stores;
• notifications and your preferences, including the email address notifications are sent to.

Email notifications

Email notifications are sent through Resend to the address you set in your preferences, which starts as your sign-in email. You can change the address or turn off email for each type of notification at any time.

AI readings

When you ask for an AI reading, such as reading a receipt or a workout photo, the content you send is processed by the provider you enrolled yourself (OpenAI, Anthropic or Google Gemini), with your key and under that provider's terms and privacy policy.

The photos and PDFs you send are not stored: only the result you review and save is kept. The CPF printed on a receipt is neither extracted nor stored.

Your API key is stored encrypted and only the app's server uses it. You can remove it at any time; without an enrolled key, no data goes to an AI provider.

Where the data is kept

The app runs on an Oracle Cloud server in the United States, behind Cloudflare. The data is kept in MongoDB Atlas, on AWS, also in the United States.

A backup of the database is made every day and kept in private Oracle Cloud storage for 14 days; after that, it is deleted.

The app's technical logs contain no name, email, IP address, amounts or descriptions.

Who the data is shared with

Your data is not sold or shared with advertisers. It is processed only by the services that run BeGreatOS:

• Cloudflare, which delivers the site and the app and measures site visits;
• Oracle Cloud, which hosts the app and the backups;
• MongoDB Atlas, which hosts the database;
• Auth0, which handles sign-in;
• Resend, which sends email notifications;
• the AI provider you enroll, only for the readings you request.

International transfer

These services are outside Brazil, mainly in the United States. The transfer is needed to provide the service you use and relies on the contractual safeguards each of them offers.

Legal bases

Your account data and the data you record are processed to perform the service you requested by creating an account (LGPD art. 7, V). Aggregate measurement of site visits and the security of the service rely on legitimate interest (art. 7, IX).

How long

Data is kept while your account exists; notifications are deleted after 90 days. If you ask for deletion, your data is removed from the database and no longer exists in the backups within 14 days.

Your rights

You may ask for confirmation that your data is processed, access to it, correction, portability, deletion and information about who it is shared with. Write to privacy@begreatos.com; we answer within 15 days. You may also complain to Brazil's National Data Protection Authority (ANPD).

Security

Every connection is encrypted (HTTPS). AI keys are encrypted, the database accepts connections only from the app's server and access to the infrastructure is restricted to the controller.

Changes to this policy

When this policy changes, the new version will be published on this page with the update date at the top.