Muilu · Pilot / beta
Privacy Policy
A short, factual account of how the current Muilu pilot handles personal data.
1. Who we are
Muilu is operated by Central Fox Tecnologia Ltda., the data controller, at Rua Lineu Jucá 182, Vila União, Fortaleza/CE, 60420-090, Brazil.
Privacy and data-protection contact (including the DPO channel): muilu@centralfox.online. Alternate contact: contato@centralfox.online.
2. Data we process
- Account and identity: email, display name, account role and identity provider/identifier. The current mobile interface signs in with a six-digit email code and has no password field. The backend also contains Apple and Google identity routes, even though the current mobile flow does not expose them.
- Sessions and abuse prevention: access and refresh tokens (refresh is stored server-side only as a hash), session family, revocation status, OTP challenge and attempts. Email and IP are transformed with a keyed hash for rate limiting; the web server may separately hold IP-based technical logs.
- Your activity and content: favourites; reviews, rating, text and language; reports and their details; blocks; business claims and evidence; promotions; business membership and edits; consent records when used.
- Business information and media: business/professional name, category, city, coordinates, address, phone, WhatsApp, website, descriptions, hours, uploaded files and their technical metadata.
- Location: only after you choose “Near me” or distance sorting and grant foreground permission. The current point is sent as latitude and longitude in the
GET /v1/businessesquery to calculate distance. It is not written to the Muilu application database or a location-history field. Because it travels in the URL, an inherited server access-log format may record it until the query-free logging configuration in this release is deployed. - Device and local storage: the app stores session tokens and language in secure storage; its local file cache can contain catalogue data, favourites, reviews, promotions and pending offline actions. Account deletion clears that cache. The API can store installation ID, platform, locale and push token, but the current Muilu app does not call the push-registration hook and no real APNs/FCM delivery exists in the audited backend.
- Technical data: request time, IP, method/path, response status, user agent, errors and security events may appear in operational logs. The app contains no advertising, analytics or tracking SDK.
3. Why and on what legal basis
| Purpose | LGPD | GDPR |
|---|---|---|
| Create the account, authenticate, show the directory, sync favourites and provide requested features | Art. 7(V), contract/pre-contract | Art. 6(1)(b), contract |
| Use foreground location after your choice | Art. 7(I), consent | Art. 6(1)(a), consent |
| Moderate content, prevent fraud, enforce rate limits and secure the service | Art. 7(IX), legitimate interests | Art. 6(1)(f), legitimate interests |
| Meet mandatory legal requests and preserve legal rights | Art. 7(II) and (VI) | Art. 6(1)(c) and (f) |
You can deny or revoke location permission and keep browsing without distance sorting.
5. International transfers
The controller is in Brazil and the production servers are hosted in the European Union. Data may therefore move between, or be remotely accessed from, Brazil and the European Union. Store or identity providers may process data in other countries under their own policies. We limit transfers to service operation and use transport encryption, access controls and the contractual safeguards applicable to each provider. You may request details through the privacy contact.
6. Retention
| Type | Observed rule |
|---|---|
| Account, identities, favourites, blocks, reports, devices, consents and personal media | While the account is active; deleted by the account-deletion transaction, subject to the backup period below. |
| Reviews and promotions | Until withdrawn/moderated. On account deletion they can remain, but the author link is removed and reviews show “Removed account”. |
| Business listings | No automatic expiry is implemented. A listing and its public contact data may remain after the member account is deleted. |
| Access / refresh / OTP / OIDC challenge | Usable for 10 minutes / 30 days / 10 minutes / 5 minutes respectively. Expiry blocks use; the repository does not prove immediate physical deletion of every expired row. |
| Rate limits and idempotency | Rate windows are 10 or 60 minutes; idempotency is defined for at least 30 days. Fixed physical cleanup was not found. |
| Sync events | 30-day configured target, applied only when the pruning function runs; the repository does not prove its production schedule. |
| Technical access logs | The repository does not fix a retention period. Query-free logging is included in this release; ask us for the period active on the server. |
| Database backups | Daily, retained for 14 days. |
| Local app cache | Until cleared, the account is deleted, or the app is removed; pending actions older than 30 days stop syncing but are not automatically erased by that check. |
7. Your rights
Depending on the law that applies, you may request confirmation and access, correction, deletion or anonymisation, portability where technically and legally applicable, information about sharing, consent withdrawal, objection or restriction, and review of a decision based solely on automated processing. Muilu does not use solely automated decisions with legal or similarly significant effect in the audited code.
Email muilu@centralfox.online. State the account email and request; never send an OTP, access token or password. Under the LGPD, a simplified confirmation/access response is immediate where possible and a complete statement is provided within 15 days. Under the GDPR, we respond within one month, extendable only where the law permits. You may also complain to Brazil’s ANPD or the competent European supervisory authority.
8. Security
Muilu uses TLS, short-lived access tokens, rotating hashed refresh tokens, one-time codes, rate limiting, PostgreSQL row-level security, separated database roles, private object storage with short-lived signed URLs, media re-encoding and EXIF removal, encrypted secret storage, restricted containers and validated daily backups. No system is risk-free; contact us if you suspect an incident.
9. Children
Muilu is not directed to children under 16. Do not create an account or submit personal data if you are under 16 without the valid authorisation required in your country. Contact us to request removal of a child’s data.
10. Changes and contact
We will post material changes here with a new version and date. Current version: 1.0, dated .
Controller and DPO channel: Central Fox Tecnologia Ltda., Rua Lineu Jucá 182, Vila União, Fortaleza/CE, 60420-090, Brazil · muilu@centralfox.online · alternate: contato@centralfox.online.