Privacy Policy

VoxDivina is a digital Bible reading, listening and study platform, available as a web application, Progressive Web App (PWA) and mobile app for iOS and Android. The platform offers Bible reading, narrated audio, reading plans, personal notes, highlights, bookmarks, reading history, AI Chat, and the Guardians (Guardiões) supporter program.

This Policy applies to all users of the platform regardless of country of access, and covers data processed in compliance with Brazil's General Data Protection Law (LGPD — Law 13,709/2018), the EU General Data Protection Regulation (GDPR — Regulation 2016/679), UK GDPR (UK-retained GDPR), the California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA), Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), and other applicable data protection laws.

2.1 Registration Data

• Full name or display name
• Email address (required for platform access)
• Phone number / WhatsApp (optional)
• City and country of residence (optional, self-declared)
• Profile photo or avatar (optional)
• Google account identifier (when logging in via OAuth 2.0)
• Password (stored exclusively as a bcrypt cryptographic hash — never in plain text)

2.2 Technical and Device Data

• IP address (partially anonymized after 90 days for analytics purposes)
• User-Agent: browser type, version, operating system and device model
• Access logs: timestamp, event, result (success / failure)
• Authentication logs: login attempts, token issuance and revocation
• PWA installation identifier (generated locally on the device, when applicable)
• Performance data and error reports (anonymized before storage)
• Cookies, localStorage and session identifiers

2.3 Usage and Behavioral Data

• Preferred language and time zone
• Biblical tradition and preferred version (translation)
• Chapters and books read, with access timestamps
• Platform browsing history
• Bookmarks: saved verses and chapters
• Highlights: verses marked with color and optional note
• Personal notes (Spiritual Notebook): title, content, tags
• Reading plans: active plan, progress and days completed
• Searches performed on the platform (text and voice)
• Accessibility settings: font size, theme
• AI feature interactions: questions sent to AI Chat, sessions created

2.4 Subscription and Payment Data

Complete card and banking data is processed exclusively by payment providers (Stripe and/or Mercado Pago). VoxDivina stores only:

• Customer identifier with the payment processor
• Subscription identifier and active plan
• Billing status (active, pending, cancelled, failed)
• Subscription start, renewal and end dates
• Transaction history: amount, currency, date and status per charge
• Payment method type (card / bank slip / PIX — no full number stored)

We never store full card numbers, CVV codes, complete banking details or PIX keys.

2.5 VoxDivina Guardians Program Data

Users who voluntarily join the Guardians program provide:

• Public name (displayed on the Guardians page)
• Country of origin (optional, displayed publicly when provided)
• Support message (optional, public)
• Financial contribution data (via Stripe / Mercado Pago)
• Date and amount of contribution

Public name and message are shown on the public Guardians page. You can edit or remove this information at any time from your Guardian profile.

2.6 Consent and Legal Audit Data

To comply with regulatory obligations (LGPD Art. 7, II; GDPR Art. 7; CCPA; PIPEDA), at the time of accepting our legal documents we record:

• User identifier (user_id)
• Exact date and time of acceptance (UTC)
• Version of accepted documents (Terms, Privacy, Cookies)
• IP address at time of acceptance
• User-Agent at time of acceptance
• Language displayed at time of acceptance
• Country detected via time zone / browser settings
• Recorded time zone
• Source of acceptance (web, PWA, mobile)

These records are retained for up to 5 years for proof and regulatory compliance, and are not used for any other purpose.

VoxDivina offers two authentication methods:

We maintain authentication logs (timestamp, IP, result) for up to 2 years for security purposes. These logs are not used for personalization or marketing.

VoxDivina uses Artificial Intelligence technologies to provide:

• AI Chat: answers to questions about biblical texts, theology and spirituality
• AI Insights: contextual explanations of biblical passages
• Smart search: finding verses by intent and context
• Guided studies: AI-assisted thematic content (Premium and Elite plans)

VoxDivina does not transmit personally identifiable data (name, email, national ID) to third-party AI APIs. Only interaction content is sent. AI providers maintain data processing agreements compatible with GDPR and CCPA. AI-generated responses may contain inaccuracies; VoxDivina does not guarantee the theological or doctrinal accuracy of automatically generated content.

VoxDivina offers biblical narration through voice synthesis. The system works as follows:

• Generation: biblical texts are converted to narrated audio by specialized providers (ElevenLabs and/or OpenAI Text-to-Speech)
• Storage: generated audio files are stored in a private cloud repository (Cloudflare R2) with access control via temporary token
• Streaming: audio is delivered via secure streaming with short-lived token authentication; files cannot be accessed without valid authentication
• Cache: frequently accessed audio files may be cached to improve delivery performance, without privacy impact
• Data transmitted to voice provider: only the biblical text to be narrated and voice parameters (voice, language, speed). No personally identifiable data is sent.

Daily audio limits vary by subscription plan. Usage is monitored for limit enforcement only and is not used for other purposes.

Payments are processed exclusively by PCI-DSS certified providers:

VoxDivina never stores full card numbers, CVV codes, complete banking data or PIX keys. Disputes and refunds are managed by the respective providers per their policies.

VoxDivina may send communications through the following channels, according to registered preferences:

Critical security communications (e.g., suspicious login attempt) may be sent regardless of preferences, as they are necessary to protect your account.

We use cookies, localStorage, IndexedDB and similar technologies as detailed in our Cookie Policy. Main categories include: essential (required for operation), preferences, analytics and advertising (applicable to the free plan only).

You can manage your cookie preferences at any time in Settings → Privacy → Cookies or via the consent banner shown on first access.

Users of the Path Plan (free) may see advertisements displayed by Google AdSense. These ads are selected by Google based on:

• Content of the accessed page (contextual advertising)
• Browsing history and interest profile, per Google's policies, when the user consents to advertising cookies

You can manage Google ad personalization preferences at adssettings.google.com. Non-personalized ads can be shown even without advertising cookies.

Your personal data is not sold to third parties. We share data only with the following operators and sub-processors, strictly to the extent necessary:

In the event of a merger, acquisition or asset sale, data may be transferred to the successor, with prior notice to users and maintenance of this Policy's protections.

To request deletion of your data, email [email protected] with subject “Data Deletion”. We will respond within 15 business days (LGPD) or 30 calendar days (GDPR/UK GDPR).

You have the following rights, exercisable under the law applicable to your country of residence:

Your data may be processed on servers located outside Brazil and/or the European Union, primarily in the United States and Europe. We ensure compliance with applicable laws through the following safeguards:

• Standard Contractual Clauses (SCCs): approved by the European Commission (Decision 2021/914), applied in contracts with sub-processors outside the EEA
• Data Processing Agreements (DPAs): signed with all sub-processors, requiring equivalent protection standards
• Adequacy assessments: analysis of the level of data protection in the destination country before transfer
• UK GDPR: transfers from the UK to third countries via International Data Transfer Agreements (IDTAs) when applicable
• LGPD Art. 33: international transfers based on ANPD adequacy decisions, specific contractual clauses or data subject consent

We implement appropriate technical and organizational measures to protect your personal data:

• Encrypted transmission: HTTPS/TLS 1.2+ for all communications
• Passwords: stored with bcrypt hash and random per-password salt
• Tokens: JWT with limited validity, automatic refresh token rotation and logout revocation
• Access control (RBAC): role-based permissions for internal staff; principle of least privilege
• Monitoring: access logs, anomaly detection and security alerts
• Encryption at rest: sensitive data encrypted in the database
• API protection: rate limiting, input validation and OWASP Top 10 protection
• Periodic assessments: security testing and infrastructure configuration review

In the event of a security incident involving personal data, we will notify the ANPD pursuant to LGPD Art. 48 and inform affected users when the risk is significant. To report security vulnerabilities: [email protected]

VoxDivina is directed at users aged 13 and over. For users between 13 and 17, we recommend access with parental or legal guardian knowledge and supervision.

• Brazil (LGPD): children under 12 must not use the platform. Data from children under 12 identified will be deleted immediately.
• EU / UK (GDPR/UK GDPR): minors under 16 (or 13 in jurisdictions that adopted the reduced minimum age) require verifiable parental consent for consent-based data processing.
• USA (COPPA): we do not intentionally collect data from children under 13 residing in the US. If such a situation is identified, data will be deleted immediately.
• Canada (PIPEDA): in compliance with applicable provincial laws on minor privacy.

Parents or guardians who identify that a minor has provided data without authorization should contact [email protected] for immediate deletion.

We may update this Policy periodically to reflect changes in our practices, legal requirements or the platform. Summary version history:

For significant changes, we will notify by email with at least 15 days' notice and display a highlight in the account dashboard for 30 days. A new acceptance confirmation may be required. Previous versions available on request to [email protected].

Supervisory authorities:

• Brazil (LGPD): ANPD — www.gov.br/anpd
• European Union (GDPR): supervisory authority of your EU member state of residence
• United Kingdom (UK GDPR): Information Commissioner's Office — ico.org.uk
• California, USA (CCPA/CPRA): California Privacy Protection Agency — cppa.ca.gov
• Canada (PIPEDA): Office of the Privacy Commissioner — www.priv.gc.ca