Chat now
Back to site

Privacy Policy

Last reviewed: September 25, 2026

This Policy describes how Bossa Companion (“Bossa Companion”, “we”, “our”, “us”) handles the personal data of users (“User”, “you”, “data subject”) of the Bossa Companion platform (the “Platform”), in compliance with Law No. 13,709/2018, the Brazilian General Data Protection Law (LGPD), the Brazilian Internet Civil Framework (Law No. 12,965/2014), Law No. 15,211/2025 (the Digital ECA) and Decree No. 12,880/2026.

1. Controller and Data Protection Officer (DPO)

Controller: Bossa Companion.
Data Protection Officer (DPO): dpo@bossacompanion.com.

2. What data we collect

2.1 Account data

  • Display name, email and password (the latter stored encrypted);
  • Declared date of birth (later validated by age verification, see item 4);
  • Language preferences and account settings.

2.2 Usage data

  • IP address, device type, operating system, browser;
  • Access records (date, time and resource accessed), retained for a minimum of 6 months under Art. 15 of the Internet Civil Framework;
  • Aggregate usage metrics (messages sent, tokens consumed and so on).

2.3 User Content and content derived from it

(a) What you provide

  • The messages you send in a conversation, including text you write to steer a scene or a roleplay;
  • The prompts you write to generate an image;
  • Companion personalisation settings, such as the tone of the relationship and the context of the scenario;
  • The choices and the name you give when creating a Character;
  • Facts about yourself that you choose to state in a conversation, such as your name, your routine or your preferences. You are not required to provide any of this, and the Platform works without it;
  • Corrections, edits and instructions you give during the conversation.

(b) What is generated for you

  • The Companions' replies in the conversation;
  • The images generated from your prompts, together with their generation parameters.

(c) What is derived from the above

To sustain conversational continuity between sessions, the Platform derives further data from the content in (a) and (b):

  • Memory summaries, that is, short records of what a Companion should remember about the relationship. You can view and delete these, one by one or all at once, at any time on each Companion's profile;
  • Vector representations (embeddings) of conversation excerpts, used to retrieve relevant context. An embedding is a mathematical representation from which the original content is not directly legible, but which we treat as personal data for every purpose in this Policy;
  • Relationship state, such as progression and preferences observed within the conversation itself;
  • Moderation and safety signals, such as the classification outcome of a message or an image and the record of any block, retained under item 8.

(d) Technical records of the interaction

Date and time of each message, message and credit counts. These serve to operate the Platform, apply plan limits and investigate faults and abuse.

(e) Data about other people

If you enter data about a third party in a conversation – a name, a description or any other detail about a real person – that data is treated under this Policy as User Content, is not used to build any profile of that person and follows the retention periods in item 8. We ask that you do not enter data about third parties. If you are a third party and believe content on the Platform contains data about you, write to abuse@bossacompanion.com.

(f) What we do not collect

The Platform has no media upload. We do not receive photographs, videos, audio or files from your device, nor do we access your camera, microphone, contacts or location.

2.4 Payment data

Card data is sent over an encrypted connection to the authorised payment processor, which stores it. We do not keep the card number or security code. For Automatic Pix, the name and CPF of the person authorising the debit are sent to the processor, as required by Brazil's Central Bank, and are not kept by us either. We receive only transaction identifiers and the status, for tax and anti-fraud purposes.

2.5 Age verification data

Verification is carried out by an independent specialist provider. We neither receive nor store the document image or the selfie. We receive only the binary result (approved or declined) and an anonymous identifier for the verification, for audit.

2.6 Content report data

When you open a report through the in-app channel, we record your Account identifier, the reported target, the reason, the description you write and the network data of the request (IP address and user agent). The network data serves exclusively to prevent abuse of the channel. The report itself, and the decision taken on it, constitute the record of diligence of the Platform (see item 8).

2.7 Push notifications

If you allow notifications in your browser, we store the subscription endpoint provided by your browser and the cryptographic keys that allow the message to be delivered. They serve only to send Platform notices and are deleted when you revoke the permission in your browser or turn notifications off in the app.

3. Sensitive personal data

Given the nature of the Platform, we process two categories of sensitive personal data, as defined by LGPD:

  • Data concerning sexual life, arising from use of adult mode, from erotic conversations and from the preferences you express when personalising the Companions;
  • Biometric data, used exclusively during age verification, processed by the certified provider and not stored by Bossa (see item 2.5 and the Age Verification Policy).

Under LGPD, this data is processed on the basis of your specific and highlighted consent, for the purposes stated herein. The processing of biometric data is additionally based on protection of the life and physical safety of the data subject and of third parties and fraud prevention and the security of the data subject in identification and authentication processes for registration in electronic systems, combined with the legal age verification obligation of Law No. 15,211/2025.

Highlighted notice: age verification and the processing of the sensitive data described above are an indispensable condition for providing the adult mode of the Platform. You may exercise the rights set out in LGPD at any time (see item 9), including withdrawing consent, in which case access to adult content ends while use of neutral mode is preserved.

We do not use sensitive data for advertising, behavioural profiling for third parties or any purpose other than those declared here.

4. Legal bases for processing

  • Specific and highlighted consent (Art. 11, I): sensitive data (sexual life and verification biometrics);
  • Protection of life or physical safety (Art. 11, II, “e”): age verification biometrics;
  • Fraud prevention and security in registration identification and authentication (Art. 11, II, “g”): age verification biometrics;
  • Performance of the contract (Art. 7, V): maintaining your account and operating the Platform;
  • Compliance with a legal obligation (Art. 7, II): logs, tax retention, age verification;
  • Legitimate interest (Art. 7, IX): security, fraud prevention, content moderation;
  • Legitimate interest (Art. 7, IX, and Art. 10): news and invitations sent to registered users, with a documented balancing test and an opt-out in every email and in your profile.

5. Purposes of processing

  • Providing and operating the Platform, authenticating your Account and processing payments;
  • Ensuring legal compliance (age verification, log retention, tax obligations);
  • Moderating content and protecting the Platform against abuse and fraud;
  • Receiving, investigating and deciding content reports, and preserving the evidence of that investigation;
  • Improving models, features and the user experience, wherever possible with aggregate or anonymised data;
  • Communicating changes to the Terms, to policies and news about the Platform, and sending invitations and news by email to registered users (you can opt out at any time).

6. Sharing with third parties

We share data only with strictly necessary processors, grouped into the following categories:

  • Age verification, a provider specialised in document and biometric analysis;
  • Payment processing, an authorised payment institution;
  • AI content generation, providers of language and image models;
  • Content moderation, specialised tooling for detecting unlawful material and for safety classification;
  • Automated account review, an artificial intelligence tool that re-examines, without any identification of you, the automatic suspension of an Account;
  • Media delivery (CDN), a content delivery provider with access control;
  • Cloud infrastructure, storage and computing;
  • Observability and monitoring, operational logs, metrics and alerts.

An up-to-date list of sub-processors is available on request to support@bossacompanion.com. We do not sell personal data. Disclosure to authorities occurs only under a legal order, a reasoned administrative request or an imminent risk to life.

What we send to generation and moderation providers carries no identifier. We send only the content needed to produce the response, such as the scene text and the character's reference images. We do not send your name, e-mail, Account identifier or any data that would let those providers link that content back to you. Requests originate from our infrastructure, under our own credentials.

Those providers may in turn rely on their own model suppliers, which may retain the content they receive for a limited period under their own security and abuse-prevention policies. Because that content reaches them without any identifier of yours, it is not associable with your Account.

7. International transfers

Some processors are based outside Brazil. Transfers take place under LGPD Art. 33, on the basis of standard contractual clauses, equivalent protection safeguards or countries with an adequate level of protection, and are always limited to the minimum necessary to provide the service.

8. Retention

There is no single fixed period. Data is kept only for as long as necessary to fulfil the purpose that led to its collection and is deleted thereafter, unless a legal, contractual or regulatory retention obligation applies. In practice:

  • Account data: for 6 months from the Account deletion (Art. 15 of the Internet Civil Framework);
  • Access logs: at least 6 months from the Account deletion;
  • Tax records: for the minimum legal period (usually 5 years);
  • Age verification confirmation: for as long as the Account exists, for audit;
  • Conversation messages: kept while the Account exists, and removed when the User deletes the message, the conversation or the Account. Photos and videos generated at the User's request: kept in the gallery while the Account exists, and removed when the User deletes the conversation, the photo, the video or the Account. What the companion remembers is kept as a short summary that User can view and delete at any time;
  • A Character created by the User, with her choices and photos: while the Account exists, and removed when the User deletes the Character or the Account;
  • A message refused by content moderation: an encrypted copy is kept for up to 180 days, even if the User deletes the conversation, for the safety of the Platform and the regular exercise of rights (Art. 16, I, LGPD);
  • Backups: up to 90 days after deletion from the primary database;
  • Network data of whoever files a report (IP and user agent): 180 days;
  • Record of the report and of the decision taken: 5 years after the decision, as evidence of diligence. Reports involving a child or adolescent are not deleted on an automatic schedule, as they constitute evidence in any authority proceeding;
  • Push notification subscription data: for as long as the permission is active.

9. Data subject rights (LGPD Art. 18)

  • Confirmation that processing exists;
  • Access to the data;
  • Correction of incomplete, inaccurate or outdated data;
  • Anonymisation, blocking or deletion of unnecessary or excessive data;
  • Portability;
  • Deletion of data processed on the basis of consent. Deletion covers, in full, the data under our control. Content already sent to generation or moderation providers follows their own retention periods and, carrying no identifier of yours, is not associable with you (item 6);
  • Information about sharing;
  • Withdrawal of consent;
  • Review of decisions taken solely by automated processing (Art. 20), such as the age verification result or the automatic suspension of the Account for repeated breaches of the content rules. You may ask for a review by a person through the support channel and, on request, we explain the general criteria used in the decision, without disclosing the Platform's security mechanisms.

Requests should be sent to support@bossacompanion.com and will be answered within 15 days. We may ask for proof of identity to prevent improper access. You can also exercise the rights of access and deletion directly in the app, under Profile → Privacy and data, confirmed by password and a code sent by email.

10. Security and privacy by design

We adopt technical and administrative measures capable of protecting data from unauthorised access and from accidental or unlawful destruction, loss, alteration or disclosure, including encryption in transit and at rest to market standards, access control restricted by need, continuous monitoring, an integrity-protected audit trail, encrypted backups and periodic security testing.

These measures are considered from the product design phase through to its operation (privacy by design and by default): we collect the minimum data necessary, adult mode stays blocked by default until verification, and document and biometric data are never stored by us. In the event of a relevant incident, we will notify the ANPD and the affected data subjects by a reasonable deadline.

11. Privacy governance and good practice

We maintain a privacy governance programme proportionate to the structure, scale and sensitivity of the data processed, covering:

  • Internal policies and safeguards based on a privacy risk assessment;
  • A designated Data Protection Officer as the channel for data subjects and the ANPD;
  • A record of processing operations and an audit trail of sensitive events;
  • An incident response and remediation plan;
  • Periodic review and updating of these policies, based on continuous monitoring.

12. Minors

The Platform is intended exclusively for people aged 18 and over. Any behavioural profiling of children and adolescents is prohibited. We apply mandatory age verification and the specific policies detailed in the Minors Policy and Age Verification Policy.

13. Cookies and similar technologies

The use of cookies and related technologies is governed by our Cookie Policy. Behavioural analytics is enabled only after completed age verification and explicit consent.

14. Contact and the ANPD

You can contact us at support@bossacompanion.com or, if you prefer, file a complaint directly with the Brazilian National Data Protection Authority (ANPD).