Privacy Policy

Effective 20/10/2026 · Version 1.0

Nuvlek is operated by G e Soluções e Eventos LTDA, CNPJ 46.647.904/0001-04, represented by Raphael das Neves Ferreira. Address: Rua Arthur Pelaio, 144 — Vila União — Bandeirantes/PR — CEP 86360-000 — Brasil. Support, safety and privacy: support@tioneves.com (suggested subject: “Safety” or “Privacy”). Data Protection Officer under LGPD article 41: Raphael das Neves Ferreira, contato@entexp.com.br.

Data we process

Account: email, username, display name, password hash, birthdate, country, language, security settings and guardian links. Service: IP/access logs, device/app diagnostics, messages, uploaded media, reports, appeals and tickets. Call metadata includes participants, time and duration. We do not record live voice/video calls or live screen shares. A voice message you deliberately send is a stored attachment; a Go Live preview is a stored thumbnail. Other participants might record externally.

Email supervision also processes the guardian’s email, the teen’s request reference, approval/decline and chosen controls. We record this to provide transparent supervision; no guardian account is required for approval.

Optional activity, payment and age checks

Presence and detected game activity are shared only if enabled. External connections follow your visibility setting; live badges need provider support. Stripe and Pix providers process payment details; we receive order ID, status, amount, currency and receipt, not your full card number. Stripe Identity handles document/selfie checks for adult access. From this check Nuvlek stores only result, date and birth year, not document/selfie images. The registration birthdate remains separate for account age rules.

Purposes and legal bases

We use account, message and call data to perform the service contract; logs/abuse signals for legitimate interests in fraud prevention and protection after balancing your rights; required financial/access records and authority reports for legal obligations; optional sharing and device access with consent where needed. Microphone, camera and screen access is requested in context. LGPD bases include articles 7 II, V, IX and, where appropriate, I; sensitive data needs an applicable article 11 basis. GDPR equivalents are articles 6(1)(b), (c), (f), (a). Children’s best interests apply under LGPD article 14, and GDPR article 8 applies where consent is relied on. We do not sell personal data or use personalized ads or advertising profiling. Teens receive no ads or profiling.

Our own hosting runs on a dedicated server with Contabo, an infrastructure provider in Germany. Other providers are Stripe (card payments and age verification), InfoPago (Pix in Brazil), Google (optional sign-in), and Cloudflare (DNS). They receive only information needed for their role. Messages follow channel/DM access permissions; moderators do not automatically read private DMs. Company systems analyze photos and reports automatically; authorized team members may review appeals or serious cases. Necessary information may go to authorities under legal obligations or lawful emergency grounds.

Retention

Messages and media stay while the person or server keeps them. Deletion removes them from the app immediately and from backups within 30 days, except legally required evidence preservation. Copies already received by others are outside this deletion.

Access records (IP and date/time): 6 months, Marco Civil article 15.
Payments and invoices: 5 years, for fiscal obligations.
Support tickets: 2 years.
Reports and moderation cases: 2 years after closure.
Live voice/video/screen: not recorded. Call metadata (who, when, duration): 90 days.
Serious child-protection cases: preserved until confirmed delivery to authorities, then for the period required by law. Decree 12.880 article 39 §2 governs deletion of prohibited material after confirmed receipt, with lawful exceptions; account information and other required evidence follow their legal period.

Diagnostics not needed for a retained case are deleted when their purpose ends. Account deletion leaves “Deleted user” on remaining conversation records and does not erase legally required records.

International transfers

International processing relies on the providers’ publicly available terms, standard clauses and applicable safeguards under LGPD article 33 and GDPR article 46. We do not claim a separately negotiated contract or a certification. The infrastructure provider is in Germany; other listed providers may process information internationally under their public terms. You may ask the DPO for information about applicable transfer safeguards.

Your rights

Choose Settings › Privacy › Download my data. A file is generated within 30 days, usually in minutes, and the download link is emailed to your account. Keep the file and link private. This export service does not extend statutory access deadlines: a full LGPD access statement is due within 15 days; GDPR requests normally within one month, with lawful extensions explained. Contact support@tioneves.com with subject “Privacy”, or the DPO, for access, correction, deletion, portability, objection, restriction or withdrawal of optional consent. Proportionate identity checks and legal exceptions apply. You may contact ANPD, your EU/UK supervisory authority or Japan’s PPC.

Under-13 and teen protection

We do not create under-13 accounts or intentionally collect their personal information. The age gate may retain only a hash of an attempted email for up to 24 hours against repeated entry; no under-13 profile, messages or marketing is created. Report suspected underage accounts to privacy so we can restrict access and remove unnecessary data subject to legal preservation. Teens have maximum privacy defaults and guardian rules in Minors and Families. Security reduces risk, without guaranteeing protection; report incidents to safety or privacy. Required notifications follow applicable law.

Family controls and spending

A teen can link a legal guardian through their own adult account or provide the guardian’s email. The email link opens a web page to approve or decline without creating an account. The guardian chooses purchases and a monthly limit, DMs, camera/screen/Go Live and quiet hours. A guardian account is optional for viewing activity summaries: new friends, conversation partners, servers and voice minutes, never message contents. The teen sees “Guardian supervision active”; supervision is never hidden. Purchases and server entry follow the guardian’s approvals.

Default monthly spending limits apply to everyone: BRL 500 / USD 100 / EUR 100 / JPY 15,000. Anyone can lower their own limit; only the guardian can raise a teen’s limit. Settings shows today’s and this week’s usage; an optional daily limit displays a break reminder. Teen camera, screen and Go Live publishing requires a linked guardian and permission, off by default. Every Go Live has Report stream. Mandatory privacy and 18+ restrictions cannot be disabled.

Verified guardian and teen confirmation

A legal guardian must be an adult verified by Stripe Identity with a document and selfie, whether approving with an account or an email link. Accepting a request alone does not activate supervision: the link stays awaiting verification, with the most restrictive controls, until verification is complete. The teen must also confirm who the guardian is before the link takes effect. A linking code has 12 characters, displayed as XXXX-XXXX-XXXX, valid for 24 hours. Nuvlek keeps only the verification result (yes/no), date and birth year, not the document, selfie or full birthdate from the check. Never send identity documents to support. A return URL or message saying the browser returned from Stripe is not proof of verification.

Reports, analysis and preventive restrictions

A report does not punish anyone by itself. It preserves evidence and goes to priority analysis. A preventive restriction requires confirmation by automated analysis of the actual content, corroboration by several different trustworthy accounts, or a team decision. A public report without an account never restricts anyone by itself, even after email confirmation. Public submission first sends an email confirmation link; only the confirmed notice enters the case queue. Identification, preservation and review are separate from punishment. A suspended or banned account cannot sign in or receive messages while the sanction remains in force; the available standing/appeal procedures remain described in Moderation.

Uploads and file safety

Uploaded videos are analyzed automatically using extracted video frames before other people can view them. A pending or restricted video is not a published video. PDFs and other files have no inline preview; teens can access files they sent themselves or that were sent by friends, not files from strangers. Executables are blocked, including .exe, .msi, .bat, .ps1, .apk and similar formats. Do not rename or package an executable to bypass the block. These controls reduce risk without guaranteeing that every permitted file is harmless.

Terms of Use · Community Guidelines · Minors and Families · Moderation and Appeals · Payments, Subscriptions and Refunds · Cookies and App Storage · Safety Center

Commercial disclosure

Official references

For users in Brazil, Portuguese controls if translations differ; elsewhere English controls, subject to mandatory local rights.