1. Who we are

WHATELSE Family is operated by WHATELSE FAMILY LIMITED, a company incorporated in England on 28 August 2026 under number 17425848, with its registered office at 203 Kenyon Way, Little Hulton, Manchester, England, M38 0DJ. We are the controllers of your personal data — that is, we decide why and how it is processed.

Until 28 August 2026 the service was operated by the individuals Matheus Alex da Silva and Cyntia Carla Pellizzer Januzzi, who incorporated the company and transferred the operation to it.

For any privacy matter: privacidade@whatelse.family.

DATA PROTECTION OFFICER (ENCARREGADO, Lei Geral de Proteção de Dados, art. 41): Matheus Alex da Silva, director of WHATELSE FAMILY LIMITED. Contact him at privacidade@whatelse.family or at the company's registered office, given above. In the United Kingdom, the company is not required to appoint a Data Protection Officer under article 37 of the UK GDPR, and the same contact answers for privacy.

ICO registration (the UK data protection authority): ZC174103, in the name of Saphia Academy, which trades under the name WHATELSE FAMILY.

2. What this policy covers

WHATELSE Family is an environment with several applications, accessed with a single account (among them Welse, for calls and broadcasts, the assistant GWE and WElupa, in addition to those that follow): Fala Aí (voice and video, with scheduled delivery), Fala Inbox (your own email address; not yet open to all accounts), Pulsoul (everyday voice), Fui.life (trips and experiences), we (the spoken diary), PXUS (content and courses), Anota Aí (organisation from what you describe) and Vínculos (the people in your life). The single account lives in the house, the front door to all of them. Where the processing is specific to one of them, we say which.

Pulsoul also publishes its own policy, which describes what is specific to it; if the two differ, the one that is more protective of you applies.

This policy says what the house does with your data, by category: it RECORDS (voice, image and the screen you show), TRANSCRIBES and TRANSLATES, STORES, SENDS to providers that carry out the service on our behalf, SHARES with the people and spaces you choose, and may SELL access to recordings of meetings. When we create a new function that does one of these things differently from what is described here, we update this policy.

Some functions described here are not yet active, and each is marked “not yet active”: the Minutes of meetings, the Minutes of Welse calls, the peer panel, online consultation with independent professionals, the health and wellbeing vault, the family calendar with a managed member, ad measurement on Meta in Fala Aí, the sale of recordings with the participation agreement and the connection of the YouTube channel. When one of them comes into use, exactly what is described here applies.

3. What data we process

3.1 What you provide to us

• For the account: email, password and your public identifier (the “@”).
• Signing in with Google: name, email and photograph, as Google sends them to us.
• In the profile, optionally: name, photograph, introduction, language, gender and location down to city. Date of birth is not part of the house profile (Fala Aí has its own field): we ask for it to protect minors (section 4).
• Content: recordings of voice, video and the screen you show, texts, images, documents and files.
• In Fala Inbox: the messages you send and receive, with senders, recipients, subject, body and attachments.

If you connect to Fala Inbox a mailbox you already have with another provider (for example, iCloud), we copy into Inbox only the messages that arrive AFTER the connection; the old history is not imported. For this we store the mailbox address and the app password you created for the connection, encrypted, with a key that is kept outside the database and that only our server reads. When you disconnect, we delete the stored address and password. Messages already copied remain in your Inbox until you delete them. You can also revoke the app password directly with your provider.

• In Fui.life: trip information, participants, the booking codes of tickets, and — as to travel documents — the CATEGORY, the EXPIRY DATE and the DESCRIPTION that you write to recognise them. Note: this description is free text and may contain sensitive information depending on what you write in it; we warn you of this at the moment you type it.

In Fala Aí: until a recording has been sent, it is kept on your device, so that it is not lost if the connection fails or the application closes. This is necessary for the recording feature, and we do not use it for anything else. The draft is deleted when you send it, when you delete it and when you sign out of the account; the upload queue (the file and who it is going to) is deleted only when the server confirms the upload. If the device is used by other people, send or delete the recording before handing it over.

• In Vínculos: the people in your life, your relationship with each one and the contacts you note down.

3.2 Collected automatically

• Session data and the token that keeps you signed in.
• IP address and request metadata, in server logs, for security and diagnostics.
• Device and browser information.
• Your country, inferred from the IP address, for aggregated reach reports.
• The notification subscription, if you authorise it (it goes through the browser's own sending service: Google, Apple or Mozilla).

3.3 What we do not collect today

• GPS location. We do not ask for location permission in any application.
• Advertising identifiers. There are none in the service, except for the two Meta measurement cookies in Fala Aí, which is not yet active and runs only with your consent.
• Your card details. See section 8.
• Access to your contacts, calendar or Bluetooth.
• Health, mood or emotional-state information that you have not chosen to give us. No application requires it. What you write or record on your own in your content remains private and yours alone, and we do not use it for any purpose of our own, nor to choose a sponsor brand.

Health information is special category data. We process it only if you give it, with explicit and separate consent, and we say here what will be processed: in live meetings, what you say on stage (section 5.1); in the health and wellbeing vault, what you choose to store (section 5.3).

In live meetings: those who only watch do not appear — no image, no voice and no name. Those who take part have their name shown to everyone in the chat, and what they write is kept for 90 days for the host and the live team to read and answer; you can delete your messages whenever you wish, and they appear to those who later watch the recording only if you authorised that. Those who go on stage appear with their image, their voice and the screen they show, and see on screen when the recording is on. The automatic caption starts off and exists only if the host turns it on; the room announces when this happens. The caption and the translation are produced on our provider's infrastructure, within our account. To bring the broadcast to the audience, we store half-second pieces of the video during the broadcast: they are deleted at the end and, at most, within 24 hours. The recording, with the transcript and the translation, is kept by us and available to the members of the confraria; section 5.1 says what happens when it is sold. If you change your mind, write to us: within 30 days we remove your name from the editions, delete your chat messages and cut out the passages in which you appear, except as section 5.1 says about the participation agreement.

• The NUMBER and the FILE of your travel documents. In Fui.life the document stays on your device. What remains is the description, the category and the expiry date — see 3.1.

If a new feature needs any of this data, it asks for your permission before collecting it, and this page will say so.

3.4 Data about other people

Part of the service consists of keeping information about people who are not users: a birthday you want to remember, a relative's contact, who is travelling with you, who writes to your mailbox, who is invited to an event of yours, or someone mentioned within your content.

When you do this for personal and family purposes, data protection law does not apply to you — this is the household exemption. It continues to apply to us, and section 12 explains what those people can request.

By recording information about another person, you declare that you have the right to do so. If you are a professional and include data of your clients, you are the controller of that data.

Family calendar — managed member. A person responsible for a child may add a managed member to the family calendar: only a short name that the responsible person chooses, a colour and the activities that person writes for the child. The child has no account, does not enter the house and receives no notices. We do not ask for date of birth, photo, school or any other data, and we ask that no sensitive information be written. What the responsible person records stays in their account and only the members of the family see it; it is deleted when they delete the member, leave the family or delete the account. If the child later has an account, the history does not pass across on its own: it passes only if the responsible person offers it and the child's account accepts it. This function is not yet active.

4. Children

We do not set a minimum age. When you complete registration in the house, date of birth is mandatory. If you are under 13, your account is put on hold, unused, until an adult in the house declares themselves responsible for you; the adult declares and you confirm. An application may, because of its content, require a minimum age of its own, which it states in its terms.

We say what is still missing: today we record who declares themselves responsible for a minor under 13, when the adult declares and the child confirms, with whom declared and when, and we do not verify that link by document. We are working to improve this verification.

The date of birth is kept in a single-purpose place that the applications cannot read. They ask only for the BAND (whether the person is under 13, 16 or 18) and receive yes or no — never the date. Fala Aí also keeps it in the profile of the application itself. When the age has not been declared, the answer is “we do not know”, and never “is an adult”. The date is requested when signing in through the house: without it, registration is not completed, and those who already had an account are asked for it on their next sign-in. Once stored, only Support can change it, with a recorded reason. Calls involving minors always go through protected mode. We say what is still missing: those who already had an account in Fala Aí or Pulsoul before the house began asking for the date may not yet have declared it; until they declare it, the answer is “we do not know”. Both apps have stopped creating accounts on their own: registration is only the house's. If you have already given your date of birth in another application of the house, we use that same date for this protection, without asking you again, and we may ask you to confirm it.

Buying and selling are only for people over 18. Parental consent authorises USE; it does not make up for the civil capacity to enter into contracts. Today the payment step does not ask for or verify age; whoever buys declares that they are 18 or over, by accepting the Terms.

Minors' accounts have public discovery turned off and are not included in audience selection. We are completing the unification so that the date of birth is held exclusively in the single-purpose place, across all applications.

In Brazil, we comply with the Digital Statute of Children and Adolescents (ECA Digital, Lei 15.211/2025): we do not use the profile of children or adolescents to choose advertising, and we do not display a sponsor brand to minors or to anyone who has not given their date of birth.

When the date of birth of a minor is given by someone who declares themselves responsible for them, we record who gave it. This record answers the question about the ORIGIN of the data — and, as described above, it does not prove that the person who gave it is in fact the responsible person. Nor does it replace, where the law requires it, the statement of the adolescent themselves: in the United Kingdom, for example, from the age of 13 a person can consent alone to the use of a digital service.

The age we know is the one that you, or whoever answers for you, declare. We do not verify it by document.

The health and wellbeing features (section 5.3) require the person to declare that they are 18 or over, and we do not offer them to accounts that we know to be minors'. This is a declaration, not a verification.

5. What we use it for, and on what legal basis

• Creating and administering the account, and providing the services — performance of the contract.
• Processing payments and meeting tax obligations — contract and legal obligation.
• Communicating operational and security notices — performance of the contract.
• Keeping the service secure, preventing abuse and moderating content — legitimate interests, and legal obligation as to unlawful content.
• Personalising what we show and suggesting the daily gesture — legitimate interests.
• Determining whether the data subject is a minor and applying the protections due — legal obligation and protection of the child. This purpose does NOT rely on consent, because the protection cannot be waived by the person it protects.
• Aggregated reach statistics, including those delivered to sponsors, who never receive personal data — legitimate interests.
• Counting, per account and without the content, how many people reach each step of functions such as recording a message and at which step they leave, so that we know what to improve. We keep only the name of the step, whether the person left there, the day and the account, never the message, the recipient or the title; only aggregated numbers come out, and only from groups of at least five people. We keep it for 13 months and delete it with the account — legitimate interests.
• Making the minutes of a meeting at the request of the person recording, and storing and selling recordings of meetings — legitimate interests, performance of the participation agreement (section 5.1) and, for any special category data the person reveals, explicit consent.

The demographic data in the profile depends on your consent, which you can withdraw at any time. THE CONSENT YOU GAVE IN ONE APPLICATION IS NOT TRANSFERRED to another application or to the central account. If this data comes to be stored by the central account, we will ask for your consent again — from you, and not from whoever carried it across. The fields are optional, and consent is never a condition of access.

5.1 Recordings of meetings, sale and participation agreement

WHATELSE FAMILY records live meetings and, when call recording is active (it is not yet), calls in which the host turns recording on: the voice, image and screen of those who appear. It transcribes and translates what is said, stores the recording and makes it available to the members of the confraria, to whoever buys it and, when the host of the meeting publishes it on the Welse showcase, to anyone with an account. We may sell access to recordings. We do not sell your personal data: whoever buys sees the recording and receives no data of yours beyond what appears in it.

Direct calls. In a direct call between two people, the network address of each device is shown to the other person, because that is how the call connects; it generally shows the city and the provider of the person calling. We keep that address only while the call is answered and delete it at the end, at most about one hour and fifteen minutes later; database backups may keep it for their own period (up to 90 days). Whoever does not want to show it uses protected mode, in which the call goes through us.

Anyone who goes on stage at a recorded meeting first signs a participation agreement. The agreement says three things: the meeting is recorded and the recording may be sold; whoever does not want to appear watches from the audience, where they do not appear; and whoever signs and appears cannot later ask for the recording to be taken off sale or for their participation to be removed from it. Only people over 18 sign. The basis for processing your image, voice, name and participation becomes the performance of that agreement (UK GDPR art. 6(1)(b); LGPD art. 7 V), and not consent. The licence is specific: that recording, for sale and display in the house's spaces, worldwide, online, with no time limit, non-transferable except to whoever succeeds us in the business. The use of excerpts in promotional pieces still depends on a separate, optional box.

There is a limit that no contract removes: what you reveal about your health, faith, intimate life, sexual orientation or political opinions is special category data, which we process only with your explicit consent, and that consent can be withdrawn. For that reason, whoever signs can ask, up to 30 days after the meeting, for the passage in which they revealed something of this kind to be discarded — the passage, and not the whole recording — and can ask, during the meeting, for the host to pause the recording before they speak. Discarding a passage is possible; removing one person from within a passage is not, because the recording is a single image with mixed audio. Your rights of access, correction, objection to new uses and portability remain intact.

The agreement is not retroactive: those who appeared in earlier recordings remain under the consent regime, which they can withdraw, and a recording with someone who has not signed is not sold. We keep the record of the agreement — who, which text, when, which meeting — for as long as the recording exists and for six years afterwards. The sale of recordings and the participation agreement are not yet active: today recordings are kept by us and available to the members of the confraria and, when the host of the meeting publishes it on the Welse showcase, to anyone with an account, and those who appear do so with the consent described in section 3.3.

5.2 The Minutes of a meeting

Whoever uses the Minutes records a meeting and the GWE, our artificial intelligence, proposes minutes: a summary, what was decided and what remains to be done, and by whom. In an in-person meeting only the audio is recorded, which is sent to a transcription service (Cloudflare, in our account, or AssemblyAI, section 8); the copy that remains with the transcription service is deleted shortly afterwards. Before recording, the person chooses whether to keep the audio and for how long, or until they delete it: if they do not keep it, the audio is deleted as soon as it is transcribed; if they keep it, it stays encrypted on their device and we keep only the encrypted content, which we do not read, and we delete it when they delete it or 45 days after their subscription ends. The GWE receives the transcribed text and what the person wrote (title, date and names of those present), returns the proposal and keeps nothing. The minutes stay in the account of whoever made them until that person deletes them.

Before each recording, whoever records declares that they have told those present, and what happens to the audio; we do not verify who is present. If you were at a meeting recorded by someone else and want to know what is in the minutes, to ask for your name to be removed from them or to ask for the audio to be deleted, write to privacidade@whatelse.family: we notify whoever made the minutes and, unless they have a valid reason, we delete the whole audio (it is not possible to remove just one person's voice) and your name from the minutes within a month; the minutes remain, without your name. The Minutes are not yet active.

Minutes of Welse calls (not yet active). In a Welse call, transcription and minutes are made only with the yes of each person on the call, who can withdraw it at any time, and are made by our own engine, with no other transcription service. The audio is not kept because of this. The text and the overall minutes stay in the account of whoever organised the call, theirs alone, until they delete them; each person who has a task, an agreement or a promise in the call receives, in their account, their part of the minutes, with only what concerns them, and only they decide whether to send it to anyone; whoever took part can ask for their lines to be removed, and we redo the minutes, and each person's part, without them within 30 days. Whoever does not authorise is not transcribed, but what others reply may still reveal what they said. With anyone under 18 on the call, transcription is not offered.

5.3 Health and wellbeing

The health and wellbeing vault lets you store, if you wish, health information about yourself: for example the fasts you record, your steps each day, your resting heart rate, how you feel and how you slept. It is health information, a special category, and we process it only with your explicit consent, requested per source (what you write by hand; the health export file from your phone), with the version of the text you saw, and which you can withdraw whenever you wish: withdrawing deletes what came through that source. Only people who declare that they are 18 or over use the health vault.

What you store is encrypted on your device with your vault key: we keep only the encrypted content, the source and the day it was stored, and we do not read it. If you have enabled vault recovery through the account password, whoever has that password opens the vault. If you lose access to the vault and to recovery, no one, not even us, can recover what you stored. The export file is read on your device and only the types you chose are stored; the whole file does not upload and is not kept.

We do not use this information for advertising or to choose a sponsor brand. Our artificial intelligence (the GWE) may work with it when you ask it to, for example to make a summary: at that moment we send what you chose, and only for that request. The service is not a medical device and does not replace a health professional. We keep it until you delete it, or until 45 days after your subscription ends, and we delete it with the account. To exercise access, write to us: we hand over what we have (the source, the date and your consents) and the way for you to open and export the rest on your device. The health and wellbeing vault is not yet active.

5.4 Peer panel among professionals

The peer panel (not yet active) allows a legal, psychology or health professional to describe a case, without data that identifies anyone, and receive the opinion of colleagues in the same field. For this we process the declaration that the person is a professional (the field, the country and the body and registration number they give), the text of the case, the answers and the record of the declarations made. Whoever answers sees the text of the case, the field and the country of whoever sent it, and not the name. We do not want data that identifies the person being discussed: the system looks for the most obvious signs and refuses the submission, but the confidentiality owed to that person rests with whoever submits. If you receive a case that seems to you to identify someone, tell us and we will remove it at once. We do not use the text of the case for advertising. We delete the case and the answers 30 days after the response deadline, or earlier at the request of whoever submitted it. We keep the record of the declarations (which text, when, by whom), without the text of the case, for six years, for the defence of rights. The basis is the contract, for the account of whoever uses the panel (art. 6(1)(b)), and our legitimate interests, for the record of the declarations (art. 6(1)(f)).

5.5 Published pages: those who visit them, without an account

You can publish a nook as a page open to anyone. Whoever visits it does not need an account and is not tracked: we count only visits and taps, in totals. The page may have forms: “Talk to me” (name, email, message and, if the person wishes, telephone), registration for a meeting (name and email), booking a conversation (name, email and the time chosen), a notice list (email, with confirmation by email) and testimonials (the text and the name the person chose). What is written in a form goes to whoever published the page, who decides what to do with it and is the one who controls it; we store and deliver it on that person's behalf, and we use the IP address, for a short time, only to block abuse. Before sending, each form says who it goes to, for what and for how long, and the person can ask for removal at privacidade@whatelse.family, without creating an account. We send notices only to those who asked for them and confirmed by email, and each notice carries a button to unsubscribe with one tap; we keep only the record that they unsubscribed. A testimonial appears only with the yes of whoever wrote it, who can withdraw it at any time, and it leaves the page at once: we keep the text, the choice of name and the date of the yes while it is on the page and, on withdrawal, we delete the text and keep only the dates. The bases are the person's request (art. 6(1)(b) and (f)) and, for notices and testimonials, consent (art. 6(1)(a)).

5.6 Online consultation with independent professionals

Online consultation with independent professionals (not yet active) works as follows. To book, we process your name, the time, the professional you chose and, only if you write it, the reason for the request. The reason may be health data: we ask for it only with your explicit consent (art. 9(2)(a)), which you can withdraw at any time, and only the chosen professional sees it; we delete the reason 30 days after the booked time. The consultation itself, the conversation and the clinical record, belongs to the professional, who is responsible for that data. The room is provided by us, and we neither record it nor read what is said in it. We keep the booking, without the reason, for six years, for the defence of rights and for tax obligations when there is a charge. The basis is the contract (art. 6(1)(b)) for the booking.

6. Artificial intelligence

We use artificial intelligence to transcribe what you say, translate incoming emails, analyse content for moderation, suggest organisation, translate the caption of recordings into the languages we offer, and find what you are looking for within what is yours. In particular, for SEARCH in your emails, the text of the message is sent to the model, which returns a numerical representation — we keep that representation and the title of the message, cut to the first 120 characters, and not the body; and, in the diary and in Anota Aí, we send the model the LIST OF PEOPLE YOU HAVE A CONNECTION WITH, so that what you dictate is linked to the right person.

Email-open notice: whoever sends an email through Fala Inbox can ask to be notified when it is opened. The function comes turned off and is turned on message by message. When it is on, the email carries an image that gives this notice and carries, in plain view of the reader, a line saying that the sender will be notified when the message is opened. We keep how many times and when it was opened, linked to that message, and we show this only to whoever sent it; it is deleted with the message and with your account. The house does not keep the network address, the email client or the location of whoever opens it — the image is served by a separate service that neither reads nor records them. Separately, and for all sends, we ask our sending service whether the message was delivered, bounced or marked as unwanted, and we keep only the name of that event.

The GWE, our artificial intelligence assistant, can read the content you have in more than one application in order to respond to what you ask of it.

The transcription of your voice is done by our own infrastructure provider, within our account; the in-person Minutes may use a specialised transcription service, described in section 8. Your voice is not sent by us to Google; Pulsoul has stopped using the browser's speech recognition, which could send it to Google.

None of these uses decides your access, your price or your rights. Automatic moderation may prevent a publication; in that case you are informed and can ask for human review. On Pulsoul, the machine can approve a clean pulse and holds the suspect one for a person to decide: no refusal is made by it alone.

Artificial intelligence processing takes place on the provider's global network, with no guarantee of a particular country.

On training models: CLOUDFLARE, which runs almost all the artificial intelligence we use, expressly states that it does not use customer content to train models or to improve services. We ourselves do not train any model with your content. Where a provider offers a training option, we keep it turned off; we are confirming with DeepL and AssemblyAI that the plans we use do not train on your content. If we offer you the option of helping to improve a provider's models with your voice or your content, it will be optional, separate and withdrawable, and we will describe it here before starting.

Today none of YOUR content is sent to OpenAI.

Moderation on Pulsoul. When someone sends a pulse, an artificial intelligence that runs on our own infrastructure account (Cloudflare) transcribes the audio and checks whether anything breaks the rules. The audio is transcribed within that account. If the result is clean, the pulse is published without going through a person. If it is suspect, or if the analysis cannot assess it, the pulse waits for a person on our team, who listens to the audio and decides. No refusal is made by the machine alone. The transcript and the reason for the result are kept in Pulsoul's database (in France), alongside the pulse, for as long as it exists, so that we can tell you why it was refused. The basis is our legitimate interest in moderating and the duty to combat unlawful content. Until 26 September 2026, Pulsoul's automatic analysis sent the audio to OpenAI (transcription) and the transcript to Anthropic (assessment); this was turned off, and on 18 October 2026 the analysis was switched back on, now in our account.

In Fala Aí, when recording a message, you can ask for a title suggestion. It is chosen by a program of ours, from the type and length of the message; no artificial intelligence provider receives it. Fui once sent to Google (Gemini) comments on itineraries with the names of family members; this sending is turned off today, and the summaries already generated remain stored in Fui's account.

7. How we read your relationships

The service calculates, from your use, a reading of the quality of each connection across six dimensions — rhythm, reciprocity, warmth, presence, depth and care —, from which come the state of the connection and the suggestion of a daily gesture. This is a form of profiling. It produces no legal effect on you and does not decide price or access. Today this reading exists only in Fala Inbox, is calculated in your browser from your messages (how many, when, at what rhythm) and does not read the content to calculate it. We say what is still missing: there is not yet an option to turn it off.

Today we do not do behavioural advertising and the only third-party ad technology planned is Meta's measurement in Fala Aí, which is not yet active and runs only with your consent; if this changes, we will ask for your consent and say so here. For sponsorship purposes, there is the possibility of selecting an audience by demographic data you have provided — and that selection depends on your consent and excludes minors' accounts. SPONSORS RECEIVE ONLY AGGREGATED METRICS: no personal data is sold or shared with them. In PXUS, YouTube and Vimeo videos and font files are loaded from those companies' servers, which receive your network address and browser data (see the Cookies Policy, section 3).

We say what is still missing: until 16 September 2026, the choice of brand and the record of each display used gender, country, state, city and language without checking your consent, and the record kept that data alongside your identification. This was corrected on that date. The old records are preserved, unused, and will be deleted.

8. Who we share with

We do not sell your personal data and we do not share it for advertising; sponsors receive only aggregated metrics. What we may sell is access to recordings of meetings (section 5.1). We share with providers that carry out the service on our behalf, in these categories: hosting and database; file storage; artificial intelligence, transcription and translation; authentication; payments; email sending; accounting; and development and operations tools. Today we use, for example:

• Cloudflare — hosting, database, file storage, transcription and translation, email sending and security logs.
• Supabase — authentication and databases.
• Google — sign-in with a Google account. In this mode, Google receives your email address.
• Stripe — payment processing. Your card details are handled exclusively by it and do not pass through us.
• DeepL — translation of profile introductions on Pulsoul.
• Hostinger — hosting of the Pulsoul site (pulsoul.com).
• Backblaze — second, encrypted backup of the databases and the files you send to the house, in Amsterdam (European Union).
• IBGE and countriesnow.space — public lists of states and cities, queried by your browser in Fala Aí when you choose your location; they receive your network address and the country or state chosen.
• Anthropic (Claude) — artificial intelligence assistant used by the team in the development and operation of the service, which may have access to data in the databases during that work. Today it is not part of the product. If it comes to process your content within a function, it will do so only with a signed data processing agreement and with training on your content turned off, and we will say here which data it receives before starting.
• Resend — sending of the service's emails.
• AssemblyAI — transcription of the audio of in-person Minutes, when the person uses the Minutes. It processes the audio on our behalf, on servers in the European Union (Dublin); we ask that the use of the audio to train its models be turned off, and we will confirm this in the dashboard and we delete the audio and the transcript that remain there shortly after the transcription finishes.
• Xero — the company's accounting. It receives the billing data needed for accounting and tax records: name of the buyer, email, amounts and dates.
• Meta Platforms (Facebook and Instagram) — measurement of Fala Aí ads, only for those who consent (not yet active). It receives the events of completed purchase (with the amount and currency) and of trial start, your email in the form of a code (hash), the IP address, the browser type and the two identifiers that Meta's script stores in your browser (_fbp and _fbc), and never the content of your messages. Meta is the controller of what it receives and processes it according to its own policy.

We also share when required by law or by a competent authority. When we begin to use a provider in a new category, we update this list.

The company's external accountant accesses the accounting records to meet our legal and tax obligations. In the exercise of the profession, she is responsible in her own right for the processing she carries out, and does not act on our behalf.

We have a data processing agreement in force with Stripe and with Cloudflare, incorporated into the respective service contracts.

8.1 If you connect your YouTube channel

If you are a creator and you authorise us, we can create live broadcasts on your YouTube channel. For this we use the YouTube API Services, from Google.

• WHAT WE ACCESS: with your authorisation, we create, start and end broadcasts on your channel; we obtain the address to which the signal of each broadcast is sent; and we read the live chat messages of that broadcast while it is happening.
• WHAT FOR: only for the broadcast that you yourself opened in the house. We do not use this data for advertising, for profiling, for training artificial intelligence or for any other purpose.
• WHAT WE KEEP: your authorisation, encrypted, until you revoke it, and the identifier of each broadcast we create. We do not keep videos, subscribers, statistics or any other content from your channel. The chat messages belong to other people: we show them to you during the broadcast and do not keep them. The recording of the broadcast is made from the signal that you send to the house, and not obtained from Google; it is your content and follows the rules in section 5 of the Terms.
• WHO WE SHARE WITH: no one. We do not sell or transfer this data. The use and transfer, by WHATELSE FAMILY, of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
• HOW TO REVOKE: by disconnecting the channel in the house, which deletes the stored authorisation; or, at any time, on the permissions page of your Google Account, at https://security.google.com/settings/security/permissions. Without the authorisation, we do not create new broadcasts.

Google processes YouTube data according to its own privacy policy, at http://www.google.com/policies/privacy.

This function is not yet active. When it is, exactly what is described above will apply.

9. Where your data is kept

The application servers run on a distributed network, close to you. The applications' databases are all in the European Economic Area, except for the mailbox and the attachments of Fala Inbox, described below:

• Ireland — the accounts database for all users, and Fui.life.
• Germany (Frankfurt) — Fala Aí, we and Anota Aí.
• France (Paris) — Pulsoul.
• Sweden (Stockholm) — PXUS.

The files you send are kept in Cloudflare storage, in Europe; the house's archive has the European Union fixed as its jurisdiction, while the audio and video storage of some applications does not yet have a fixed jurisdiction.

The We-mail mailbox — messages received and sent at the @whatelse.family addresses, with sender, recipient, subject, message body and the list of attachments — is kept in a Cloudflare database; Cloudflare is our network provider and is responsible for that hosting. The database is in Western Europe, the region in which Cloudflare runs it.

Apart from the mailbox database, which is in Western Europe, and apart from the running of part of the service (search indexes, queues and real-time rooms), which runs on Cloudflare's global network, and the Fala Inbox attachments, which are kept in Cloudflare storage with no fixed jurisdiction, our databases are in the European Economic Area. There are transfers to providers based outside it, some in the United States (such as AssemblyAI), made under the Data Privacy Framework, with the UK Extension, where the provider is certified, or under the European Union's standard contractual clauses and the UK Addendum, incorporated into their contracts.

The service can be used from any country. The data remains stored in the places indicated above; when you access it from another country, it is transmitted to you because you requested the service.

10. The search index

So that you can search among your content from different applications, we maintain a shared index. It contains representations of your content and also readable excerpts, such as titles.

Queries to this index are filtered by account, so that you only find what is yours.

11. How long we keep it

While your plan is paid, your content is kept, within the plan's capacity. What you store for a contracted period, such as a scheduled message or a time capsule, lives for that period, and you say how long you want to keep it when you store it; the corresponding space is counted against your capacity.

This period does not depend on the account: if you close the account, content whose period was contracted remains stored until the end of the period, and becomes available again if you create an account again with the same email within the period.

Messages already delivered belong to whoever received them and remain with that person.

Security and access logs are kept for up to twelve months, and tax data for the legal period, which is the mandatory minimum and cannot be shortened on request. Encrypted database backups are kept for up to 90 days. These periods are applied by an automatic routine that runs daily and records each pass in its own log, so that compliance can be demonstrated.

Reports. Whoever reports a call tells us the reason (up to 500 characters, without the content of the call). We keep who reported, who was reported, the reason and the date, for a person on our team to review, and we never tell the person reported who reported them. A report that no one has reviewed within 30 days is deleted, whether or not the person reported has closed their account. If the report is not confirmed, we delete the record. If it is confirmed, we keep for 24 months an irreversible summary of the email (not the email), the type of abuse and the date, to recognise whoever returns after being removed for abuse: when this happens, a person decides, and whoever is affected can ask for review. The text of the reason and the identity of whoever reported are deleted 12 months after the decision. The basis is our legitimate interest in protecting users (art. 6(1)(f)) and the defence of rights. Whoever reports content also tells us the reason; we keep the report, and serious content is hidden and preserved, without being deleted by routine.

Requests about your data. When you write to us to exercise a right (to see, correct, delete), we keep the conversation, with your email, for 12 months after our final reply, to follow up and to answer a complaint, and then we delete it. We keep for 6 years the record that the request was made and fulfilled (the dates, the type of request and what we did), without the content and without your email. A request that you withdraw counts from the date of withdrawal.

Call log. We keep for 90 days who called, whom, when, for how long and in what mode (direct or protected); the same period applies to rooms.

We do not delete content because you stopped using the account. When a paid plan ends, nothing is deleted before 45 days, and you can ask for the copy; afterwards, what exceeds the free space is deleted, except what has a contracted period or was promised to another person.

The chat messages of a meeting are kept for 90 days; the usage count, for 13 months; the record of a participation agreement, for as long as the recording exists and for six years afterwards; the stored audio of the Minutes and the health and wellbeing vault, until you delete them or until 45 days after your subscription ends, and they go with the account. The recording of a meeting is kept for as long as we have it available.

12. Your rights

You can find out what data we hold about you and obtain a copy; correct it; request erasure; restrict or object to certain processing; withdraw consent; and receive your data in a format that allows you to take it to another service.

To exercise any of them, write to privacidade@whatelse.family. We reply within one month.

12.1 When you close the account, you choose between two things

• CLOSE KEEPING WHAT WAS PAID FOR — content whose period you contracted remains stored until the end of the period. So that it becomes available again if you return, we keep your email address, and only that, until the end of that period; once the period has expired, the email is also deleted. The rest is deleted straight away.
• DELETE EVERYTHING — including the content you paid to store, with loss of what was paid for it. In this case we do not keep your email. In either mode, what you promised to other people — a scheduled message, an Event Chest, a time capsule, a course or a recording that someone bought for a fixed time — continues until the end of the period you promised (section 13).

Deletion goes through steps in order, starting with what can be reconstituted and ending with your identification, so that an interruption never leaves content without an owner. If it is interrupted, we notify you.

We say what is still missing: some of the deletion steps are still carried out manually, within the period of one month. If any step cannot be completed, we notify you and say what remained.

The mode you chose is recorded in the confirmation of each step: it is not possible to confirm in one mode and act in another, and the request is refused if the applications disagree with each other. The account mechanism exists, but has not yet been inspected or used. The applications have not yet completed the part that falls to them; until they do, requests are handled through privacidade@whatelse.family, within the same period.

12.2 What deletion does not reach

• What you have already handed to another person stays with them: an email sent, a message or an item left on a shared board remain with whoever received them, as would happen with a letter. In those records, you appear as “closed account”.
• Works created jointly are not deleted by the departure of one of the authors; what is deleted is your personal data, and you can ask to no longer be named. The second backup of the files, at Backblaze, may continue to keep a file for about 90 days after you delete the original; after that period it deletes it too.
• The minimum necessary to meet legal and tax obligations and for the defence of rights. When something is kept for that reason, we say in the reply to your request what was kept, why, until when, and that in that period it can only be used for that purpose.

12.3 If you are not our user

If you believe that we process data about you without your having an account with us, write to the same address. You do not need to create an account.

As to mentions of you within content created by another person: you can contact us, and we REVIEW the request, weighing your privacy against the freedom of expression of whoever wrote it. The decision is communicated with the reason, and whoever created the content can challenge it. We do not remove automatically on request, because that would allow any work that mentions someone to be taken down.

A limit that we prefer to state: we are able to locate who is registered as a connection or recipient. A name written freely within another person's content may not be locatable by search. In such cases, we say what we were able to find and what we were not, instead of appearing to be complete.

13. Death

The content you store is private and remains private after your death. We do not give heirs or third parties access to the account and we do not transfer the account. If you want someone to receive something, schedule the delivery while you can — scheduled deliveries are paid for at creation and take place on the set date, even if you close the account. They fail to take place only if you yourself delete them before they are opened.

14. Security

Among the measures adopted: separation of access per user in the database; authentication by asymmetric key verified by public key for accounts and, between some of our services, shared secrets kept outside the database; communication between our services over an internal channel; passwords stored only as a cryptographic hash; and encrypted traffic.

We offer two-step verification to all users, which can be turned on in your profile.

The data is on disk encrypted by our providers. This protects against unauthorised physical access, but does not prevent us from being able to access the content when necessary for operation, moderation or compliance with a legal obligation. We do not use end-to-end encryption, with one exception: the personal vault, whose content is encrypted on your device and which we do not read.

If an incident occurs that may affect your rights, we will notify you and the competent authority within the legal deadlines, following a written procedure that we maintain for that purpose.

15. Marketing and notifications

Today we send only messages necessary for the service. In Fala Aí, only with your consent, we measure the effectiveness of our ads on Meta (not yet active), as described in section 8. Whoever chooses “Essential only”, whoever is under 18 and whoever has not declared their age is never included. If we begin to send promotional communications, it will be with your consent, with a link to stop receiving them. Browser notifications depend on your authorisation and can be turned off at any time.

16. Changes

We may update this policy. When a change is significant, we will notify you by email or within the service, with reasonable advance notice. New functions that process data in a way already described here do not need notice.

17. Contact and complaints

privacidade@whatelse.family · Data protection officer (encarregado): Matheus Alex da Silva · WHATELSE FAMILY LIMITED, no. 17425848, 203 Kenyon Way, Little Hulton, Manchester, M38 0DJ, England. If you are not satisfied with our reply, you can complain to the data protection authority of your country: in the United Kingdom, the Information Commissioner’s Office; in Brazil, the Autoridade Nacional de Proteção de Dados; in the European Union, the authority of your Member State.