Privacy policy

This is a translation provided for convenience. If there is any difference, the Portuguese version prevails.

Bromélia Groove, a music label based in São Paulo, Brazil, respects your privacy. This policy explains in plain language which personal data we process on this site and why, in line with Brazil’s General Data Protection Law (Law 13.709/2018, LGPD).

what data we collect

• Browsing: IP address, browser type, pages visited and time — recorded automatically by the server and by any analytics tools (see the cookie policy).
• Contact: name, e-mail, phone number and the message you send us by e-mail or WhatsApp.

what we use it for

• to reply to you;
• to keep the site secure and online;
• to understand, in aggregate, what people visit most.

We don’t sell personal data and we don’t send promotional e-mails without your consent.

who we share it with

Only with those needed to run the site: hosting (Hostinger) and e-mail tools — all under contract and only for the purpose described. Embedded players (Spotify, YouTube, Instagram) may collect their own data when you interact with them.

how long we keep it

Contact messages: up to 12 months after we reply. Access logs: 6 months, as required by Brazil’s Internet Civil Framework (Marco Civil da Internet).

app notifications

If you turn on notifications (in the app or in your browser), we only store your device’s technical notification address, the keys that protect the messages, the language you chose and the date you subscribed — all so we can tell you about releases and news. We don’t store your name, e-mail or phone number. Messages travel encrypted through your device’s or browser’s notification service (Apple, Google, Mozilla or Microsoft). When you turn them on, your IP address is used for up to 1 hour, only to prevent abuse. You can turn them off at any time in your device or browser notification settings, or by uninstalling the app; subscriptions that are turned off are deleted automatically.

To know whether the app is already installed on your device (so we stop offering it again), the site creates a random code, unrelated to you, kept in your browser and in the app. When the app opens, it lets our server know; we keep only a scrambled version (hash) of that code and the dates of the first and last opening — no name, e-mail, phone or device. Your IP address is used for up to 1 hour, only to prevent abuse. Records with no opening for 180 days are deleted automatically. To erase the code, clear this site’s data in your browser or uninstall the app.

flower game leaderboard

The leaderboard is optional and shows up after you lose a round of the flower game. If you clear at least one level and don’t pick a name, your best score goes on the leaderboard under a random name (for example, “beijaflor482” or “CAPIVARA”), which you can change or delete. If this device already had a saved best score from before the leaderboard existed, it is added too, only once. There are two ways to use the leaderboard:

• Just a name, no sign-up: we keep the name (random or chosen by you), your game scores and the date. Access is remembered in this browser (local storage); if you clear your browser data, you lose access to that name.
• Continue with Google: Google confirms who you are. We don’t receive your password and we don’t keep your email or photo. We only keep the name shown (at first, your first name and the initial of your last name; you can change it), a scrambled code of your Google identifier that doesn’t reveal who you are, and your scores. This way your best score follows you to any device. Google learns that you signed in to this site, under Google’s own privacy policy.

Why we use it: to show the leaderboard and keep your best score. Legal basis: your consent (LGPD, art. 7, I), given when you play and save to the leaderboard. The name shown and the level reached are visible to anyone who opens the leaderboard.

How long: names without sign-up not played for 12 months and Google accounts not played for 24 months are deleted automatically. You can delete everything right away in leaderboard › delete my data. To record a round, we keep a temporary code for each round for up to 2 hours and count attempts per IP address (without storing the IP), only to prevent abuse.

your rights

Under the LGPD you can ask at any time for: confirmation that we process your data; access, correction or deletion; portability; information about sharing; and to withdraw consent. Just write to bromeliagroove@gmail.com. We reply within 15 days.

security

The site uses HTTPS, strong passwords and two-factor authentication on the admin panel, regular updates and backups. No system is infallible; if an incident affects your data, we will notify you and Brazil’s National Data Protection Authority (ANPD) as required by law.

children and teenagers

The site is not aimed at children under 13 and we do not knowingly collect their data.

changes to this policy

We may update this text. The version published on this page is the one in force.

data protection officer (DPO)

Bromélia Groove team — bromeliagroove@gmail.com.