This Policy explains what personal data ObraFácil processes, why, who we share it with, how long we keep it and how you can exercise your rights. ObraFácil is based in Brazil and follows the Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet, Law 12,965/2014). If you are in the United Kingdom or in the European Economic Area, the UK GDPR or the EU General Data Protection Regulation (GDPR) also applies, as described in this Policy.
1. Who is responsible
Controller: Jessica Cristina Gomes de Freitas, Brazilian taxpayer number (CPF) 046.179.351-26, Av. T-9, nº 2310, Sala 203B, Jardim América, Goiânia, Goiás, Brazil, who provides ObraFácil.
Privacy contact (the person designated under the LGPD to handle data subject requests): Jessica Cristina Gomes de Freitas, privacidade@appobrafacil.expertbr.com.
2. Who this Policy applies to
- people with an ObraFácil account (managers, engineers, team members and Client Portal clients);
- people whose data users enter in the app (workers, clients and guests);
- people who visit the ObraFácil website or contact support.
3. What data we process
Account and profile: name, email address, phone number with country code, country, language, currency, tax number (when provided), profile photo, logo and footer text for reports, and password (stored in encrypted form by Google Firebase; we cannot see it). When you sign in with Google or Apple, we receive the name, email address and photo of the account used.
Project content: project name and address, areas, schedule, daily reports, weather entered, photos, files, invoices, purchases, finances, incidents, reminders, tools and signatures made in the app.
Other people's data entered by you: workers (name, job title, identity document, phone number, email address, payment details such as bank account, salary, attendance and payments), clients and guests (name, email address, phone number) and people who appear in photos.
Payments: plan, subscription status, dates, amounts and purchase identifiers. We do not receive or store your card number: it stays with Stripe, Apple or Google.
Acceptance of the Terms and acknowledgement of this Policy: the version and language of the text, the date and time, the IP address, the device and the app version of each acceptance.
Reward programs (when you take part): your sign-up, your device's time zone when you signed up, the version and language of the rules you accepted, the date, type and reference of your records that count towards the reward program (for example, a daily report or a photo, without copying its content), your progress and your reward, including any App Store offer code reserved for your account. To make sure the same person does not receive a reward twice, we also keep an irreversible code generated from your email address (not the email address itself) and, for payments on the website, a payment method code provided by Stripe (never the card number).
Support: tickets opened in the Help Centre (including attached images), emails exchanged with support and, for WhatsApp support, your number and the messages in the conversation (text, images, voice messages and videos).
Artificial intelligence features: what you send to each feature (described in section 13) and a technical record of each use, with the feature, the model, the volume processed, the cost and the account identifier, without the content you sent. When you create a project from the plans, this also includes the dates and answers you enter and the images taken from the project files.
Technical and usage data:
- device identifier for notifications, operating system, app version and app integrity check (Firebase App Check);
- app crash reports (Firebase Crashlytics);
- records of the use of paid features and of downloads, with the date, time, device type and IP address. To find out the IP address, the app queries the api.ipify.org service.
Website: browsing and advertising data (for example, which ad brought you to the site) collected by Google Analytics and Google Ads, with your consent.
The app does not use your location and does not read your contacts.
4. Why we use the data and on what legal basis
For each purpose, we give the legal basis under the LGPD and, for people in the United Kingdom and the European Economic Area, the corresponding basis under article 6(1) of the UK GDPR and the GDPR.
- Creating and maintaining the account, providing the service, syncing projects, generating reports and sending invitations: performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
- Charging for, activating and managing plans and purchases: performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).
- Answering tickets and WhatsApp support with the help of artificial intelligence, and generating a schedule or a new project from your project plans when you ask for it: performance of a contract or steps taken at your request before entering into one (LGPD art. 7, V; GDPR art. 6(1)(b)).
- Enforcing the usage limits of the artificial intelligence features, preventing abuse and keeping technical records of each use: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
- Reward programs (First steps and Subscriber challenge): signing you up, counting your steps and delivering the reward: performance of a contract, under the rules you accept (LGPD art. 7, V; GDPR art. 6(1)(b)).
- Preventing the same person from taking part in a reward program more than once: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
- Recording acceptance of the Terms and acknowledgement of this Policy: performance of a contract and the regular exercise of rights (LGPD art. 7, V and VI); under the GDPR, performance of a contract and our legitimate interest in being able to prove the contract (art. 6(1)(b) and (f)).
- Security, fraud prevention, proof of use of paid features and defence in disputes: legitimate interest and the regular exercise of rights (LGPD art. 7, IX and VI; GDPR art. 6(1)(f)).
- Notices about the account, including those about unused free accounts: performance of a contract and legitimate interest (GDPR art. 6(1)(b) and (f)).
- Recording the delivery of our emails and no longer sending to addresses that do not exist or that marked our emails as spam: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
- Fixing faults and improving the app with aggregated statistics that do not identify anyone: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
- Keeping access records for the period required by law: legal obligation under Brazilian law (LGPD art. 7, II; Marco Civil da Internet, art. 15); under the GDPR, our legitimate interest in complying with the law of the country where we are established (art. 6(1)(f)).
- Sending news and offers: consent, given at sign-up or in Profile (LGPD art. 7, I; GDPR art. 6(1)(a)); for accounts created before this version, legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)). Every message includes the option to opt out.
- Website analytics and ad measurement (Google Analytics and Google Ads): consent (LGPD art. 7, I; GDPR art. 6(1)(a)).
When we rely on legitimate interest, you can object at any time (section 9). We do not sell personal data and do not use it for third-party advertising.
5. When the user is the controller
The data of workers, clients and guests entered by a user is processed under that user's direction. In this case, the user is the controller and ObraFácil is the processor: we process this data only to provide the service, keep it confidential and secure, delete it when the project or the account is deleted, and help the user respond to requests from the people concerned. These people can contact the user who entered the data or our support, which will pass the request on.
6. Who we share data with
- Project members: people who take part in a project see what the manager has made available to their role.
- Google (Firebase and Google Cloud): sign-in, database, files, server functions, sending emails, notifications, crash reports and app verification; on the website, with your consent, visit statistics (Google Analytics) and ad measurement (Google Ads).
- Apple and Google: Sign in with Apple and Google, purchases on the App Store and Google Play.
- RevenueCat: management of subscriptions made in the app stores and delivery of the rewards from our reward programs there.
- Stripe: payments on the website and coupons for our reward programs.
- ipify: IP address lookup for usage records.
- Amazon Web Services (Amazon SES): sending the app's emails, from servers in the United States, and the notices about emails that could not be delivered or were marked as spam.
- Hostinger: website hosting and support email.
- Anthropic: provider of the Claude artificial intelligence model, used for replies to support tickets, for the Max assistant, for schedules and new projects generated from project plans, from servers in the United States. Anthropic acts as our service provider (processor): it processes the data only to provide the service to ObraFácil and does not use it to train its models (section 13).
- Meta (WhatsApp), n8n and Groq: support through the Max assistant on WhatsApp. n8n carries messages between WhatsApp and our servers, and Groq, in the United States, transcribes voice messages and the sound of videos.
- Authorities: when required by law or a court order.
These providers only receive what is needed for their role and are contractually bound to protect the data.
7. International transfers
ObraFácil is based in Brazil, and its database is in Brazil (São Paulo). In January 2026, the European Commission recognised that Brazil provides an adequate level of protection for personal data (this decision covers the European Economic Area; it does not apply to transfers from the United Kingdom). Part of the processing (server functions and some Google services) and several providers are outside Brazil, mainly in the United States, including our artificial intelligence providers (Anthropic and Groq). These transfers follow article 33 of the LGPD and rely on the contractual data protection safeguards offered by the providers. You can ask us for more information about these safeguards (section 9). If you are in Australia, this means that we disclose personal information to recipients located mainly in Brazil and the United States.
8. How long we keep data
- Account and content: while the account exists. After deletion (30 days of suspension; immediately when you confirm immediate deletion, and always for Client Portal clients), the data is deleted.
- Unused free account: deleted after 180 days without access, following the notices at 60, 120 and 173 days, and only once at least 7 days have passed since the last email notice was delivered. If the notice cannot be delivered, the account is not deleted automatically: it is reviewed by our team.
- ZIP files for download: 7 days.
- Access records: at least 6 months, as required by the Brazilian Marco Civil da Internet, and for as long as they are needed for security or for a dispute in progress.
- Payment data: for the period required by tax law and for defence in disputes.
- Records of acceptance of the Terms and acknowledgement of this Policy: while the account exists and for 5 years after it is deleted, to prove the contract in the event of a dispute. After that, they are deleted.
- Reward programs: while the account exists; they are deleted when the account is deleted, except for the fraud prevention codes (from the email address and the payment method), which are kept for 5 years with no link to the account.
- Emails sent by the app: a copy of each email and its delivery record, for 90 days.
- Addresses that cannot receive our emails: when an email bounces because the address does not exist, or when someone marks our email as spam, we keep an irreversible code generated from the address (not the address itself) so that we stop sending to it, for as long as necessary. To receive our emails again, ask us to remove it by writing to the support email.
- News and offers mailings: a record of who received each mailing (the account, language and date, without the email address), for 1 year.
- WhatsApp support (Max assistant): chats (number, messages and replies) and the questions the Help Centre could not answer, for 90 days; images are deleted straight after the reply; the confirmation code sent by email is deleted when it expires.
- Schedule from your project plans: the project files are deleted as soon as they have been read; the proposal generated is kept for 90 days, so that the same request is not charged twice.
- New project from your project plans: the same periods as the schedule from your project plans (the files are deleted as soon as they have been read; the proposal is kept for 90 days); the chosen cover image stays in a temporary file until the app downloads it and is deleted within 2 days (the cleanup runs once a day and deletes anything older than 24 hours).
- Technical records of the artificial intelligence features: 90 days.
9. Your rights
You can, at any time: confirm whether we process your data; access it; correct incomplete or inaccurate data; ask for unnecessary data, or data processed in breach of the law, to be anonymised, blocked or erased; ask for portability; find out who we share it with; withdraw consent; object to processing; and ask for a review of automated decisions.
If you are in the United Kingdom or the European Economic Area, you also have the rights of access, rectification, erasure, restriction of processing, data portability and objection under the UK GDPR and the GDPR, the right to withdraw consent at any time without affecting earlier processing, and the right not to be subject to decisions based solely on automated processing that have legal or similarly significant effects on you.
If you are in Australia, you also have the rights given by the Privacy Act 1988 and the Australian Privacy Principles, where they apply to us, including to access and correct your personal information.
To make a request, write to privacidade@appobrafacil.expertbr.com from the account's email address. We reply within 15 days. You can also complain to the Brazilian National Data Protection Authority (ANPD), at gov.br/anpd, or, in Australia, if you are not satisfied with our answer, to the Office of the Australian Information Commissioner (oaic.gov.au). If you are in the United Kingdom or the European Economic Area, you can complain to the data protection authority of the country where you live or work.
You can correct much of your information yourself in the app, under Profile, and download the PDF reports and photos of your projects.
10. Security
Data travels protected by encryption (TLS) and is stored on Google's servers, which encrypt it at rest. Access rules in the database ensure that each person can only read the projects they take part in, with the permissions of their role. Acceptance records can only be written by the server and cannot be changed by the app; a copy of each one is kept in a protected area that does not allow it to be changed or deleted for 5 years. Payments are made in Stripe, Apple and Google environments.
On the device, the app keeps a copy of the data so that it can work offline. This copy is protected by the device's own passcode and encryption: keep the screen lock turned on.
No system is completely immune. If there is a security incident that could cause significant risk, we will notify the people affected and the competent authorities, as required by law.
11. Deleting your account
In the app: Profile > Delete account. The account is suspended for 30 days and can be reactivated within that time; after that, the projects you own and their data are deleted. You can also delete it straight away, by confirming your identity, on the account reactivation screen and on the screen for accepting a new version of the Terms. For Client Portal clients, deletion is immediate. You can also ask by email, from the account's email address. The records kept after deletion, and for how long, are listed in section 8. Further details are in the Terms of Use.
12. Communications
Emails and notifications about the account, payments, security and project alerts are part of the service. Project email alerts can be turned off in Email alerts, under Profile. News and offers by email are only sent to people who ticked the option at sign-up or turned on News and offers by email, under Profile; accounts created before this version keep receiving them until they are turned off. You can turn them off there at any time, or through the link in each message, which opens a page where you confirm; the unsubscribe button in your email app also works. Your choice is saved in your profile, along with the date and where it was made, and emails about the account, payments, security and projects keep arriving as usual.
13. Artificial intelligence (Max assistant and other features)
Some ObraFácil features use artificial intelligence. The model is Claude, from Anthropic, a company based in the United States that acts as our service provider (processor). Under Anthropic's commercial terms, it does not use the data sent by ObraFácil to train its models and processes it only to provide the service; under Anthropic's policy, this data is deleted from its systems within 30 days, unless it needs to keep it longer to comply with the law or to check compliance with its usage policy. How long ObraFácil keeps this data is set out in section 8.
Support tickets. When you open a ticket in the Help Centre, the text, any attached images and technical details (app version, operating system and plan) may be sent to Anthropic to identify the topic and prepare a reply based on the Help Centre articles. Depending on the topic, the reply is sent automatically or reviewed first by a member of our team; requests about payments, refunds and your account always go to a person. The topic identified is recorded on the ticket, and the draft reply is visible only to our team. When a ticket reports a technical problem, the text and technical details may also be sent to Anthropic to group tickets about the same bug into an internal report for the team, without your name, email, phone number or other identifying details; only that technical report, once approved by the team, is used to fix the app. If the bug is confirmed, you get a notice that we are fixing it and another one when the fix is available.
Max, our virtual assistant (WhatsApp). On ObraFácil's WhatsApp, support starts with Max, a virtual assistant powered by artificial intelligence. To reply, the text of your messages, any images you send and the transcripts of voice and video messages are handled by Anthropic, and voice messages and the sound of videos are transcribed by Groq. Max answers from the Help Centre and can't see your account details until you've been identified: your WhatsApp number must match the phone number on your profile and, to check your plan, subscription status and dates or to request a cancellation, you confirm with a 6-digit code sent to your account email (valid for 10 minutes, with 5 attempts, and stored only in hashed form). Max never shows IP addresses or usage records and never asks for your password or card details. Chats are used to answer you and to improve support, for example by adding to the Help Centre the questions it could not answer.
When you ask to cancel a subscription paid for on the website, Max automatically checks whether the charge is 7 days old or less. If it is, Max cancels it and refunds the amount straight away. If it is older than 7 days, or for any other request about payments, refunds or your account, the case goes to a member of the team. Do not send passwords or card details over WhatsApp.
Schedule from your project plans. When you ask for a schedule, the project files (up to 5, in PDF or image format) and your answers to the app's questions are sent to Anthropic together, in a single request, to generate a proposal. All the files are deleted from ObraFácil's storage as soon as they have been read, and nothing is saved to the project until you check and save it. If the plans contain other people's data (for example, the owner's name), section 5 applies.
New project from your project plans. When you create a project from the plans, the project files (up to 5, in PDF or image format), the images taken from inside those files (to choose the cover), the start and end dates and, in guided mode, your answers to the questions are sent together to Anthropic, in a single request, to generate a proposal with the project details, the stages, the estimated crew and the cover. The same legal basis (section 4), the same provider (section 6) and the same retention periods (section 8) as the schedule from your project plans apply, and nothing is saved to your projects until you review the proposal and create the project.
Human review. You can ask for a human review of any automated reply or decision (LGPD art. 20 and, in the United Kingdom and the European Economic Area, article 22 of the UK GDPR and the GDPR) and speak with someone from our team at any time.
14. Children and young people
ObraFácil is for people aged 18 or over. We do not knowingly collect data from children or young people. If we find out that this has happened, we will delete the data. Parents or guardians can let us know through the support email address.
15. Cookies
In the browser version, the app only uses essential storage to keep you signed in and secure. The website uses Google Analytics, to measure visits, and Google Ads, to measure how our ads perform, only with your consent, which you can withdraw at any time through the Cookies link in the website footer.
16. Changes to this Policy
Each version of this Policy has a number and an effective date, and earlier versions are kept. When it changes in an important way, we will tell you by email and in the app at least 30 days in advance, and the app will show you the new version so that you can acknowledge it. Changes required by law, by a court or by an authority, and changes that only benefit you, may take effect on the date they are published; in that case, we will tell you in the same way and give the reason. We record this acknowledgement as described in section 3.
17. Contact
privacidade@appobrafacil.expertbr.com, suporte@appobrafacil.expertbr.com and the Help Centre in the app.