Privacy Policy — Lurea

This is a courtesy translation. If there is any difference between this version and the Portuguese original, the Portuguese version prevails.

Version: 2.3 Effective date: November 2, 2026 Responsible party: Fernando Lorenzetti Contact: suporte@lurea.app | privacidade@lurea.app Domain: lurea.app

Contents

1. Introduction
2. Who we are
3. Data we collect
4. How we use your data
5. Artificial Intelligence and automated processing
6. Who we share your data with
7. International transfers
8. Security
9. How long we store your data
10. Your rights (LGPD)
11. Children and adolescents
12. Cookies and similar technologies
13. Changes to this Policy
14. Contact

1. Introduction

This Privacy Policy describes how Lurea collects, uses, stores and protects your personal information when you use our app and services.

By creating an account and using Lurea, you declare that you have read and understood this Policy. If you do not agree with any provision described here, do not create an account or use the app.

This Policy is governed by the LGPD (Lei Geral de Proteção de Dados, Brazil's General Data Protection Law, Law No. 13.709/2018).

2. Who we are

Lurea is a service operated by Fernando Lorenzetti, an individual, in the process of forming a legal entity.

For the purposes of the LGPD, we act as controller of your personal data when you use the app in an individual capacity.

Contact addresses:

• suporte@lurea.app — general matters
• privacidade@lurea.app — matters related to personal data

3. Data we collect

3.1 Data you provide to us directly

Registration and account:

• Name
• Email address
• Password (stored with a cryptographic hash — never in plain text)
• Date of birth (optional, when editing your profile)
• Age you declare when you start using the app
• Gender you declare when you start using the app, with the option not to say

Age helps us understand our audience and improve the app, and Luri does not use it in her replies. Gender lets Luri use the right grammatical agreement when talking to you. This data is kept in your profile and on your device, is included when you export your data, and is erased when you delete your account.

Emotional profile and well-being:

• Companion personality preferences (communication style)
• Sensitive topics the user chooses to indicate as avoided
• Stated emotional goals (clarity, self-knowledge, emotional regulation)

Journal entries and sessions:

• Free-form journal texts
• Transcriptions of voice sessions
• Audio from voice sessions: the recording is sent to our servers and to our transcription provider (OpenAI) to be converted into text. We do not keep the audio: it is processed and discarded within the same request. A copy remains on your device, so that you can listen to it later in your history. For privacy, that copy stays only there: it disappears when you delete that journal entry or uninstall the app.
• Mood and emotion records

Emotional classification by Artificial Intelligence:

Notice: Lurea uses AI to infer and classify the user's emotional state based on journal entries and sessions. The resulting data constitutes sensitive data under art. 11 of the LGPD and is processed exclusively with your express consent, collected in a prominent manner during the initial setup of the app.

3.2 Data collected automatically

• Device identifiers (device ID, operating system, app version)
• IP address
• Usage data (screens accessed, features used, frequency of use)
• Session data and error logs
• Purchase and subscription information (via App Store, Google Play or Asaas)

3.3 Data from third parties

• Authentication data via Google (when you choose to sign in with a Google account): name, email and profile photo
• Transaction data provided by payment processors (Asaas, Apple and Google Play)

3.4 What we do not collect

• Medical diagnoses, clinical conditions or information about pregnancy or illnesses
• Physical health data (weight, diet, physical activity)

4. How we use your data

We use your information for the following purposes, with the respective legal bases under the LGPD:

We do not use your data for third-party advertising purposes. We do not sell your personal data.

5. Artificial Intelligence and automated processing

5.1 How the Luri companion works

The Luri companion uses language models to generate empathetic responses, emotional analyses and personalized longitudinal insights. To do so, we send the AI provider a pseudonymized context — without name, email or direct identifiers, but with the content you wrote — containing:

• Emotional profile data (without name, email or direct identifiers)
• The history of the active conversation in the session
• Journal entries relevant to the context

5.2 AI providers

5.3 Important limitations

We do not use your data to train, develop or improve generative AI models, whether our own or third-party models. OpenAI, under the terms of its API data usage policy, does not use data sent via the API for training.

The analyses and responses generated by Luri are informational and for emotional support. They do not replace care from a psychologist, psychiatrist or any licensed mental health professional. Lurea is not liable for decisions made based exclusively on the AI's suggestions.

5.4 Crisis protocol

Lurea is not a mental health crisis intervention service. In situations of acute distress identified during use of the app, the user will be directed to external specialized support resources (e.g., CVV (Brazil) — 188). The app does not replace emergency care.

6. Who we share your data with

Legal requests: We may disclose data when required by law, court order or a competent authority. Whenever legally possible, we will notify you before complying with the request.

All suppliers are engaged under confidentiality and data processing agreements aligned with the LGPD and with the applicable laws in their countries.

7. International transfers

Some of our suppliers are located outside Brazil, mainly in the United States. App data is stored on Supabase servers located in São Paulo (Brazil). Transfers to international providers are carried out based on the safeguards of art. 33 of the LGPD, including:

• Standard contractual data protection clauses
• Suppliers' certifications and compliance with international regulations (GDPR, CCPA)
• Prior assessment of each supplier's privacy and security policies

8. Security

We adopt the following technical and organizational measures to protect your data:

• Encryption in transit: TLS 1.2 or higher in all communications
• Encryption at rest: AES-256 in the Supabase database
• Passwords stored exclusively with a hash (never in plain text)
• Row Level Security (RLS) in Supabase — each user accesses only their own data
• Voice audio transcribed and discarded within the same request — never stored on our servers
• Database access restricted to authorized personnel with an operational need
• Two-factor authentication for administrative access

No system is 100% impenetrable. In the event of a security incident that may affect your data, we will notify you and the ANPD (Autoridade Nacional de Proteção de Dados, Brazil's National Data Protection Authority) within the periods required by the LGPD.

9. How long we store your data

When you delete your account, all your data is removed from production systems immediately. Encrypted backup copies are erased within 30 days. Financial data is kept for the legal period of 5 years regardless of account deletion.

10. Your rights (LGPD)

Under art. 18 of the LGPD, you have the following rights in relation to your data:

• Confirmation and access: confirm whether we process your data and obtain a copy of it
• Correction: request the correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or erasure: for unnecessary or excessive data
• Portability: receive your data in a structured and interoperable format
• Erasure: request the deletion of data processed based on consent
• Information about sharing: know which entities we share your data with
• Withdrawal of consent: withdraw previously given consents at any time
• Objection: object to processing carried out based on legitimate interest

To exercise any of these rights, contact us by email at privacidade@lurea.app. We will respond within 15 business days. We may request identity verification before fulfilling the request.

You may also contact the ANPD (Autoridade Nacional de Proteção de Dados, Brazil's National Data Protection Authority) through the portal www.gov.br/anpd.

11. Children and adolescents

Lurea is not directed at minors under 18. We do not intentionally collect data from children or adolescents without the consent of their parents or legal guardians, as required by art. 14 of the LGPD.

If we become aware that data from a minor under 18 has been collected without due consent, we will erase that information immediately.

12. Cookies and similar technologies

The Lurea mobile app does not use cookies. Our cookie policy applies to the lurea.app website and is available at: lurea.app/en/cookies.

13. Changes to this Policy

We may update this Policy periodically. In the event of material changes, we will notify you through:

• Push notification in the app
• Email to the registered address

The effective date at the top of this document will always reflect the most current version. Continued use of Lurea after notification of changes implies acceptance of the new version.

14. Contact

• General email: suporte@lurea.app
• Privacy email: privacidade@lurea.app
• Responsible party: Fernando Lorenzetti

We strive to respond to all requests within 5 business days and, at most, 15 business days for formal requests from data subjects.

Lurea — Emotional clarity for real life lurea.app