Privacy Policy
NextWish is a social media-curation app: you log what you consumed (films, series, books, music, products and games), give it a rating, write a short review and build a public "taste profile". This Privacy Policy explains what personal data we process, why, on what legal grounds, who we share it with, and what your rights are.
This policy is written to comply with Brazil's General Data Protection Law (LGPD, Law No. 13.709/2018) and the European Union's General Data Protection Regulation (GDPR, Regulation (EU) 2016/679). By creating an account and using NextWish, you confirm that you have read and understood this document.
1.Controller and contact
The controller of your personal data is LUCAS GARCIA SCAPIN CONSULTORIA EM TECNOLOGIA DA INFORMACAO LTDA - ME, registered under CNPJ No. 52.802.823/0001-34, responsible for deciding how and why your data is processed on NextWish.
For any privacy question, to exercise your rights, or to reach our Data Protection Officer (DPO), write to contact@nextwish.app. This is the official point of contact for data protection matters.
2.Data we collect
Account data: email and password (stored hashed/encrypted by our authentication provider) or Google sign-in; @username, display name, avatar image and profile color.
Birthdate: collected for age verification. It is stored in a private, owner-only table and is not shown to anyone else.
Content you create: logged items (title, type, rating, review, dates, favorite flag), collections, who you follow, and recommendations sent and received.
Social and usage data: followers, profile visits (who viewed your profile) and achievements/gamification. Device push tokens, only if you enable notifications.
Payment: processed by Stripe. We store only Stripe customer/subscription identifiers and subscription status. Card data never touches our servers. Technical data: IP address (for rate limiting and abuse prevention), session cookies (authentication) and a Cloudflare Turnstile anti-bot token.
3.How we use your data
Provide and operate the service: create and maintain your account, display your profile and content, and let you log items, build collections, and manage your queue and archive.
Authentication and security: verify your identity at login, keep your session, apply rate limits, and prevent fraud, spam and abuse (including via IP and Turnstile).
Personalization and social features: build your taste profile, show followers and profile visits, generate achievements, and enable user-to-user recommendations.
Notifications: send push notices to your registered devices when you enable that option. Billing: manage your Premium subscription through Stripe.
Legal compliance: meet legal and regulatory obligations and respond to requests from competent authorities.
4.Legal bases for processing
We process your data only when a legal basis exists. Performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)): creating and maintaining your account, operating the service, authenticating access and processing your Premium subscription.
Consent (LGPD art. 7, I; GDPR art. 6(1)(a)): sending push notifications and, where applicable, the optional Google sign-in. You may withdraw consent at any time, without affecting prior processing.
Legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)): security, fraud and abuse prevention, rate limiting, personalization and social features, and service improvement, always balanced against your rights and freedoms.
Legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)): retaining records and meeting legal, tax and regulatory requirements.
6.International transfers
Some of our sub-processors are located in the United States and other countries. As a result, your data may be processed outside Brazil and the European Economic Area.
In these cases, we rely on appropriate safeguards required by the LGPD and the GDPR, such as Standard Contractual Clauses and other recognized mechanisms, to ensure a level of protection comparable to that of your jurisdiction.
7.Data retention
We keep your personal data while your account is active and needed to provide the service.
When you delete your account, your data is removed via cascade, covering your profile, content, collections, followers and other associated records. Backups containing this data are purged within a reasonable period, in line with our rotation cycle.
We may retain certain information for longer where required by a legal obligation, or to establish or defend rights in legal proceedings, always limited to what is strictly necessary.
8.Security
We apply technical and organizational measures to protect your data. Database access is restricted by Row-Level Security, ensuring each user can only access the data they are entitled to.
Communications travel over HTTPS, with encryption in transit. Sensitive data, such as your birthdate, is kept in private tables accessible only to the owner. Passwords are stored hashed by our authentication provider, never in plain text.
No system is entirely free of risk. If we identify a material security incident, we will take appropriate measures and make the notifications required by applicable law.
9.Your rights
Under the LGPD (art. 18) and the GDPR, you have the right to: confirmation of and access to your data; correction of incomplete or outdated data; anonymization, blocking or deletion of unnecessary or unlawfully processed data; portability; and information about who we share your data with.
You may also: request deletion of data processed on the basis of consent; restrict or object to certain processing; and withdraw consent at any time, without affecting the lawfulness of prior processing.
To exercise any of these rights, use the options available in the app (Settings) or write to contact@nextwish.app. We will respond within the timeframes set by applicable law.
If you believe your rights have not been respected, you may lodge a complaint with Brazil's National Data Protection Authority (ANPD) or with an EU supervisory authority.
10.Account deletion
You can delete your account at any time directly in the app, under Settings, or by requesting it via email at contact@nextwish.app.
When you delete your account, we remove your profile and associated data via cascade, including content, collections, followers and recommendations. Backups that still contain this data are purged within a reasonable period.
Some information may be kept only where a legal retention obligation applies, always limited to what is strictly necessary.
12.Children
NextWish is not directed to children under 13, and we do not knowingly collect their data. Users in the European Union must be 16 or older; below that age, a parent's or guardian's consent or authorization is required, as provided by local law.
We collect birthdate to apply this age-gate. If we learn that an account was created contrary to these requirements, we will take steps to remove it. Parents or guardians may contact us at contact@nextwish.app.
13.Changes to this policy
We may update this Privacy Policy to reflect changes in the service, in the law, or in our practices. When changes are material, we will notify you by appropriate means, such as an in-app notice or by email.
The date of the current version is always shown at the top of this document. Continued use of NextWish after an update means you are aware of the revised version.
14.How to contact us
For questions about this policy, to exercise your rights, or to reach our Data Protection Officer (DPO), write to contact@nextwish.app.
Controller: LUCAS GARCIA SCAPIN CONSULTORIA EM TECNOLOGIA DA INFORMACAO LTDA - ME, CNPJ 52.802.823/0001-34. We will do our best to respond clearly and within the timeframes set by applicable law.