Balance — Brazil Country Annex

Effective date: 19 July 2026 Last updated: 19 July 2026

Owner: , Director, BabaYaga Program, TOO — Privacy Officer and Designated Child Safety Officer for every Brazilian resident covered by this Annex; the encarregado pelo tratamento de dados pessoais (Data Protection Officer) designated under Lei Geral de Proteção de Dados Pessoais — Lei 13.709/2018 ("LGPD") Art 41, with business contact published as the publicly-accessible contact required by LGPD Art 41 § 1; the designated contact point for the Autoridade Nacional de Proteção de Dados (the "ANPD"), the Secretaria Nacional do Consumidor ("Senacon") and the state/municipal Procon bodies, the Polícia Federal, SaferNet Brasil, and the Ministério Público, under their respective intake protocols. Reviewed: at least once a year, by 9 June. Re-opened immediately on (a) any amendment to Lei 13.709/2018 (LGPD, in force since 18 September 2020; administrative sanctions since 1 August 2021); (b) any Resolução or Regulamento of the ANPD — including Resolução CD/ANPD 15/2024 (breach-notification regulation, 26 April 2024), Resolução CD/ANPD 19/2024 (international-transfers regulation + Brazilian SCCs, 23 August 2024), Resolução CD/ANPD 2/2022 (small-processing-agents regime), and any children's-data Enunciado or guidance (including Enunciado CD/ANPD 1/2023 on LGPD Art 14 lawful bases for children's data); (c) any amendment to the Estatuto da Criança e do Adolescente — Lei 8.069/1990 ("ECA") including Arts 240-241-E (CSAM offences); (d) any amendment to, or regulation under, the ECA Digital — Lei 15.211/2025 (the Estatuto Digital da Criança e do Adolescente, in force 17 March 2026) including any ANPD/adjacent-agency implementing act on age verification, parent-account linkage, or parental-supervision tools; (e) any amendment to the Código de Defesa do Consumidor — Lei 8.078/1990 ("CDC") or the Decreto 7.962/2013 (e-commerce decree); (f) any amendment to the Marco Civil da Internet — Lei 12.965/2014 or its Decreto 8.771/2016; (g) any decision of the Supremo Tribunal Federal (including the ADC 51 line on cross-border lawful access and the constitutional right to data protection — EC 115/2022 Art 5º LXXIX) or the Superior Tribunal de Justiça materially bearing on the LGPD; (h) any change in Brazil's EU-adequacy status (none in force at the Effective date); (i) any change to a sub-processor's Brazil data-handling posture under our sub-processor register; (j) the bringing into force of any post-Effective-date Brazilian regulation governing automated processing or related techniques (covered by the deliberate-silence carve-out in § 2 of this Annex — including the pending PL 2338/2023 AI bill); (k) any ANPD designation affecting Balance's classification or any ECA-Digital transparency-report threshold event (> 1 million under-18 Brazilian users). Classification: Public legal annex. This document is published at Privacy Policy alongside the global Privacy Policy (H1) and at Children's Privacy Notice alongside the Children's Privacy Notice (H2), and is incorporated by reference into both. It is one of the country annexes that travel with the global documents under the "global policy + per-country annex" architecture documented in our internal compliance plan § 6.3.

This Annex discharges the country-annex obligations referenced in:

• Privacy Policy § 18 (Country annexes — Brazil row).
• Children's Privacy Notice § 14 (Country annexes — Brazil row).
• Child Safety Standards § 13 (Country annexes — Brazil row).
• Terms of Service § 17 (Brazil consumer-protection carve-out under the CDC + Marco Civil + ECA Digital; consumer-domicile forum under CDC Art 101(I)).
• Subscription Terms § 18 (Brazil consumer-rights overlay — CDC Art 49 seven-day direito de arrependimento).
• Data Retention & Deletion Policy § 13 (Brazil — ANPD complaint route).
• our breach-notification runbook § 9 (Brazil breach-notification route under LGPD Art 48 + Resolução CD/ANPD 15/2024 — 3 working days).
• our international-transfer pack § 6 (LGPD Arts 33-36 transfer mechanisms + Resolução CD/ANPD 19/2024 Brazilian SCCs).

This Annex is the canonical Brazilian-resident extension of the global Privacy Policy and Children's Privacy Notice. Where this Annex grants a Brazilian resident a right that the global Policy does not, this Annex governs. Where the global Policy grants a Brazilian resident a right that this Annex does not, the global Policy governs. The two are read together.

This Annex is drafted in English. The official language of the Federative Republic of Brazil is Portuguese (Constituição Federal Art 13). CDC Art 31 requires consumer information to be in Portuguese; a Brazilian-Portuguese translation of this Annex and of the common documents is provided via the language switcher at balance.babayagaprogram.com as part of the batch-1 locale rollout. In case of divergence, the English master is the drafting original and the Portuguese rendering controls for CDC-Art-31 consumer-information purposes.

1. Scope and applicability

This Annex applies to every Balance user (parent or kid) whose country of residence is Brazil — the Federative Republic comprising 26 states and the Federal District. The LGPD is a federal statute; since Emenda Constitucional 115/2022 the protection of personal data is a fundamental right (CF Art 5º LXXIX) and data-protection legislation is an exclusive Union competence — there is no state-level data-protection sub-layer that derogates from the LGPD.

We determine country of residence at install/sign-up time by (a) the country the parent self-declares in the in-app onboarding flow, (b) the IP-geolocation read at sign-up (discarded immediately after the residence decision — our internal data-flow map § 2.1), and (c) the Play Store account locale. The residence determination is reviewable at Settings → Account → Region. Where any signal identifies Brazil, this Annex applies; the most-protective reading controls per our internal compliance plan § 6.3.

The LGPD has explicit territorial reach at Art 3: it applies where the processing is carried out in Brazil, where the processing activity has the objective of offering or supplying goods or services to individuals located in Brazil (Art 3(II)), or where the personal data was collected in Brazil (Art 3(III)). Balance targets Brazilian residents through Google Play Brazil and through this Annex; the LGPD applies via Art 3(II) and 3(III).

2. Statutory framework — what applies

(Any prospective Brazilian regulation governing automated processing, algorithmic decisions, or related techniques — including the pending PL 2338/2023 artificial-intelligence bill and any successor instrument — is intentionally omitted from this Annex on the principle that this Annex makes no affirmative or negative statement about whether Balance does or does not process personal data using techniques within the scope of any such regulation. Balance's substantive product posture is described elsewhere in the policy bundle and is the controlling reference; this Annex's silence on the topic is deliberate and is not to be read as an implicit statement either way.)

3. Supervisory authorities

3.1 ANPD

A Brazilian resident may petition the ANPD (LGPD Art 18 § 1) after raising the matter with Balance (the ANPD's triage practice expects prior contact with the controller). Private remedies also run via consumer bodies (Senacon/Procon), the Ministério Público, collective actions, and the courts — including habeas data (CF Art 5º LXXII; Lei 9.507/1997).

3.2 Other regulatory bodies

3.3 The encarregado (DPO)

LGPD Art 41 requires the controller to designate an encarregado as the communication channel between controller, data subjects and the ANPD. The Balance encarregado is , Director, BabaYaga Program, TOO — , published here, in the global Privacy Policy § 1, and at balance.babayagaprogram.com (Art 41 § 1). The ANPD accepts a non-resident encarregado; no local representative is engaged (locked user decision; exposure tracked internally).

4. Lawful bases — LGPD Art 7 + Art 14

• Parent account data: Art 7(V) performance of contract + Art 7(I) consent obtained at sign-up.
• Kid profile + device data (usage totals, limits, tasks, earned-time ledger, device identifiers, push tokens): Art 14 processing in the child's best interest, grounded on the parent's specific and highlighted consent (Art 14 § 1) given through the parent-first onboarding; per Art 14 § 5 the parental link is verified by the account architecture itself (the kid profile exists only inside the authenticated parent account — see § 7).
• Security, fraud-prevention, legal compliance: Art 7(II) legal obligation + Art 7(IX) legitimate interest (with the Art 10 balancing recorded in our Data Protection Impact Assessment), never overriding the child's best interest (Art 14 caput).
• No sensitive data (Art 11) of Brazilian residents is processed. No advertising, profiling, or sale — monitoring/limits/tasks are performed at the parent's direction, strictly for the safety, well-being and parental supervision of the child, and are never used for advertising, profiling, or any commercial purpose (this also discharges the ECA Digital ban on exploitative commercial practices directed at children).

5. Children's rights overlay — LGPD Art 14 + ECA + ECA Digital

1. Best interest first. LGPD Art 14 caput + ECA Art 3 + CF Art 227: every processing operation touching a Brazilian kid is designed and reviewed against the child's best interest (DPIA: our Data Protection Impact Assessment).
2. The parent always consents; the kid never self-registers. LGPD Art 14 § 1 specific and highlighted parental consent is obtained by design; Art 14 § 5 verification is satisfied by the parent-first architecture (verified email + payment instrument where subscribed + affirmative pairing act).
3. ECA Digital alignment. Balance is a parental-supervision tool of the kind Lei 15.211/2025 requires suppliers to offer: under-16 accounts are parent-linked by construction (there is no unlinked kid account at any age); privacy-by-default for minors is the only mode Balance ships; no advertising is directed at children; no commercial exploitation of children's data occurs. The transparency-report threshold (> 1M under-18 users) is not met at the Effective date and is monitored.
4. Art 14 § 6 plain language: the Children's Privacy Notice (H2) and the kid-facing screens use age-appropriate plain language.
5. No contact-by-strangers surface, no content feed, no social graph — the product exposes no ECA-Digital-regulated recommendation or interaction surface to the kid.

6. LGPD Art 18 rights catalogue

A Brazilian resident (the parent, also exercising the kid's rights as legal representative) has the following rights, honoured at and in-app:

• Art 18(I) confirmation of processing; Art 18(II) access — in-app JSON export at Settings → Family → [kid name] → "Export this kid's data" + plain-language summary; simplified format immediately, full declaration within 15 days (Art 19(II)).
• Art 18(III) correction — Settings → Account → Edit.
• Art 18(IV) anonymisation, blocking, or erasure of unnecessary/excessive/unlawfully-processed data.
• Art 18(V) portability (the JSON export; no trade-secret content).
• Art 18(VI) erasure of consent-based data — Settings → "Delete my account" / "Delete this kid"; Delete-account page; cascade per Data Retention & Deletion Policy § 7.
• Art 18(VII) information about public/private entities with which data was shared — § 10 of this Annex + our sub-processor register.
• Art 18(VIII) information about the possibility of denying consent and its consequences; Art 18(IX) revocation of consent (Art 8 § 5).
• Art 20 review of decisions taken solely on automated processing — Balance performs no such processing; the earned-time ledger is deterministic and parent-reviewable.
• Petition rights: Art 18 § 1 petition to the ANPD; consumer-body routes (Art 18 § 8).

Requests may be submitted in Portuguese or English, free of charge. Identity verification uses the parent's existing authentication credential.

7. Children's data — verification and minimisation

• The kid profile exists only inside an authenticated parent account; the kid's device is paired by the parent's affirmative act; the kid cannot self-register (LGPD Art 14 §§ 1, 5; ECA Digital parent-linkage duty).
• The consent screen itemises categories, purposes (safety, well-being and parental supervision only), sub-processors, retention, and rights — specific and highlighted (Art 14 § 1), in Portuguese for Brazilian parents.
• Data minimisation per Art 6(III): only what the supervision service needs; proof media is end-to-end encrypted to the parent's device keys — Balance holds ciphertext only (§ 13).
• Kid data is never used for advertising, never profiled, never sold, and never disclosed except to the § 10 sub-processors as processors.

8. International data transfers from Brazil — LGPD Arts 33-36 + Resolução CD/ANPD 19/2024

Balance transfers Brazilian residents' personal data to the United States (hosting) under:

• Brazilian Standard Contractual Clauses (Resolução CD/ANPD 19/2024) incorporated into the sub-processor paperwork per our international-transfer pack § 6; and
• the parent's specific and highlighted consent to the transfer, with prior information (LGPD Art 33(VIII)) — the transfer-disclosure consent at sign-up names the US hosting and the controller's Kazakhstan seat; and
• for contract-necessary flows, Art 33(IX) necessity for the performance of the contract.

No ANPD adequacy decision covers the US or Kazakhstan at the Effective date. The E2EE proof-media posture is the supplementary measure (ciphertext-only storage). § 18 covers any ANPD adequacy/SCC development.

9. Data residency for Brazilian residents

Brazil imposes no comprehensive data-localisation mandate on parental-control services at the Effective date (Marco Civil localisation proposals were dropped in 2014).

10. Sub-processors touching Brazilian-resident data

Full list with DPA status: our sub-processor register.

11. Breach notification — LGPD Art 48 + Resolução CD/ANPD 15/2024

Minimum notification content per Res 15/2024: nature of the data, categories and number of affected subjects, technical/security measures, risks, mitigation, encarregado contact (, named individual: ). Internal SLA: our breach-notification runbook § 5.4 + § 9.

12. Cookies, spam, and electronic direct marketing

Brazil has no standalone cookies statute; the ANPD Guia de Cookies (2022) treats cookie data as personal data under the LGPD. The Balance app deploys strictly-necessary storage only (authentication tokens; device-pairing key wrap; earned-time cache), covered by the sign-up consent. The public site uses no analytics, advertising cookies, trackers, or fingerprinting. Balance sends no electronic direct marketing to Brazilian residents — only transactional email. Should a marketing channel ever be introduced, the CDC Art 39 + Procon anti-spam practice and the ANPD legitimate-interest guidance would be applied first.

13. Lawful-access requests and the encryption posture

Brazilian authorities may serve lawful-access requests via court orders under the Marco Civil (Arts 10, 22-23 — connection/application records disclosed only on judicial order), criminal-procedure production orders, Ministério Público requisitions grounded on judicial authorisation, and cross-border channels (Budapest Convention since 1 August 2023; Brazil-US MLAT, Decreto 3.810/2001; the ADC 51 STF ruling upheld direct MLAT-route validity). Posture:

• Proof media is end-to-end encrypted (fresh per-file key, XChaCha20-Poly1305, wrapped to parent-device X25519 keys; ciphertext-only upload). No master key, no backdoor.
• Response protocol: (1) acknowledge within one business day; (2) engage Brazilian counsel; (3) preserve relevant ciphertext; (4) inform the authority plaintext is unavailable from us; (5) cooperate in identifying the lawful route to the key-holding parent.
• Marco Civil Art 15: Balance retains authentication/access records for six months and discloses them only on Brazilian judicial order.
• No bulk plaintext interception assistance; no server-side content scanning. CSAE cooperation runs via § 14 regardless.

Full encryption posture: our encryption-posture record.

14. CSAE reporting routes — Brazil

• Balance Designated Child Safety Officer: (named individual: ). Acknowledgement within one business day, in Portuguese for Brazilian reporters.
• SaferNet Brasil — INHOPE-member national hotline: https://new.safernet.org.br/denuncie.
• Disque 100 — national human-rights hotline (children): dial 100.
• Polícia Federal — CSAM/ECA Arts 240-241-E offences: https://www.gov.br/pf/ (Delegacias de Repressão a Crimes Cibernéticos).
• Ministério Público — federal/state prosecution: https://www.mpf.mp.br/.
• Conselho Tutelar — municipal child-protection council (ECA Art 131), per municipality.
• NCMEC CyberTipline (https://report.cybertip.org/) — provider-side discoveries route to NCMEC, which relays to Brazilian law enforcement.

Full routing table: Child Safety Standards § 8.5.

15. Complaint routes (summary)

A Brazilian resident may always first raise the matter at — simplified response immediately, full declaration within 15 days (LGPD Art 19). Prior contact is not a precondition to any authority route.

16. Consumer rights — the CDC overlay

• Art 31 information duty: clear, correct, Portuguese-language information on the service and price — implemented via the Portuguese documentation set + Subscription Terms § 5.
• Art 49 — 7-day direito de arrependimento: for distance contracts the consumer may withdraw within 7 days of contracting, with full refund including monetary correction. Balance honours it through the Google Play Billing refund route regardless of use in the window (Subscription Terms § 8).
• Art 51 abusive clauses: null; the Terms of Service are drafted to avoid each listed abuse (no liability-exemption clause against the consumer, no burden-of-proof reversal, no compulsory arbitration imposition).
• Art 101(I) forum: the Brazilian consumer may sue in their own domicile; the Terms preserve it (Terms of Service § 17-18).
• Marco Civil Arts 7-8: privacy-violating clauses are null — the Terms contain none.
• Contracting capacity: age of majority 18 (Código Civil Art 5º); the subscribing parent must be an adult; the kid never contracts with Balance.

17. Cross-references

• Global Privacy Policy: Privacy Policy (H1).
• Children's Privacy Notice: Children's Privacy Notice (H2).
• Terms of Service: Terms of Service (H3).
• Subscription Terms: Subscription Terms (H4).
• Child Safety Standards: Child Safety Standards (H5).
• Retention Policy: Data Retention & Deletion Policy (H6).
• Records of Processing: our Records of Processing Activities (Article 30) (H7).
• DPIA + LIA: our Data Protection Impact Assessment (H8).
• Breach Runbook: our breach-notification runbook (M1).
• Transfer Pack: our international-transfer pack (M2) — Brazilian SCCs (Res CD/ANPD 19/2024) on file.
• JIT Permission Disclosures: the just-in-time permission disclosures (M3).
• App Classification: our country classification table.
• Sub-processor list: our sub-processor register.
• Encryption Posture: our encryption-posture record.
• Data Flow / Inventory Map: our internal data-flow map.
• Compliance Plan: our internal compliance plan.

18. Versioning and review

• Every change to a substantive row in §§ 2-16 bumps the frontmatter and triggers re-publication.
• A material LGPD amendment, a new ANPD Resolução/Enunciado, or an ANPD adequacy/SCC development triggers an off-cycle rewrite of §§ 2, 6, 8, 11.
• Any ECA Digital implementing regulation (age assurance, parent linkage, supervision-tool standards) triggers an off-cycle update to §§ 5, 7; crossing the > 1M under-18-user transparency threshold triggers the semiannual-report workstream.
• A material CDC / Decreto 7.962/2013 change triggers an off-cycle update to § 16 + Subscription Terms.
• A material change to a sub-processor's Brazilian-SCC status triggers an off-cycle update to §§ 8, 10.
• The annual review is by 9 June. The Privacy Officer signs off; the Designated Child Safety Officer co-signs any change to §§ 5, 7, 11, 13, 14.

End of Brazil Country Annex.