Privacy Policy — True Path

1. Introduction

This Privacy Policy (“Policy”) describes how the True Path Association, a private legal entity incorporated as a nonprofit association (Civil Code, Art. 53), registered with the CNPJ under No. 62.136.935/0001-57 (“True Path,” “we”), collects, uses, stores, shares, and protects the personal data of users (“you”) of the True Path app and the website www.truepath.com.br (collectively, the “Platform”).

This Policy complies with the General Personal Data Protection Law (LGPD) (Law No. 13,709/2018), the Brazilian Civil Rights Framework for the Internet (Law No. 12,965/2014), and other applicable regulations.

2. Data Controller and Data Protection Officer (DPO)

2.1. Controller

True Path Association (nonprofit organization)
CNPJ: 62.136.935/0001-57
Address: Rua Horácio Bandieri, 209, São Paulo, SP, ZIP Code 05653-030
Email: suporte@truepath.com.br

2.2. Data Protection Officer (DPO)

In compliance with Article 41 of the LGPD, we have appointed a Personal Data Protection Officer:

• Name: Gustavo
• Email: gustavo@truepath.com.br
• Responsibilities: Receive complaints, provide clarifications, and take appropriate action regarding personal data, in accordance with ANPD guidelines.

3. What Data We Collect

3.1. Data Provided Directly by You

3.2. Automatically Collected Data

3.3. Device Permissions

The app requests the following permissions from your device, always subject to the User's express authorization at the time of use:

You can revoke any permission at any time in your device's settings (iOS: Settings → True Path; Android: Settings → Apps → True Path → Permissions). Revoking a permission may make the corresponding feature unavailable.

3.4. Data We DO NOT Collect

• Precise location (GPS) — we do not request access to GPS;
• Cell phone contacts — we do not access your address book;
• Credit card information — the app is free; any donations or future payments will be processed by third-party payment gateways that do not share complete financial data with us;
• Biometrics — we do not collect fingerprints, Face ID, or other biometric data (authentication via Face ID or Touch ID, when used, is processed locally on your device and does not reach our servers);
• Health data from system apps (Apple Health / Google Fit) — we do not integrate with these services.

3.5. Specific Processing of Photos and Audio Files

Profile photos:

• They are optional and can be removed at any time;
• They are stored using encryption on AWS servers in São Paulo;
• They are not analyzed by facial recognition algorithms, biometrics, or embedding generation;
• They are not shared publicly or with other users.

Audio clips recorded using the microphone:

• Recorded only when the user explicitly taps the record button;
• Sent to contracted AI providers (e.g., OpenAI Whisper or the equivalent from AWS Bedrock / Google) for transcription into text;
• After transcription, the audio is discarded within a short period of time (up to 30 days for auditing and service improvement purposes);
• The transcribed text is formatted in the same way as the text messages in the Bible Chat;
• Under contracts that prohibit the use of providers' models for training purposes (when available).

4. Sensitive Personal Data

4.1. What are

Under the LGPD (Article 5, II), sensitive personal data includes information regarding religious beliefs, health, sex life, and genetic data, among other things.

4.2. What Sensitive Data Do We Collect?

• Religious beliefs: The very fact that you use the app indicates that you are interested in Christian content, and we may ask about your denomination or theological views;
• Information about emotional/mental health: During onboarding and in chat interactions, you can share your feelings, psychological challenges, times of grief, anxiety, depression, addictions, family conflicts, etc.

4.3. Legal Basis

The processing of sensitive data is based exclusively on your FREE, INFORMED, AND SPECIFIC CONSENT (LGPD, Art. 11, I), which is requested on a dedicated onboarding screen, separate from the other consent forms.

4.4. How We Handle It

• Access is restricted to a limited group of True Path professionals who are bound by confidentiality obligations;
• Storage with encryption at rest and in transit;
• No sharing with third parties for commercial, advertising, or any other unauthorized purposes;
• Intended solely for customizing your reading plan and improving your individual use of the Platform.

4.5. Repeal

You may revoke your consent at any time by emailing gustavo@truepath.com.br or through the app's settings, subject to the consequences described in Section 9.

5. Why We Collect Data (Purposes and Legal Bases)

6. How We Use Your Data

We use your data to:

1. Personalize your experience: generate customized reading plans based on your responses and interactions;
2. Operate the AI Bible Chat: send your input to LLM providers (see Section 7) and return relevant responses;
3. Save your notes and progress so you can refer to them whenever you want;
4. Improving the Platform: aggregated and anonymized analysis of which features work best, which types of plans are most useful, etc.;
5. Communicate with you: service notifications, reminders (if you enable them), support responses;
6. Ensure security: detect suspicious access attempts, prevent fraud;
7. Comply with legal obligations: respond to authorities when legally required.

6.1. What We DO NOT Do with Your Data

• We do not sell your data;
• We do not share your User Content or sensitive data with advertisers, social media platforms, or third parties for commercial purposes;
• We do not use your data to train general-purpose AI models—your personalization is individualized and contained;
• We do not cross-reference your data with that of other users to create commercial profiles;
• We do not display targeted ads based on your User Content.

7. Sharing with Third Parties (Subprocessors)

To operate the Platform, we rely on sub-processors (third-party service providers) who process data on our behalf under contracts that include protection and confidentiality clauses:

7.1. Sharing Due to Legal Obligations

We may disclose data when required by:

• Court order;
• Request from a competent authority (Public Prosecutor’s Office, ANPD, Police);
• Compliance with a legal or regulatory obligation;
• Protection of the rights of True Path or third parties in cases of fraud or infringement.

8. International Data Transfer

Some sub-processors are located outside Brazil, primarily in the United States. This international transfer is based on:

• Specific contractual provisions with sub-processors (LGPD, Art. 33, II);
• Ensuring an adequate level of protection in accordance with the LGPD’s parameters;
• In some cases, specific consent from the data subject.

We have implemented technical and contractual measures to ensure that the transferred data maintains the same level of protection required by the LGPD.

9. Data Retention

We retain your data for as long as necessary to fulfill the purposes described:

After the deadline, the data is permanently deleted or anonymized.

9.1. Account Deletion

You can delete your account at any time:

• In the app: Settings → Account → Delete account;
• By email: gustavo@truepath.com.br.

Deletion is permanent and removes notes, personalized plans, and chat history.

10. Your Rights (LGPD, Art. 18)

You have the right, at any time and free of charge, to:

1. Confirmation that your data is being processed;
2. Access to your data;
3. Correction of incomplete, inaccurate, or outdated data;
4. Anonymization, blocking, or deletion of unnecessary, excessive, or improperly processed data;
5. Data portability to another provider (upon express request);
6. Deletion of data processed on the basis of consent;
7. Information regarding sharing with third parties (already listed in Section 7);
8. Information about the option to withhold consent and the consequences of doing so;
9. Withdrawal of consent at any time;
10. Objection to processing that does not comply with the LGPD;
11. Review of automated decisions (Art. 20), including those made by AI;
12. Petition filed against us with the ANPD (National Data Protection Authority).

10.1. How to Exercise

Please send your request to gustavo@truepath.com.br with the following:

• Identification (name and registered email address);
• Description of the right you wish to exercise;
• Identification document (only in cases where there is reasonable doubt regarding identity).

Response deadline: up to 15 (fifteen) days for declaratory information; other deadlines are subject to ANPD regulations.

11. Cookies and Similar Technologies (Website)

The website www.truepath.com.br uses cookies:

• Essential: required for operation (cannot be disabled);
• Analytics: These track website usage in aggregate form—you can accept or decline them;
• Functional: remember preferences (language, etc.);
• Marketing: used only with explicit consent.

The first time you visit the site, we display a cookie banner where you can set your preferences. The mobile app does not use cookies (it uses equivalent SDKs for analytics, with the same level of protection).

12. Information Security

We have implemented appropriate technical and administrative measures to protect your data, including:

• Encryption in transit (HTTPS/TLS) and at rest (AES-256);
• Role-Based Access Control (RBAC);
• Secure authentication, with protection against brute-force attacks;
• Audit logs for access to sensitive data;
• Regular backups with encryption;
• Periodic security assessments and vulnerability tests;
• Team training on data protection;
• Incident Response Policy (see 12.1).

12.1. Security Incidents

In the event of a security incident that could pose a significant risk or cause significant harm to data subjects, we will notify:

• The ANPD within a reasonable time;
• The affected account holders, along with a description of the incident, the data involved, the measures taken, and recommendations.

12.2. Limitations

No system is 100% secure. Although we follow best practices, we cannot guarantee absolute security against sophisticated attacks, third-party failures, or malicious acts.

13. Restricted to Those 18 and Older

The Platform is intended exclusively for individuals 18 (eighteen) years of age or older. We do not intentionally collect personal data from children or adolescents (under 18 years of age).

• Upon registration, the user declares that he or she is at least 18 years of age and has full legal capacity;
• The Association may request proof of age at any time;
• If we identify, by any means, a user under the age of 18, the account will be immediately deleted and the personal data will be removed from our systems within no more than 30 (thirty) days;
• Parents, legal guardians, or any interested party may report the existence of an improper registration of a minor by emailing gustavo@truepath.com.br and requesting immediate removal.

This age restriction stems from the processing of sensitive personal data (feelings, religious beliefs, personal challenges) and the availability of an AI-powered Bible Chat; in this context, the Association believes it is prudent to make the Platform available only to adults.

14. Automated Decisions

True Path uses algorithms and AI to generate personalized plans and chat responses. You have the right to request a review of these automated decisions by a human (LGPD, Art. 20) by sending a request to gustavo@truepath.com.br.

15. Changes to This Policy

We may update this Policy from time to time. Substantial changes will be notified at least 15 days in advance via email and an in-app notification. The current version is always available at www.truepath.com.br/politica-de-privacidade.

Version History:

• v1.0 — May 16, 2026 — Initial release.

16. Complaints to the ANPD

You may file a complaint with the National Data Protection Authority (ANPD):

• Website: www.gov.br/anpd
• Procedure: in accordance with ANPD guidelines.

17. Contact

• Data Protection Officer (DPO): Gustavo — gustavo@truepath.com.br
• General Information: suporte@truepath.com.br
• Address: Rua Horácio Bandieri, 209, São Paulo, SP, ZIP Code 05653-030

By using True Path, you confirm that you have read and understood this Privacy Policy.

Version 1.0 — May 16, 2026