Legal document

Privacy Policy

How BipView handles your data. In plain English, no fine print.

Version 1.0 · effective as of August 22, 2026

1. Who is responsible

BIPVIEW SISTEMAS LTDA, CNPJ 63.306.772/0001-76, with registered offices at Praça Monsenhor Emílio Lottermann, 40 — Moinhos de Vento, Porto Alegre/RS, CEP 90560-050.

Data Protection Officer (DPO): Denis Rocho — privacidade@bipview.com.

2. What data we collect

Account data

Your email address and an internal identifier generated at sign-up. These are the minimum needed for you to log in and for us to know the wallet is yours. Authentication is handled by Amazon Cognito.

Exchange credentials

If you connect an exchange, we store the API key you provide — and it must be read-only. The app does not request, does not use, and has no way to use trading or withdrawal permissions.

These keys are stored encrypted. We use envelope encryption: a master key in AWS KMS protects a data key unique to each credential, and only the ciphertext is stored. The key never appears in readable text: not in log records, not in error messages.

On-chain wallets

Only the public address that you provide. We never ask for a seed phrase, private key, or wallet password — and if anyone ever asks you for these on behalf of BipView, it is a scam.

Financial data we display

Balances, positions, transaction history, and values calculated from the sources you connected. This is the content the product exists to show.

Notifications

If you allow notifications, we store the device token so we can send them. By design, no notification displays monetary amounts — the alert calls you into the app, and the number stays behind your login.

Surveys and feedback

From time to time we may ask how strongly you would recommend BipView (a score from 0 to 10), or whether a specific action worked well. You can also write to us whenever you like.

We store the score, the text you write, the app version, and the date. We never store the values of your holdings alongside your response — the score does not need to know how much you hold, and combining the two would create a piece of data that did not exist before.

Responding is always optional. Dismissing it changes nothing in the service, and it keeps the question from coming back any time soon.

What we do NOT collect

Location, contacts, photos, calendar, messages, device files, and browsing history. The app does not request any of these permissions.

We also do not record your screen, your taps, or your browsing, and there are no third-party trackers — neither in the app, nor on our site.

3. What we use it for

• Show your consolidated holdings and keep them up to date
• Authenticate your access and keep your account secure
• Calculate tax estimates and alert you to deadlines
• Send the notifications you authorized
• Process subscriptions and unlock the features of your plan
• Understand what to improve in the product, based on what you answer
• Comply with legal obligations and respond to authorities when required by law

We do not use your data for advertising and we do not sell it.

4. Legal basis (LGPD)

We process your data on the basis of the performance of the contract (Art. 7, V of Law 13.709/2018 — the LGPD, Brazil's General Data Protection Law) for everything necessary for the service to function; on consent (Art. 7, I) for notifications and for connecting each source; on legitimate interest (Art. 7, IX) for satisfaction surveys and product improvement; and on compliance with a legal obligation (Art. 7, II) when the law so requires.

5. Who we share with

Only with those necessary for the service to work, and always to the minimum indispensable extent:

• Amazon Web Services — hosting, database, and key vault. Your data stays in the Brazil region (São Paulo).
• RevenueCat — subscription control. It receives only your account identifier and your plan status; it does not receive your balances.
• Google Play and App Store — they process the payment. We do not receive or store your card data at any time.
• The exchanges and networks you connect — we query your account data, always in read mode.

International transfer

Some of these partners process data outside Brazil — this is the case with RevenueCat, Google, and Apple, headquartered in the United States. This transfer takes place under Art. 33 of the LGPD, limited to what is necessary for the service to work, and supported by the contractual clauses signed with each of them.

The data that makes up your holdings — balances, positions, and credentials — stays in Brazil.

6. How long we keep it

For as long as your account exists. Survey responses and feedback are kept for up to 24 months, or until you delete your account — whichever comes first.

You can remove an exchange credential at any time, and it is erased immediately.

7. Deleting your account

You can delete your account inside the app, under Settings, or request deletion at bipview.com/excluir-conta — without needing the app installed and without talking to anyone.

Deletion erases everything: your account data, your exchange credentials, your wallet addresses, your positions, your survey responses, and your login. It is immediate and irreversible — there is no recovery period, which is why the app asks for an explicit confirmation.

If you have an active subscription, also cancel it in the store (Google Play or App Store), because billing is controlled by the store, not by us.

8. Your rights

The LGPD (Brazil's General Data Protection Law) guarantees that you may, at any time:

• Know whether we process your data and access it
• Correct incomplete or outdated data
• Request anonymization, blocking, or deletion
• Request portability to another provider
• Withdraw consent
• Be informed about who we share your data with
• File a petition with the ANPD (Brazil's National Data Protection Authority) if you believe your rights have not been met

To exercise any of them, write to privacidade@bipview.com. We respond within the period set by law.

9. Automated calculations

BipView automatically calculates a risk score (0 to 100) and tax estimates. The score describes the concentration and composition of your portfolio — it is not a buy or sell recommendation, and BipView does not provide investment advisory services.

You may request an explanation of the criteria behind these calculations at the email address above, under Art. 20 of the LGPD.

10. Security

• All traffic between the app and our servers is encrypted (HTTPS)
• Exchange credentials are encrypted with a key managed in AWS KMS
• Your session is kept in the secure vault of the operating system (Keychain on iOS, Keystore on Android), accessible only when the device is unlocked
• Each customer sees only their own data — the isolation is verified by automated tests
• Our technical logs do not store request content, only the error type

No system is immune to incidents. If one occurs that could pose a relevant risk to you, we will notify you and the ANPD, as required by Art. 48 of the LGPD.

11. Children and adolescents

BipView is not intended for anyone under 18, and we do not intentionally collect data from children or adolescents.

12. About the tax information

BipView's tax calculations are estimates for personal organization. They do not replace your accountant, do not constitute tax advice, and do not serve as an official document for the Receita Federal (Brazil's federal tax authority).

13. What BipView does not do

BipView does not buy, does not sell, does not transfer, and does not hold in custody virtual assets. We have no access to your coins and cannot move them — the keys we use are read-only, and we never hold your private key.

14. Changes to this policy

If we change anything material, we will notify you in the app or by email before the change takes effect. The date of the current version is always at the top of this page.

BIPVIEW SISTEMAS LTDA · CNPJ 63.306.772/0001-76 · Porto Alegre/RS