Privacy Policy

The controller of your personal data is Samuel Batista de Souza, an individual based in Turmalina, Minas Gerais, Brazil, who operates Radar 99. He also acts as the person in charge of data processing (encarregado, or data protection officer). You can reach him at help@radar99.app.

• Account data: your e-mail address and password. The password is stored only as a one-way cryptographic hash; we cannot see it. We do not ask for your name.
• Subscriptions you track: the name, price, currency, billing cycle, next charge date, free-trial flag and reminder preference of each subscription you add.
• Payment data: your card details are entered directly on Creem's checkout and never reach our servers. Creem sends us only what we need to manage your plan: a customer and subscription identifier, the status of your subscription, and the amount, currency and date of each payment or refund.
• Consent record: the date and version of the Terms of Service and Privacy Policy you accepted.
• Technical data: when you use the Service, our servers record the IP address, date, time and requested address of each request. We use it for security, abuse prevention (for example, limiting login attempts) and troubleshooting.
• E-mail delivery data: whether each reminder was sent successfully, so we do not send duplicates.
• Support messages: if you write to us, we keep the conversation to answer you.

We use a single cookie, sr_session, which keeps you logged in. It is strictly necessary for the Service to work, is not readable by scripts, and expires after 30 days without use or when you log out. We do not use advertising, analytics or tracking cookies, and we do not use third-party trackers on our pages. Creem may use its own cookies on its checkout and billing pages, under its own policy.

• To provide the Service — create and secure your account, store your subscription list, send reminders and password-reset e-mails, and manage your plan. Legal basis: performance of a contract (LGPD, Art. 7, V).
• To process payments and meet tax and accounting obligations — through Creem. Legal bases: performance of a contract and compliance with legal obligations (Art. 7, V and II).
• To keep the Service secure — prevent fraud and abuse, and investigate errors. Legal basis: legitimate interest (Art. 7, IX), always balanced against your rights.
• To communicate important changes — such as changes to these documents, the price or the Service. Legal basis: performance of a contract.
• To defend our rights — in legal, administrative or arbitration proceedings. Legal basis: regular exercise of rights (Art. 7, VI).

We do not sell your data, do not use it for advertising and do not send marketing e-mails.

We share personal data only with the service providers we need to run Radar 99, and only what each one needs:

Creem receives your e-mail address when you check out and is an independent controller of the payment data it collects, under its own privacy policy. We may also disclose data when required by law or by an order from a competent authority.

Our providers store and process data outside Brazil, mainly in the United States and the European Union. These transfers are made under Article 33 of the LGPD, when necessary to perform the contract with you and relying on the contractual safeguards these providers offer to protect personal data.

• Account, subscription list and payment records: while your account exists. When you delete your account, they are permanently removed from our database right away.
• After deletion we keep only an internal identifier (no e-mail) so that late notifications from our payment provider are ignored instead of re-creating data. Creem keeps its own transaction records for the period required by tax law.
• Login sessions expire after 30 days without use; password-reset links expire after 1 hour and are erased within 24 hours.
• Server logs are kept for a limited period defined by our hosting provider and then deleted automatically.
• Backups of the database are kept for a short period by our hosting provider and are overwritten automatically.

• All connections use HTTPS encryption.
• Passwords are stored with Argon2id hashing; session tokens are stored only as hashes.
• Login attempts are rate-limited, and cookies and secrets are removed from server logs.
• Access to production systems is restricted to the operator of the Service.

No system is 100% secure. If a security incident could cause you relevant risk or harm, we will notify you and the Brazilian National Data Protection Authority (ANPD), as required by the LGPD.

Under Article 18 of the LGPD you have the right to:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data;
• request anonymization, blocking or deletion of unnecessary or excessive data, or data processed unlawfully;
• receive your data in a portable format;
• request deletion of your data;
• know which third parties we share your data with;
• object to processing based on legitimate interest;
• request a review of decisions made solely by automated processing (we do not make such decisions).

You can edit your subscription list at any time and delete your account yourself from the dashboard ("Delete account"). For any other request, write to help@radar99.app from the e-mail address of your account. We may ask you to confirm your identity, and we will reply within 15 days. You also have the right to file a complaint with the ANPD (gov.br/anpd).

If you are in the European Economic Area (EEA) or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR also applies to our processing of your personal data. Samuel Batista de Souza is the controller.

• Legal bases (GDPR, Art. 6(1)): performance of a contract with you (account, reminders, billing); compliance with legal obligations (tax and accounting); and our legitimate interests in keeping the Service secure and defending legal claims.
• Your rights: access, rectification, erasure, restriction of processing, data portability, and objection to processing based on legitimate interests. You may exercise them as described in section 9, and we will reply within one month.
• Complaints: you have the right to lodge a complaint with the data protection supervisory authority of the country where you live or work (in the UK, the Information Commissioner's Office). We would appreciate the chance to address your concern first at help@radar99.app.
• International transfers: your data is transferred to Brazil, where the Service is operated, and to the providers listed in section 5. Where the destination country does not have an adequacy decision, transfers rely on the European Commission's Standard Contractual Clauses (and the UK Addendum) offered by our providers.
• EU/UK representative: we have not appointed a representative under Article 27 GDPR, because our processing is occasional, does not involve special categories of data at large scale and is unlikely to result in a risk to your rights. You can always contact us directly at help@radar99.app.

We do not sell your personal information and do not share it for cross-context behavioral advertising, as those terms are defined in U.S. state privacy laws such as the California Consumer Privacy Act. We do not use your data for profiling, and we treat no data we collect as sensitive personal information. You may request access to, correction of or deletion of your data as described in section 9.

Radar 99 is intended for adults aged 18 or over. We do not knowingly collect data from children or adolescents. If you believe a minor has created an account, contact us and we will delete it.

We may update this policy. The new version will be posted on this page with a new "Last updated" date, and we will notify you by e-mail of material changes before they take effect.

For any question about your privacy or this policy, contact Samuel Batista de Souza at help@radar99.app.