Privacy Policy

The short version, in five lines

• Regrado stores what you send it: your entries, your reminders and the messages in the conversation.
• It does not connect to your bank, does not read statements and has no access to any account of yours.
• The AI reads your message to understand it, not to train anything on it.
• We do not sell or rent your data. Ever. It is not our business.
• You delete your whole account from the dashboard, with your password, and we delete it.

1. Who is responsible

Regrado is operated by Marketing Solutions Brasil Ltda, registered under Brazilian company number (CNPJ) 27.300.241/0001-02, which is the controller of the personal data processed here under Brazilian Law 13.709/2018, the Lei Geral de Proteção de Dados (LGPD).

For anything to do with privacy, including exercising your rights, reach us at contato@regrado.com.br or on the support WhatsApp.

2. What Regrado does not do

We start here because it is what puts people at ease, and it is verifiable in the product:

• We do not ask for, store or use your bank password, bank token or any financial credential.
• We do not connect to open banking, to internet banking or to any bank app. Regrado only knows what you tell it.
• We do not read your statement or your card bill. What shows up in the dashboard is what you entered.
• We do not sell, rent or hand over your data for third-party advertising.
• We have no access to your card number. Payment is processed by Asaas, or by Stripe for those who pay in US dollars, and the card is typed in there.

3. What data we process

3.1. Data that identifies you

• WhatsApp number. It is your identity here: the account is created when you send the first message, and the number is verified by WhatsApp itself.
• Name and, if you subscribe in Brazilian reais, billing name, e-mail, tax ID and address, which the payment gateway requires in order to issue the charge. Those who subscribe in US dollars give Regrado no tax ID or address: the billing details are typed on Stripe's page.
• Profile photo, if you send one.

3.2. What you send

• Text messages, voice notes and photos (a receipt, for instance) sent in the conversation, on WhatsApp or in the in-app chat.
• Entries: expenses, income, amounts, dates, categories, payment methods, cards you register, instalments.
• Reminders, goals and spending limits you create.
• Your own words: the terms you teach Regrado so it categorises things your way.

3.3. Operational data

• Time zone, language, currency and screen preferences.
• Technical access and error logs, which include IP address and date and time, and exist for security and for diagnosing failures. The Regrado error log does not keep what you write: the text becomes a code that cannot be read back, phone numbers show only the last four digits, and email addresses appear without the part before the @. The warnings that the server itself writes when part of the program fails may carry a piece of the data that was being handled at that moment.
• Where you came to the site from, if you tap the button to start on WhatsApp: the name of the site, search engine or network that brought you (not the full address of the page), the campaign parameters in the link and, when there is one, the click identifier that the ad or the social network adds to the link. See section 9.
• If you accept measurement and ads, browsing data on the site and your tap on the button to start (see section 9).
• The steps of your arrival: the first message, the account created, the payment opened and the payment made, which the server tells Meta with the phone number hashed (see section 5).

Sensitive data. Regrado does not ask for sensitive data in the sense of the LGPD (racial origin, religious belief, political opinion, health, sex life, biometrics). If you write something like that in a message, it is treated like the rest of the conversation, and you can delete it at any time.

4. Why we process it, and on what legal basis

Where the basis is legitimate interest, you may object. Write to us and we will assess it and reply.

5. Who we share it with

Regrado uses suppliers that act as processors: they handle data on our behalf and on our instructions, so the thing works, and not for their own purposes. These, and only these:

Ads on Meta. When a new number writes to Regrado on WhatsApp, creates the account, opens the payment or pays, Regrado's server tells Meta through the Conversions API. This also covers people who go straight to WhatsApp without visiting the site, so it does not depend on accepting cookies. The phone number, e-mail, name, city, state, postal code and country, when Regrado has them, and the identifier leave here already hashed (SHA-256), as Meta requires: Meta matches those codes against its own accounts and does not receive the data itself. The exception is the IP address from when you open the payment on the site, which Meta requires as it is, and which we delete on our side as soon as Meta confirms receipt. Your tax ID, your street address and the content of your messages are never sent. You may object to this: write to contato@regrado.com.br.

Artificial intelligence. OpenRouter is the only artificial intelligence company Regrado talks to. It passes the content on to the provider of the AI model that does the reading.

WhatsApp. The conversation happens inside WhatsApp, which belongs to Meta and has its own privacy policy.

Family group. If you join a family group, the entries on that account become visible to everyone in the group. That is the feature working, and it is you who decides to join or leave.

Beyond that, we only share data under a court order or a lawful request from a competent authority, and only as far as what is asked for.

6. International transfer

Some of the processors above are outside Brazil, such as OpenRouter and Google, and so are the providers of the AI models OpenRouter passes the content on to. That means part of the processing happens in another country, which the LGPD allows in the cases of art. 33, and here the basis is performance of the contract with you: without that transfer the AI does not understand your message and the product does not exist.

Stripe, which processes payments in US dollars, also processes data outside Brazil, and there the basis is the same performance of the contract with you: without it there is no way to charge in dollars.

Google Analytics and the Meta Pixel also process data outside Brazil, and they only receive anything if you accept measurement and ads: there the basis is your consent.

The events the server sends to Meta through the Conversions API (section 5) are also processed outside Brazil, and they leave here with the identifying data already hashed, except for the IP address from when you open the payment on the site.

7. How long we keep it

• While your account exists, we keep what you entered, because showing it back to you is what Regrado is for.
• After the account is deleted, by you or for lack of use, we delete your personal data and your content. So that the free trial counts once per number, we keep, for 1 year, only a mark of the deleted account's number, made with a secret key. This mark doesn't let anyone read the number and shows nothing of what you recorded: it only tells us that this number has already used the trial and, if so, the automatic refund (the item below). Tax records of the charge are kept for the period the law requires.
• The automatic refund of the guarantee also counts once per number. If the deleted account had already received that refund, the same mark of the number keeps, for the same 1 year, the date it happened: whoever comes back with the same number can still ask for a refund within the 7 days, and the request goes to our team, who will review it and reply.
• Inactive accounts. An account whose access is paused (the trial ended or the subscription expired) that goes 180 days (6 months) without use, without signing in to the dashboard and without sending a message, is permanently deleted, with everything in it. Before that, we notify you twice on WhatsApp and, if the account has an email, by email too: 30 days and 7 days before, with the date. To keep the account, just reply that you want to keep it, or sign in to the dashboard and tap Keep my account. Accounts with an active subscription are not covered by this rule.
• Access logs are kept for the period set by Brazil's Internet Civil Framework (Law 12.965/2014).
• The origin of a visit that did not turn into a conversation is deleted after 90 days. One that did stays linked to your contact while it exists; deleting the account removes the link.
• Events for Meta wait in a queue until they are delivered and leave it 30 days later. Anything not delivered within 7 days is dropped without being sent.
• If you talk to Regrado without an account. If you chat with Regrado on WhatsApp and don't create an account, the messages of that conversation are kept for up to 180 days and then deleted. Your contact details (your number, name and WhatsApp profile photo) are deleted too, 180 days after your last message.
• The trash. What you delete, such as an entry, stays in the trash for 90 days so it can be undone, and then it is gone for good. Deleting the account empties the trash too.
• The backup copy of a deleted account. When an account is deleted by our team, and not from the dashboard, a backup copy of that data may be kept for up to 90 days, only to be able to fix a mistake. After that, it is deleted.
• The artificial intelligence record. Each message the artificial intelligence reads leaves a technical record with the text it read and its answer. In that record, the text is kept for 90 days and then deleted; the cost of the reading stays in the totals, without the text. The conversation in your account does not change: it is kept while the account exists.
• Technical error logs are kept for up to 30 days and then deleted (what they keep is described in section 3.3).

8. Your rights

The LGPD gives you rights over your data, and in Regrado most of them are exercised by saying so in the conversation, with no form and no waiting:

• Knowing what exists about you and accessing that data.
• Correcting whatever is wrong. In the conversation: "it was 45, fix it".
• Deleting an entry, in the conversation, or the whole account, from the dashboard, with your password and 24 hours to change your mind.
• Taking your data with you, as a spreadsheet (CSV), from the dashboard.
• Choosing whether your audio, photos and files keep showing in the chat: in Settings > Privacy and security, you remove audio from the chat once it is transcribed, photos and files once they are read, and the ones you already sent. The text and your entries stay in your account.
• Objecting to processing carried out on the basis of legitimate interest.
• Withdrawing consent for measurement and ads whenever you want, through the Cookies link in the site footer.
• Complaining to the Brazilian data protection authority (ANPD).

If you would rather do it in writing, send it to contato@regrado.com.br. We reply within 15 days.

9. Cookies, measurement and ads

The site stores three kinds of thing in your browser:

• What is needed to work, such as remembering the language you chose and keeping your session when you log in. Without it the site does not work, which is why we do not ask you to accept it.
• The origin of the visit, kept only in this browser tab and gone when it closes: where you came to the site from, with no cookie. It only leaves your browser if you tap the button to start on WhatsApp: it is sent to us together with a short code that goes in the ready-made message, and that code is what links your conversation to the visit. This record does not include your IP address or the full address of the page you came from.
• Measurement and ads, with Google Analytics, to know where visits come from, and with the Meta Pixel, to measure Regrado's ads on Facebook and Instagram and show them to people who visited the site. Only after you accept. If you decline, nothing is recorded, and the site works the same. You can change your mind at any time through the Cookies link in the footer.

What happens outside the site (the WhatsApp conversation, the account, the payment) does not go through cookies: it is the server that tells Meta, as section 5 explains.

10. Security

What we do to protect what is yours: encrypted traffic, passwords stored as a hash and never as text, integration credentials out of the browser's reach, a separate session for the administrative area, attempt limits on everything that compares a secret, and uploaded files stored outside any public folder, reachable only by whoever owns the account.

No system is impenetrable. If there is a security incident with relevant risk to you, we will notify you and the ANPD, as the LGPD requires.

11. Children and teenagers

Regrado is made for people aged 18 and over. We do not knowingly create accounts for children or teenagers. If we find one, we delete it.

12. Changes to this policy

When it changes, the date at the top changes with it. If the change matters to you, we tell you on WhatsApp, which is where we already talk.

13. Data protection officer

The channel for the officer in charge of personal data processing is contato@regrado.com.br.