PELOZ

Privacy Policy — Peloz

Last updated: May 28, 2026

Peloz ("we", "our" or "the app") is developed by The Chosen One Naturais Ltda (Brazilian company registration / CNPJ 51.286.257/0001-92), headquartered in Belo Horizonte/MG, Brazil. This policy explains how we collect, use and protect your information, in compliance with the Brazilian General Data Protection Law (Law 13.709/2018 — "LGPD"), which governs our processing of personal data wherever you use the app.

1. Data Protection Officer (DPO)

Under art. 41 of the LGPD, the Data Protection Officer is Lucas Barbosa Guimarães Barros, reachable at contato@usepeloz.com. This is the single official channel for anything concerning personal data.

2. Information we collect

We collect only what the service needs to work. Peloz has no login and does not sync your data to our servers — everything below is stored locally on your device unless stated otherwise:

  • Sign-up details: name and email (given during onboarding, stored on your device only)
  • Hair profile (sensitive health data — art. 5 II and art. 11 of the LGPD): date of birth, stage of hair loss, affected area, product used (topical/oral minoxidil, finasteride, dutasteride, etc.), application frequency, side effects you report, treatment start date
  • Behaviour and progress: daily application logs, streak, Hair Score, progress photos you take
  • Photos (day-zero photo and progress photos): these are photos of your scalp and hairline, taken to track your progress. Peloz does not perform facial recognition and does not collect biometric identification data. The original photos are stored on your device only. The day-zero photo is sent to Anthropic for visual analysis only after you explicitly authorise it in the app (see section 5); you can decline and keep using the app without the AI analysis
  • Chat messages with the mascot: the text of your messages, any photos you attach and your hair profile are sent to Anthropic to generate the reply, only after you authorise it in the app (see section 5); they are never linked to you for marketing purposes
  • Reminders: your application reminders (morning and night) are scheduled locally on your device by the operating system. Peloz does not send server-side notifications and does not generate a push token
  • Device information: model, operating system, language, anonymous RevenueCat identifiers (used solely to manage your subscription)
  • Payment: handled entirely by Apple or Google — we never store card details

3. Legal basis and purpose (art. 7 and art. 11 of the LGPD)

Each piece of data is processed under a specific legal basis:

  • Sign-up details (name, email): performance of a contract (art. 7 V) — without them we cannot deliver the service to you
  • Sensitive health data (hair loss, product, frequency, scalp photos, Hair Score): specific, highlighted consent (art. 11 I). You can withdraw that consent at any time inside the app, under Settings > Delete account
  • Push notifications: consent (explicit device authorisation)
  • Payment data: performance of a contract + legal obligation (art. 7 II and VI)
  • Anonymous usage logs for product improvement: legitimate interest (art. 7 IX), with documented proportionality assessments

4. How we use your information

  • Tailor your treatment plan and reminders
  • Calculate your Hair Score (see section 6 — automated decision)
  • Send application reminders (only if you allowed them)
  • Generate replies in the chat with the mascot
  • Improve the app based on anonymised patterns

We do not sell, rent or hand over your data to third parties for marketing purposes.

5. Where your data is stored

Your sign-up details, hair profile, application logs, streak, Hair Score, chat conversations and photos (day-zero and progress) are stored on your device only (iOS/Android). Peloz has no login, keeps no user database, and does not persist any of this on our servers. The only personal data that ever leaves your device is the transfer to Anthropic described below, and it happens only after you explicitly authorise it inside the app.

Current sub-processors, kept to the strict minimum:

  • Anthropic, Inc. (USA) — AI assistant (Claude): used in two features — the chat with the mascot and the visual reading of your day-zero photo. What is sent: in the chat, the text of your messages, any photos you attach, and your hair profile (area, product, time on treatment); for the day-zero photo, the photo itself and your hair profile. When: only after you explicitly authorise it on a consent screen inside the app — and you may decline. How it is handled: Anthropic processes the data solely to generate the reply, does not use it to train AI models, and does not retain the images after processing, under the provider's commercial API terms. Anthropic's privacy policy: anthropic.com/legal/privacy
  • RevenueCat (USA) — subscription management: receives only an anonymous identifier for your purchase
  • Apple / Google: payment processing via the App Store or Play Store

International transfers to the United States rely on standard contractual clauses and technical safeguards equivalent to the protection required by art. 33 of the LGPD.

6. Automated decision — Hair Score (art. 20 of the LGPD)

The Hair Score is a metric calculated automatically, with no human intervention, from: your initial quiz score, time elapsed on treatment, adherence (logged applications), consecutive-day streak, and number of progress photos. It shapes how the app presents your progress and its recommendations.

You have the right to request a review of this automated decision and a detailed explanation of its criteria, at the email address above.

7. Your rights (LGPD art. 18)

At any time, you may request:

  • Confirmation that we process your data
  • Access to the data we hold about you
  • Correction of incomplete, inaccurate or outdated data
  • Anonymisation, blocking or deletion of unnecessary or excessive data
  • Portability of your data to another comparable service provider
  • Deletion of personal data processed on the basis of your consent
  • Information about the parties we share your data with
  • Information about your right to withhold consent, and the consequences of doing so
  • Withdrawal of consent, at any time
  • Review of automated decisions (e.g. the Hair Score) — see section 6

To exercise any of these rights, write to contato@usepeloz.com. We respond within 15 days.

You can also delete your account directly in the app, under Settings > Delete account. Deletion immediately wipes your local data and triggers the erasure request for anything else.

8. Data retention

  • Sign-up details, hair profile, photos and conversations: stay on your device for as long as you use the app. Using "Delete account" in the app removes them from the device immediately.
  • Data sent to Anthropic (chat and day-zero photo): processed to generate the reply and not retained by Anthropic after processing, under the provider's commercial terms.
  • Tax records (subscription receipts, invoices): kept by Apple/Google for up to 5 years, as required by the Brazilian Consumer Protection Code (art. 27) and tax law.

9. Security

We use encryption in transit (HTTPS/TLS). Data stored locally on your device is protected by the operating system. Access to third-party data (RevenueCat, Apple, Google, Anthropic) is restricted and audited.

10. Security incidents (art. 48 of the LGPD)

In the event of a security incident that could pose a relevant risk or harm to data subjects, we will notify the Brazilian Data Protection Authority (ANPD) and the affected users within 72 hours of becoming aware of it, as required by art. 48 of the LGPD.

11. Children and adolescents

Peloz is intended for people aged 18 and over. We do not knowingly collect data from children or adolescents. If we identify an account belonging to a minor, it will be removed.

12. Cookies and tracking technologies

The Peloz native app does not use cookies. The marketing website (usepeloz.com) may use cookies that are strictly necessary for it to work. If we ever enable analytics tooling, we will update this policy and offer granular control.

13. Changes to this policy

We will notify users by email and with an in-app notice in case of a material change. The "Last updated" date at the top is always kept current.

14. Contact

contato@usepeloz.com

Brazil