Security

Security and data protection

No data sold Not now, not ever

The short answer (the one you probably want most) is that your data is protected with industry best practices and is used to provide the service you purchased and for the purposes described in the Privacy Policy. Ad measurement depends on your consent and does not use your photos, your health data, or your analysis. We keep the data for as long as needed to deliver your assessment, and we will never put it up for sale.

Photos sold or licensed: 0
Card details stored: 0
Where the data is kept: Brazil and abroad
Data in transit: HTTPS

Storage

Isolated on purpose, not by chance

A deliberate commitment to security.

We do everything we can to protect your data, even in the worst-case scenarios. What you send us is processed by Garbo and by the providers each function requires, listed in the Privacy Policy. This processing may take place outside Brazil, with the safeguards that Brazil's data protection law (LGPD) requires for international transfers.

Encryption
Data travels encrypted (HTTPS) between your device, Garbo, and the providers.
Restricted access
Only the people who keep the service running access the data, under restricted access control.
Providers
We share with the providers listed in the Privacy Policy only the minimum needed for each function.
Incidents
No system is 100% secure. If an incident involving your data could pose a significant risk or harm to you, we will notify you and the Brazilian National Data Protection Authority (ANPD) within the deadlines and under the conditions required by regulation.

Retention and deletion

Your data doesn't last longer than it's useful to you

We keep your photos and analysis data only for as long as needed to deliver and support your analysis.

Active retention
Standard period
Your photos and analysis are kept for as long as your account exists, because access doesn't expire, so you can review your results whenever you like.
Full deletion
On request
Request deletion whenever you like, in the dashboard Settings or by email, and we'll delete your account, your photos, and your analyses within 15 days.
Kept by law
Logs
Application access logs are kept for six months, as required by Brazil's Internet Civil Framework (Marco Civil da Internet), in a protected environment with restricted access. After that they are deleted, unless a legal obligation or a valid preservation request requires a longer period. This period applies to access logs, not to your photos or your health data.