Privacy Policy
1. Who we are
Poolmind8 Desenvolvimento de Software Ltda., CNPJ 67.223.642/0001-20, headquartered at Av. Brigadeiro Faria Lima, 1572, Jardim Paulistano, São Paulo, SP, Brazil, is the controller of the personal data collected through our applications and website (poolmind8.com). For any privacy-related questions, contact us at hello@poolmind8.com.
2. What data we collect
We collect only what is necessary to provide our services: your email address (used as your license identifier and for sending your access credentials), your license password (generated automatically at the time of purchase), and a device identifier (a random code generated by the app on first use, stored only on your device, never linked to your name or personal profile). In Maná8, when the license holder opens a circle, we also record that circle's technical data: the license holder's email and device identifier, the start and end times, whether it was extended and the number of guest entries. For the license holder's yearly recap, we also keep a summary of each circle (date, duration, number of people playing together, instruments, whether they used the circle sound on the host's phone and whether they made the card, never the photo) and how long they played per day and per instrument. When the license holder taps "I have read and accept", we record that acceptance: email, terms version, date, time and device identifier. Guests do not create an account and do not give us any personal data.
3. How we use your data
Your email and password are used exclusively to validate your license and allow access to the app. The device identifier is used only to enforce the two-device limit per license. We do not use your data for advertising, profiling, or sharing with third parties for commercial purposes. Before first use, the license holder declares that they have read and understood this Policy by tapping "I have read and accept"; guests make the same declaration before joining each circle.
4. Payment data
Brazilian purchases are processed by Cakto. International purchases are processed by Paddle.com (Paddle, 15 Briery Close, Great Oakley, Corby, Northamptonshire, NN18 8JG, United Kingdom), which acts as the Merchant of Record for all international transactions. Paddle processes the payment, billing, and applicable taxes on behalf of Poolmind8, and may collect additional data required for tax compliance in accordance with its own privacy policy (paddle.com/privacy). We do not store credit card numbers or financial data of any kind. The payment processors transmit to us only the email associated with the purchase, which we use to create and activate your license.
5. Data retention
Your license data is retained for as long as it is active. Refund records are retained for up to 24 months to prevent abuse, as permitted by Brazilian consumer protection law. Technical records of Maná8 circles are automatically deleted 7 days after each circle. The circle summaries and playing time used for the yearly recap are kept while the license is active and deleted 15 days after the license is deactivated for non-renewal. The record that the license holder tapped "I have read and accept" (email, terms version, date, time and device identifier) is kept for 5 years, for Poolmind8's defense in any administrative or legal proceeding, as permitted by the LGPD for the regular exercise of rights. After these periods, or upon request, data is anonymized or deleted.
6. Your rights (LGPD and GDPR)
Under Brazilian General Data Protection Law (Lei 13.709/2018), you have the right to: access your data, correct inaccurate information, request deletion of your data, request a portable copy of your data, and revoke consent at any time. To exercise any of these rights, contact us at hello@poolmind8.com. Data deletion requests will be processed within 15 business days. Deletion means anonymization of records in our licenses and devices tables. Refund records may be retained for up to 24 months as permitted by law. If you are in the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) also applies. We process your data to perform the contract (license and access to the app), on the basis of your consent (Microsoft Clarity) and on the basis of our legitimate interest (security, preventing abuse and replying to messages you send us). Some of our providers (Supabase, Cloudflare and Microsoft) may process data outside your country, under their own data protection terms. You also have the right to object to processing and to lodge a complaint with the data protection authority of your country.
7. Children's data — Kids lines
Some product lines are aimed at children ("Kids"). Poolmind8 does not collect personal data directly from children: the registration, email, and account management are the responsibility of the legal guardian who subscribes. Under Article 14 of the LGPD, the processing of children's data requires specific and prominent consent from at least one parent or legal guardian, obtained at the time of subscription by the guardian themselves. We do not collect additional data within the app during use by the child.
8. Maná8: circles, circle sound on the host's phone and end-of-circle card
During a Maná8 circle, a live channel (Supabase Realtime, over an encrypted connection) carries only technical signals: the instrument chosen by each participant, identified by a random code generated on the page itself; the signal that the license holder's device is still connected; and, in "Circle sound on my phone" mode, which groove each participant is playing and whether they are playing. No audio is transmitted or recorded, and these signals are not stored after the circle. Guests use Maná8 in the browser, without an account, and nothing is kept on their device beyond the page's own memory, which is cleared when the page is closed. To deliver the service, our infrastructure providers (Supabase and Cloudflare) may process technical connection data, such as the IP address, on a transient basis. The camera is used only on the end-of-circle card screen, with the device system's permission. The photo is taken on the license holder's device and sent, encrypted, through the circle's channel only to the devices present; it is not stored on our servers, and Poolmind8 does not access, keep or use the photos. The copy received by a guest stays only in the page's memory until it is closed or saved by them. Sharing the card is entirely the responsibility of whoever shares it, and the license holder is responsible for obtaining the consent of the people photographed, including parents or guardians in the case of children and teenagers.
9. Partnership form
When you submit the form on the Partnerships page, we receive the information you fill in: name, company or club, role, work email, phone (if provided), country, website or profile, area of interest and message. This information is used only to review and reply to your message and is stored in our database and in the hello@poolmind8.com mailbox. To prevent abuse, the form uses Cloudflare Turnstile (a bot check that may process technical data from your browser), and we store an irreversible code derived from your IP address, only to limit repeated submissions; the IP address itself is not stored. Form data is kept for up to 2 years after our last contact, and you can ask us to delete it at any time by writing to hello@poolmind8.com.
10. Cookies and local storage
Our apps use the device's local storage exclusively to save your login credentials and app preferences (such as right- or left-handed mode and jingle damper settings). In Maná8, the license holder's device also stores the record that they tapped "I have read and accept" and the record number of people playing together in their circles. On our website, we use Cloudflare Web Analytics to understand, in aggregate, how many people visit our pages and which pages they view (for example, how many visitors tap the buy button). This tool does not use cookies, does not identify you individually, does not build profiles and does not track you across other websites. If you choose a language in the language selector on our website, we save that choice in a functional cookie (pm8_lang), valid for 1 year and used only to open the site in your language: it does not identify you and is not used for tracking. With your consent, we also use Microsoft Clarity (Microsoft Corporation) on the pages of our website to understand how our pages are used — for example, where visitors tap and how far they scroll — through anonymous session recordings and heatmaps. Clarity uses cookies and is only activated if you click "Accept" on the notice shown on the site; you may decline and keep browsing normally. Clarity automatically masks what you type in form fields, and it is not used inside our apps or on payment pages. We do not use advertising cookies or social media pixels.
11. Security
We use Supabase as our database infrastructure, Cloudflare for DNS, CDN, firewall protection and aggregated, cookie-free website statistics, and all communications are encrypted via HTTPS. Access to your data is restricted to automated systems and, in exceptional cases, to our technical team for support purposes.
12. Changes to this policy
We may update this policy periodically. In the event of material changes, we will notify users via email. Continued use of the app after the changes constitutes acceptance of the new terms.
13. Contact
For any questions or requests related to this Privacy Policy, contact us at hello@poolmind8.com. Last updated: November 1, 2026.