Privacy Policy

Bora Rota ("we", "us") is a route planner for Brazilian businesses. This policy covers the website, the planner, the driver app and route share links, and explains how we handle personal data under Brazil's General Data Protection Law (Law No. 13,709/2018, the LGPD).

This is an English translation of our Portuguese policy. If the two differ, the Portuguese version prevails.

The LGPD separates whoever decides about personal data (the controller) from whoever handles it on their behalf (the processor, or "operador"). In the planner, both roles come up:

• Your account data, like your name, your email address and how you use the service. For this, Bora Rota is the controller.
• What you put into the planner, like your customers' names and addresses, notes and visit history. Your organization decides why and how it's used, so it's the controller; Bora Rota is the processor and handles that data to provide the service, as set out in the Terms of Service.

If you receive deliveries or visits from a business that uses Bora Rota and want to know what it keeps about you, ask that business. If your request reaches us, we'll pass it on to them.

• Account. Your name, email address and the date you accepted the Terms of Service.
• Planner. Stops, addresses, routes, bases, notes, custom fields, the spreadsheets you import and the email addresses of the people you invite to your team.
• Visit history. When someone marks a stop Visited, Unsuccessful or Skipped, we keep the outcome, the note, the time and who marked it.
• Technical information. IP address, browser, device type, the pages you visit and access logs (the date and time the service was used from an IP address). We use it for security, to prevent abuse and to keep the service working well.
• Payments. Polar processes our payments. We don't see or store your card details.

Location. The driver app doesn't track anyone: it shows the route's stops, not where the driver is. When you open navigation in Waze, Google Maps or Apple Maps, those apps use your location under their own policies.

Don't add sensitive data. Please don't upload sensitive personal data, such as health information, racial or ethnic origin, religion, political opinions or biometrics, or ID numbers (like Brazil's CPF, RG or driver's license), bank details or passwords. That includes stop notes: for a pharmacy delivery, for example, write the order number, not the name of the medicine.

The LGPD requires a legal basis for each use of personal data (art. 7). These are ours:

• Providing the service (performing our contract with you): creating and running your account, managing your subscription, saving and optimizing routes, running the driver app and share links, and sending the emails the service needs, like sign-in codes and invitations.
• Meeting legal obligations: keeping tax and billing records, keeping the access logs Brazil's Internet Civil Framework (Marco Civil da Internet) requires, and responding to orders from the authorities.
• Protecting the service (legitimate interest): preventing fraud, abuse and unauthorized access, and limiting repeated attempts.
• Improving the product (legitimate interest): understanding how the service is used, fixing bugs and building new features.
• Measuring our ads (legitimate interest): learning which ads bring sign-ups, with Google Analytics and the Meta Pixel. You can object to this at any time, as explained under Cookies.
• Defending our rights (the regular exercise of rights): keeping what we need to respond to complaints and legal claims.

We share data with companies that help us run Bora Rota, and only what each one needs:

• Supabase, which hosts our database, and the provider that hosts the website;
• Mapbox, for maps, address lookup and route calculation;
• Resend, for sending email;
• Polar, for payments and subscriptions;
• OpenAI, which receives a sample of the rows of a spreadsheet you import, to work out which columns hold the address;
• Google and Meta, to measure visits and ads.

Within your organization, members can see its stops, routes and visit history, and anyone with a route's share link can view that route. We may also share data when the law or a court order requires it, to protect our users or the service, or as part of a merger, acquisition or sale of our business.

Several of these providers store or process data outside Brazil, mainly in the United States. These transfers follow the LGPD's rules (art. 33), for example when they're needed to perform our contract with you.

We use cookies and similar technologies:

• Necessary. borarota_session keeps you signed in and borarota_lang remembers the language you chose. The service doesn't work properly without them.
• Measurement and advertising. Google Analytics and the Meta Pixel set their own cookies (like _ga and _fbp) to understand how the site is used and measure our ads, and borarota_registered signals, once, that an account was just created. The driver app doesn't load the Meta Pixel.

To opt out of measurement, use your Facebook ad preferences, the Google Analytics opt-out add-on or your browser's cookie settings.

• Account and planner data, while your account is active.
• Access logs, for 6 months, as the Marco Civil da Internet requires (Law No. 12,965/2014, art. 15).
• Tax and billing records, for as long as the law requires.

When you ask us to delete your account, we remove your personal data from our active databases within 30 days, apart from what we must keep by law. You can also ask us to delete specific data.

Under the LGPD (art. 18), you can ask us at any time for:

• confirmation that we handle your data, and access to it;
• correction of incomplete, inaccurate or out-of-date data;
• anonymization, blocking or deletion of data that's unnecessary, excessive or handled against the law;
• portability of your data to another provider;
• deletion of data handled on the basis of your consent, and withdrawal of that consent;
• information about who we share your data with;
• an end to any handling of your data that breaks the law.

You can view, edit, export and delete what you've added in the planner yourself. For anything else, email suporte@borarota.com.br. We may ask you to confirm your identity, and we'll reply within 15 days.

If you feel we haven't resolved it, you can complain to Brazil's National Data Protection Authority (ANPD).

We use industry-standard safeguards, including encryption in transit and at rest. No system is perfectly secure: if an incident could cause you significant risk or harm, we'll tell you and the ANPD, as the LGPD requires (art. 48).

Bora Rota is meant for people 18 and over, and we don't knowingly collect data about children or teenagers.

We may update this policy from time to time. The date at the top shows when it last changed. If we change something important, like the purpose of a use of your data, we'll tell you by email or in the planner before the change takes effect.

For questions about this policy or your data, or to use your rights, email suporte@borarota.com.br or use the support form. This is our channel for requests from data subjects.