CHEGA+ PRIVACY POLICY
Version 1 — in force from September 2, 2026. This version fully replaces the previous policies, both the one published on the website and the one shown inside the app.
This Privacy Policy (“Policy”) explains what we do with your personal data: what we collect, why we collect it, who we share it with, how long we keep it and what you can demand from us at any time.
It applies to the Chega+ app, to the chegamais.app website and to all related services (together, the “Platform”). It forms part of the Terms of Use and must be read together with them. Whenever the Terms mention personal data, the detail is here.
We wrote this document for whoever organizes matches (“pelada”, a Brazilian pickup game), not for lawyers. We know that reading this is tiring, so we were as direct as we could be. If you still have questions, talk to us through the channels in section 1.
The summary below is only a guide and does not replace reading the full text:
a) We do not sell, do not rent and do not assign your personal data. The previous version of this Policy said that we could commercialize it. That authorization has been removed and no longer applies.
b) Performance tracking is optional and comes turned off. Heart rate is health data and is only collected if you use a smartwatch and authorize it.
c) Your GPS coordinates are not kept. They go into the calculation and are discarded. What stays are the numbers of your performance.
d) We do not read your device’s contact list, we do not read your phone line number and there is no exchange of private messages between users on Chega+.
e) You can delete your account inside the app. Not everything disappears, and section 21 says exactly what remains and why.
f) You can ask for access, correction, a copy, deletion and an explanation about any data of yours, and we reply within 7 days.
g) One detail we would rather state: although the screens show only your age, and the Birthdays screen only the day and the month, our servers still deliver your full date of birth, with the year, to the app of whoever is looking. It is in clause 11.1, and we are fixing it.
When this Policy mentions “we” and “our”, it refers to CHEGAMAIS PROVEDOR DE CONTEUDO LTDA. When it mentions “you” and “your”, it refers to the User.
1. WHO WE ARE, WHO THE ENCARREGADO (DATA PROTECTION OFFICER) IS AND HOW TO CONTACT US
1.1 The Platform is provided by CHEGAMAIS PROVEDOR DE CONTEUDO LTDA, a limited liability company registered with CNPJ under no. 31.552.846/0001-68, with head office at Rua General Espírito Santo Cardoso, nº 342/101, Tijuca, Rio de Janeiro/RJ, CEP 20530-500.
1.2 We are the controller of your personal data. That means it is we who decide what is collected, what for and for how long, and it is from us that you can demand answers.
1.3 Our support channels are:
a) E-mail: suporte@chegamaisapp.com
b) WhatsApp: +55 21 4121-2456, also reachable through the “Contact Us” item in the app menu.
1.4 The Encarregado for the Processing of Personal Data is Rodrigo de Medeiros Manguinho. To reach him, write to suporte@chegamaisapp.com with the subject “Encarregado — LGPD”: that is the channel provided in clause 1.2, item c, of the Terms of Use, and it is through it that your requests reach the Encarregado. The Encarregado is the person responsible for receiving your requests, guiding whoever works with us and speaking with the Autoridade Nacional de Proteção de Dados (Brazil’s National Data Protection Authority, “ANPD”).
1.5 We confirm receipt of every request and reply within 7 (seven) days. When the Lei Geral de Proteção de Dados (General Data Protection Law, “LGPD”) requires a shorter deadline for a specific request, the deadline in the law applies.
1.6 This Policy is available inside the app in Portuguese, English, Spanish, French and German, and, for reading without an account, at https://www.chegamaisapp.com/legal/privacidade, in the same five languages. When there is no version in your language, the English version is shown. The Portuguese version is the one that prevails. You can save it, print it or ask for a copy by e-mail, free of charge.
2. WHAT THIS POLICY COVERS
2.1 This Policy covers the processing of personal data that we carry out in the Chega+ app, on the chegamais.app website and in the related services.
2.2 This Policy forms part of the Terms of Use. If there is any discrepancy between versions of this Policy published in different places, the interpretation most favourable to you prevails. If there is any discrepancy between this Policy and the Terms of Use, whichever is more favourable to you prevails; in matters of personal data, the detail of this Policy prevails over the summary in the Terms, except where the Terms guarantee you more.
2.3 Some features open third-party services, which have policies of their own and answer for what they do with the data you give them. As to what we do with your data, this Policy prevails.
2.4 The words with an initial capital letter — User, Member, Group, Administrator, Event or Match, Professional, Hirer, Subscription and Content — have the meaning given in section 3 of the Terms of Use.
3. WHAT DATA YOU GIVE US
3.1 To create the account we ask for a name and an e-mail. Access is by e-mail with a verification code, by Google account or by Apple account. Your account has no password, and for that reason we do not store any password of yours.
3.2 The other profile data are optional and serve to organize the matches, build the rankings and allow your Group to get in touch with you. They are: photo, position, date of birth, city and state, gender, marital status, whether you have children, WhatsApp, favorite team, preferred foot, height, weight and shoe size. Height and weight are information about your body and filling them in is your choice. The date of birth has one further use, described in section 6: if you turn on performance tracking, it goes into the calculation of the effort zones and of the calories.
3.3 The emergency contact (name, phone number and relationship) is optional. It exists for the case of an accident or of someone feeling unwell during the match, and it is accessible only to the Administrators of your Group. As this is another person’s data, tell whoever you register. If you were registered as someone’s emergency contact and do not want to be here, ask for deletion through the channels in section 1: we comply without requiring you to create an account, and we tell you what data we have and who registered it. The legal basis for this processing is in clause 10.1, item l.
3.4 Inside the Group, the game data are recorded: your attendances and absences, the reasons you write, goals and other statistics, the ratings you give to the other players, the veto and the internal votes that the Group enables, as well as the notices, polls, comments and photos you post. The rating you give is stored together with the identification of who voted, and that is what makes it possible to calculate the final rating in the manner of section 16.
3.5 If you use the voice commands during the match, the microphone is switched on and the audio is converted into text by the speech recognition service of your device’s system. Depending on the device and on your settings, that service may send the audio to Apple’s or Google’s servers to do the conversion — that step is theirs and follows their policy, in the manner of clause 12.1, item l. We do not record and do not keep the audio: we receive only the resulting text, which is sent for interpretation in the manner of clause 12.1, item h.
3.6 When you talk to us, we keep the content of the conversation and whatever you send with it.
3.7 The payment data — the CPF of whoever pays and, for whoever registers as a Professional, the package of information required by the payment institution — are described separately in section 7.
4. WHAT DATA WE COLLECT AUTOMATICALLY
4.1 About your device and the app, we collect: the platform (iPhone or Android), the app version, the language, the date of your last access and the identifier that allows notifications to be sent to your device. The operating system version is recorded only in two cases: in the technical diagnostics of performance tracking, when you turn it on, and on the click of an invitation link to a Group.
4.2 About usage, we collect technical logs of the requests the app makes to our servers — what was requested, the result, how long it took and the internal identifier of your account — as well as error and crash reports from the app and from the server.
4.3 As to the IP address, the following applies, and the treatment is different in each case:
a) On login attempts, we keep the IP address together with the e-mail entered, in order to prevent mass-attempt attacks. That record is deleted within 24 hours.
b) When an IP is blocked for abuse, the block is also deleted within 24 hours.
c) When someone clicks an invitation link to a Group, we do not keep the IP address: we keep only a cryptographic hash of it, which does not allow anyone to get back to the number. That record is deleted within 7 days.
d) The ordinary log of requests to the server does not record an IP address. For that reason we do not keep an application access log linked to an IP address outside the two short windows described in items a and c. The previous policy, published on the website, said that we kept those logs for 6 (six) months; that does not match what the system does, and we would rather tell the truth than repeat the sentence.
4.4 We also count how many accesses there were per day and per platform. That number is aggregated and does not identify anyone.
4.5 As to the use of the app, a usage measurement service records, linked to the internal identifier of your account, a stream of behavior events — which screens you open, when a tracking session starts and ends, when you open a subscription screen, when you complete a purchase, when you accept or refuse a Group invitation. The detail of what goes out, to whom and for what purpose is in clause 12.1, item c, and in section 20.
4.6 Performance tracking has rules of its own and is in section 6.
4.7 To leave no doubt, here is what we do NOT collect, despite what the previous policy said:
a) We do not access and do not read your device’s contact list. The app does not even ask for that permission.
b) We do not read your phone line number on the device. The WhatsApp number you register is the one you typed in yourself; where it is shown is set out in clause 11.4.
c) There is no exchange of private messages between users on Chega+, so we have no copies of any messages of yours.
d) We do not keep your phone model, browser data or data about your mobile carrier in our databases. The only exception is the smartwatch: if you connect one, we keep the name of its model and whether it has GPS and a heart rate sensor, so as to know what can be measured and to show the source of the data on the screen. When you disconnect the watch in the app, that record is deleted. The usage measurement and crash reporting services mentioned in section 12 collect, on their own account, the standard technical data of the device, such as model and system version.
e) The app does not use cookies, in the manner of section 20.
5. WHAT DATA WE RECEIVE FROM OTHER PEOPLE AND FROM OTHER SERVICES
5.1 A Group’s Administrator may pre-register a player who does not yet have the app, providing a name and an e-mail and, if they wish, a nickname, a position and a photo. Whoever does this states that they have that person’s authorization — and that statement is the responsibility of whoever makes it, it is not your consent. If you were pre-registered and do not want to be on the Platform, ask for deletion through the channels in section 1: we comply without requiring you to create or keep an account, and we tell you what data we have about you and who registered it. The legal basis for this processing is in clause 10.1, item l.
5.2 Other Members and Administrators record data about you in the Group: attendances, game statistics, ratings, the nickname you are called by there and photos from the galleries.
5.3 If you sign in with a Google account, we receive from Google your e-mail, your name and an identifier. If you sign in with an Apple account, we receive from Apple an identifier and, on the first authorization, your name and your e-mail, when you choose to share them — the app asks for both. If you use Apple’s “Hide My Email” feature, the address we receive is a relay address generated by Apple, and not your real address; it is treated as your account e-mail for all purposes of this Policy.
5.4 From the app stores and from the service that manages the subscriptions, we receive the purchase confirmation, the subscription status and the receipts.
5.5 From the payment institution, we receive the status of the payment, of the deposit and of the Professional’s identity verification.
6. PERFORMANCE TRACKING AND HEALTH DATA
6.1 Performance tracking is optional and comes turned off. To turn it on, you must give a specific consent, presented on its own screen, with version and date recorded. We keep the history of the times you granted and withdrew that consent, as proof that it existed. You may withdraw it at any time in the tracking settings and in your device’s permissions.
6.2 With tracking on, we measure during the match:
a) By the device’s GPS: distance covered, average and maximum speed, sprints, time in movement and time stationary, and the heat map of your movement on the field.
b) By the smartwatch and by the device’s health app — Apple Health (HealthKit) on the iPhone and Health Connect on Android —, if you use a compatible watch and authorize the reading: average and maximum heart rate, effort zones, estimated calories and step count. On Android, when the watch is the source, the path itself used in the heat map is also read from the health app. To calculate the effort zones and the calories we also use your date of birth, because these estimates depend on age; without it, we show only the heart rate.
c) When you connect a smartwatch, we keep the name of its model and which sensors it offers (GPS and heart rate), so as to know what can be measured and to show on the screen the source of the data. When you disconnect the watch in the app, that record is deleted.
6.3 Heart rate, effort zones and calories are sensitive personal data, because they concern your health. The legal basis for processing them is your specific and highlighted consent, in the manner of art. 11, I, of the LGPD. Without that consent, these data are not collected.
6.4 Your GPS coordinates and the heart rate readings are not kept. They are used for the calculation and discarded. What we keep are the resulting numbers and the heat map, and that map contains only positions relative to the mid-point of your own movement in that match: there is no geographic coordinate in the map, and on its own it does not reveal where you were. As the address of the field of that match is registered by the Administrator (clause 8.1), that address remains the address of the game, and not yours: the map adds no information about where you live, where you work or where you move about outside the match.
6.5 Collection happens only in the window around the game time. It may happen with the app in the background, and in that case your device shows the notice that tracking is active.
6.6 Who sees these data: when the Group is PRO, or when you are a Player Partner, the other Members of that Group see your performance indicators, including your heart rate, your effort zones, your calories and the heat map. Outside those conditions, these data are not shown to the other Members. Today it is not possible to measure without displaying: if you do not want that sharing, keep tracking turned off.
6.7 Health data are never used for advertising, marketing or product offers, and are never sold. The data read from HealthKit and from Health Connect are never used for those purposes and are not shared with third parties for them. The heart rate readings, the effort zones and the calories stay only in our databases: none of these values is sent to the processors in section 12. To the usage measurement service we send only technical metadata of the session — whether tracking was turned on, how long it lasted, how many GPS points and how many heart rate readings were collected, whether there was a sending failure and what type of device was used —, never the numbers of your performance nor the readings themselves. The raw heart rate readings and the GPS coordinates are automatically removed from our technical logs and from the error reports.
6.8 Chega+ is not a medical device. The numbers are estimates from your device’s sensors and are not for diagnosis or for clinical guidance.
6.9 You may delete only the performance data, without deleting the account, under Profile, then Account. You may also ask for a copy of them through the channels in section 1, and we send it in a readable format.
6.10 These data do not expire on their own. They stay stored for as long as your account exists, or until you delete them. If you delete the account, they are deleted along with it.
7. PAYMENTS, CPF AND PROFESSIONAL REGISTRATION
7.1 There are two situations in which real money is involved: Subscriptions and the hiring of a Professional. The Group’s financial management is not one of them — there the entries are notes made by the Administrator or by the Treasurer, and no money passes through us.
7.2 CPF of whoever pays. The payment institution requires the payer’s CPF on every PIX charge. We keep that CPF in encrypted form, so as not to have to ask for it again on each hire, and it is only decrypted at the exact moment of generating the charge. It never appears in our technical logs. The legal basis is the performance of the contract and compliance with a legal and regulatory obligation.
7.3 Professional registration. If you register to provide a paid service, the payment institution requires, by force of the regulation of payment methods and of money laundering prevention, a larger set of data: name, e-mail, CPF, date of birth, declared monthly income, occupation, phone number, full address and your bank account details. We collect these data on the registration screen and transmit them to the payment institution. We do not keep, in our database, your bank account, your income, your occupation or the address in the bank registration. Of your CPF, we keep only an irreversible code, which serves only to prevent someone from hiring themselves. If that screen fails in the middle of the submission, what you filled in does not go to the technical error report described in clause 12.1, item i: the sending of the body of requests to that service is switched off. The legal basis is compliance with a legal and regulatory obligation.
7.4 Liveness Check. The facial verification required in that registration is done inside the payment institution’s environment, by means of a link that it generates itself. We do not receive and do not store the image of your face. We receive only the result: approved, refused or pending.
7.5 To register as a Professional and receive payments you must be 18 years of age or older, and this is verified at that moment.
7.6 The Professional’s public profile. Whoever is looking to hire sees your name, your photo, your age, your description, the services you provide, the reference price for each one and how much you receive after our commission, your neighborhood, your average rating and the ratings by rating criterion, the number of ratings, the number of jobs you have already completed, your attendance rate, the date on which you created your professional profile, whether you are a Player Partner, whether your identity has been verified and, on the search screen, how far you are from the venue of the game. They also see the comment written by whoever has hired you, identified by the role and by the date, without the name of the person who rated. The coordinates of your service base and the radius you set are not shown: they are used only to calculate distance and to decide which vacancies appear to you. Suspensions and other penalties appear for as long as they last. If a comment about you is offensive, unfair or violates your rights, ask for a review through the channels in section 1.
7.7 After the payment for a hire is confirmed, both sides start seeing each other’s WhatsApp, so they can arrange that service. That contact must be used only for that.
7.8 Subscriptions. To manage the subscriptions, the service that handles that control receives your e-mail, your name, your account identifier and the receipt issued by the app store. The identifier of the linked Group does not go to that service: it goes to the crash reporting service, in the manner of clause 12.1, item c.
8. LOCATION
8.1 Your Group’s field location. It is provided by the Administrator; it is not yours. We store the address, the coordinate and the neighborhood, and we use that for the proximity search, for the weather forecast for that game and to sort Mercado da Bola (our discovery feed for groups and vacancies).
8.2 Your device’s location in the search. When you look for groups or vacancies near you, your location is used at that moment to calculate the distances. It is not recorded in your profile.
8.3 Location during the match. This only happens if you have turned performance tracking on, as set out in section 6.
8.4 The Professional’s service base. If you register as a Professional, the location you set as your base and the radius you choose are stored in your professional profile, together with city and neighborhood. That is what decides which vacancies appear to you and in what order you appear to whoever is hiring. You can change that location or delete the professional profile whenever you want.
8.5 Weather forecast. We send the forecast service only the coordinate of the Group’s field and the time of the game. It is the coordinate of the place where the match is played, provided by the Administrator; your device’s location is never sent to that service.
9. PHOTOS AND CONTENT YOU POST
9.1 The images sent to the app — profile picture and galleries — are hosted on a storage service and are displayed through a direct address. The address is random and hard to guess, but anyone who has that address can open the image even without an account on Chega+. Bear that in mind when deciding what to post.
9.2 Removing the photo inside the app stops it being displayed on the Platform. To also ask for the file to be removed from the storage, use the channels in section 1. Backup copies and copies that other people have already saved on their own are not reached.
9.3 The Administrator may set your photo inside the Group. If you do not agree, you can change it or ask for it to be removed, either through the app or through the channels in section 1.
9.4 If any content posted about you — photo, nickname, comment or rating — is offensive, discriminatory or violates a right of yours, report it through the channels in section 1. We look into it and may remove it. The same applies if you are contacted in an unwanted way, harassed or pestered by another User using data obtained on the Platform: we investigate the case and may suspend and terminate the account of whoever acted that way, as well as refer the case to the competent authorities when appropriate.
10. WHAT WE USE YOUR DATA FOR AND ON WHAT LEGAL BASIS
10.1 Every time we process data of yours, there is a purpose and an LGPD legal basis behind it. This is the complete map:
a) Creating and keeping your account, authenticating access and operating the app. Legal basis: performance of the contract (art. 7º, V).
b) Organizing the matches: invitations, attendance confirmation, team draws, statistics, ratings, rankings, highlights and the Group’s financial management. Legal basis: performance of the contract (art. 7º, V).
c) Sending notifications about your match, your Group and your account. Legal basis: performance of the contract (art. 7º, V).
d) Measuring your performance by GPS. Legal basis: consent (art. 7º, I). Measuring heart rate, effort zones and calories. Legal basis: specific and highlighted consent for health data (art. 11, I).
e) Processing payments, intermediating the hiring of a Professional, registering the Professional with the payment institution and complying with the identity verification required by regulation. Legal basis: performance of the contract (art. 7º, V) and compliance with a legal and regulatory obligation (art. 7º, II, and art. 11, II, “a”).
f) Keeping the Platform secure: preventing mass login attempts, blocking abuse, detecting fraud, applying the anti-fraud limits in clause 16.1, item g, investigating reports and looking into breaches of the Terms. Legal basis: legitimate interest (art. 7º, IX).
g) Understanding how the app is used, fixing errors, measuring technical performance and improving the service. This includes the stream of usage events described in clause 4.5 and the device’s advertising identifier, used only to make that measurement possible, as set out in section 20 — never to hand you over to an advertiser. Legal basis: legitimate interest (art. 7º, IX).
h) Displaying notices and offers inside the app and sending promotional communications. Legal basis: legitimate interest (art. 7º, IX), with a right to object as set out in section 20.
i) Responding to your requests, complying with a legal obligation, meeting a request from an authority and defending our rights in administrative or court proceedings. Legal basis: compliance with a legal obligation (art. 7º, II) and regular exercise of rights (art. 7º, VI).
j) Keeping the emergency contact so that it can be used in case of an accident during the match. Legal basis: protection of life and physical safety (art. 7º, VII, and art. 11, II, “e”).
k) Keeping the entries in the Group’s cash after you delete your account. Legal basis: regular exercise of rights and the Group’s legitimate interest in preserving the integrity of its own cash (art. 7º, VI and IX).
l) Keeping the data of three people who do not have an account on Chega+: the player pre-registered by an Administrator; the emergency contact provided by a Member; and the guest a Member brings to a match, whose name and participation in the game we record. We keep it until the person creates an account, asks for deletion or the link comes to an end. None of the three has a contract with us, and the statement of authorization given by whoever registered them is not their consent. Legal basis: legitimate interest (art. 7º, IX), in the Group’s interest in organizing the match and, in the case of the emergency contact, also the protection of life (art. 7º, VII). We assessed that the processing is limited to the minimum, that it is what the person would expect from someone who already plays with them, and that they can leave at any time through the channels in section 1, without having to create an account. The guest’s name is also sent to the service that interprets the voice commands, as set out in clause 12.1, item h.
10.2 When we use legitimate interest, we assess beforehand whether the processing is what you would expect, whether it is limited to the minimum necessary and whether your rights and freedoms do not weigh more than our interest. You may object to any processing based on legitimate interest through the channels in section 1, and we assess the request case by case.
10.3 Consent may be withdrawn at any time, and withdrawing it is as easy as giving it. The withdrawal takes effect from then on and does not make irregular what was done while the consent existed. Refusing the tracking consent does not stop you from using the rest of the app.
10.4 We do not use your data for a new purpose that is incompatible with these without telling you beforehand, as set out in section 22.
11. WHO SEES WHAT INSIDE THE APP
11.1 Inside a Group, the other Members see: your name, your nickname, your photo, your position, your state, your favorite team, your preferred foot, your age, your account e-mail, whether you have ever signed in to the app, your attendance, your game statistics, the ratings you have received and the information that you are a Player Partner. The day and the month of your birthday appear on the Group’s Birthdays screen, and on the date we send a notification to the Members. This needs to be said precisely: although the screen shows only your age, and the Birthdays screen only the day and the month, what our servers deliver to the app of whoever is looking is your full date of birth, with the year. That is more than the screen needs, and we are fixing it.
11.2 In Groups with the financial management turned on, the other Members also see your payment status — whether you are up to date or owing — and the cash entries in your name. The Administrator can hide the financial information from the Members in the Group Settings, and in that case the display is restricted to the Administrator and to the Treasurer.
11.3 The following are not shown to the other Members: your height, your weight, your shoe size, your gender, your marital status, the information about children and your emergency contact.
11.4 Your WhatsApp is not shown on your profile inside the app to the other Members. It is shown in two situations: to the Administrator, on the screen for searching for players to add to the Group — together with your name, your photo, your city and state, the date of your last access and the Groups you take part in —; and, in the hiring of a Professional, to the other party, after the payment is confirmed. Your WhatsApp does not travel in your profile’s data package — neither to the screens nor outside them.
11.5 The emergency contact is accessible only to the Administrators of your Group.
11.6 Performance data follow the rule in clause 6.6.
11.7 The Professional’s public profile follows the rule in clause 7.6.
11.8 Mercado da Bola shows information about the Group, not about you: the Group’s name, the approximate region of the playing location, day and time, number of players and, when registered, the monthly fee amount. The Administrator can turn that display off in the Group Settings.
11.9 Your profile is only delivered to someone who shares at least one Group with you. That applies both to the screens and to the programming interface the app uses to talk to our servers: knowing an account’s identifier is not enough to obtain its data. Trying to get around this rule is a breach of the Terms of Use, subject to suspension and termination of the account and to the applicable legal measures. Beyond what is described in this section and the contact details revealed in a hiring, we do not give one Member another Member’s contact details.
12. WHO WE SHARE YOUR DATA WITH
12.1 We work with companies that carry out parts of the service for us. They are processors: they process your data only in accordance with our instructions, only for the contracted purpose, and they are bound by contract to a standard of protection equivalent to ours. These are all of them, what each one receives and where it is:
a) Pagar.me (Brazil) — payments, Professional registration and deposits. It receives, from whoever pays: name, e-mail, CPF and phone number. It receives, from whoever registers as a Professional: name, e-mail, CPF, date of birth, monthly income, occupation, phone number, full address and bank details. If you have never hired a Professional or registered as one, none of your data goes there.
b) Google, in the notifications service (United States) — receives the device’s notification identifier and the content of the notification sent, which may contain the Group’s name, what happened and amounts.
c) Google, in the usage measurement and crash reporting services (United States) — receives an internal identifier of your account and, linked to it, the platform, your subscription type, the type of device used in tracking and the record of the app’s usage events: the screens you open, the granting and the renewal of the tracking consent, the refusal of a device permission, the scheduling, the start and the end of a tracking session (with the duration, the number of GPS points and heart rate readings collected and the battery level), the connection and the state of the smartwatch, the sending of the data and the failures of that sending, the opening of the subscription sales screens, the start and the completion of a purchase with the amount paid, the currency and the product, the deletion of the performance data and the confirmation or refusal of a Group invitation, with the Group’s identifier. It also receives the app’s error and crash reports, which may contain your account identifier, the identifier of the subscription’s Group and the product involved. We do not send your name or your e-mail, and we never send your performance values or your heart rate readings.
d) Google, in the maps and addresses services (United States) — receives the text you type when searching for a place and, in order to find out the neighborhood, the coordinate of the playing location when the Administrator registers a new field and the coordinate of the Professional’s service base, once for each change.
e) Cloudflare (United States) — stores the images sent to the app.
e.1) Better Stack, the operator of Logtail (United States) — keeps the technical logs of our servers. It receives the method and the address of the request, the result, the duration and an internal identifier of your account. It does not receive the body of the requests.
f) Resend (United States) — sends our automatic e-mails. It receives the destination address and the content of the message, such as the login code.
g) RevenueCat (United States) — manages the subscriptions. It receives your e-mail, your name, your account identifier and the store receipt.
h) Anthropic (United States) — interprets the voice commands during the match. It receives the text of the command and the list of the players on the field at that moment, with name or nickname, team and identifier, including guests who do not have an account on Chega+. The audio is not sent to it: it is converted into text beforehand, as set out in item l.
i) Sentry (United States) — monitors server errors. It receives technical reports that may contain an internal identifier of your account, the method and the path of the request that failed and the type of the error. The body of the requests is not sent, and the address of the request is sent without the part that carries what you typed. Authentication data is erased before sending.
j) OpenWeather (United States) — provides the weather forecast. It receives only the coordinate of the field and the time of the game.
k) Heroku, from Salesforce (application hosting), and MongoDB Atlas (database), both with servers in the United States, in Amazon Web Services’ us-east-1 region, in Virginia — they store the Platform’s data, including the performance and health data in section 6.
l) Apple and Google, in the device’s system speech recognition services (United States) — when you use the voice commands, the audio captured by the microphone may be sent to Apple’s or Google’s servers, depending on your device and your settings, to be converted into text. That conversion is done by them and follows their policy. We do not record and do not keep that audio.
12.2 Apple and Google also appear in another role, that of login platforms and app stores. In those cases the flow is the reverse: we receive data from them, as set out in clause 5.3, and we do not send data of yours.
12.3 Beyond the processors above, we share personal data only in these situations:
a) With the other Users, exactly as described in section 11.
b) With the other party to the hiring of a Professional, after the payment is confirmed.
c) With a police or administrative authority or with the Ministério Público, upon a reasoned request, and only as regards registration data of personal qualification, parentage and address, as set out in art. 10, §3º, of Lei nº 12.965/2014. Connection logs and application access logs, the content of communications and the other personal data are only provided upon a court order. Whenever the law allows it, we tell you before complying with the request.
d) With the Judiciary, upon a court order, and in order to exercise or defend rights in administrative, court or arbitration proceedings.
e) In the event of a corporate reorganization, merger, acquisition or sale of assets, with prior notice to you and keeping the same protection as this Policy.
12.4 The benefits club, available to the Player Partner, opens a partner’s website inside the app. We do not send it your name, your e-mail, your CPF or any data from your registration. From the moment you browse or sign up on its screens, that partner’s terms and policy apply.
13. WHAT WE DO NOT DO WITH YOUR DATA
13.1 We do not sell, do not rent and do not assign your personal data to third parties for their commercial purposes. The previous version of this Policy provided for that possibility. It has been removed and no longer applies.
13.2 We do not integrate any third-party advertising network: the app does not embed any advertiser kit, we do not hand your device’s advertising identifier to an advertiser and we do not do behavioral advertising. The notices that appear inside the app are ours, as set out in section 20. We record this here so that there is no contradiction between what you read and what your device asks you: the tracking prompt shown by the iPhone and the permission text currently shown by the app mention ad personalization. Those two texts are wrong, we are fixing them, and what applies is what is written in this clause.
13.3 We do not use health data for advertising, marketing, product offers or sales, under any circumstances.
13.4 We do not use your voice commands, your content or your support conversations to train artificial intelligence systems, ours or third parties’. We do not authorize the service that interprets the voice commands to use what it receives from us to train models.
13.5 We do not buy databases to enrich your registration and we do not build a behavioral profile of you to sell to anyone.
14. INTERNATIONAL DATA TRANSFERS
14.1 Part of the services we depend on is provided outside Brazil. Of the processors listed in clause 12.1, the payment institution — item a — operates entirely in Brazil. All the others are in the United States, with the exception of the hosting providers in item k, whose region is the one stated there. This means that the data involved in those specific flows leave the country; and, if the hosting region is outside Brazil, the international transfer also reaches the Platform’s entire database, including the performance and health data in section 6.
14.2 That transfer relies on the data protection contracts we have signed with each processor, which bind them to confidentiality, security, use limited to the contracted purpose and cooperation in meeting your rights. We are adapting those contracts to the standard contractual clauses approved by the Autoridade Nacional de Proteção de Dados (Resolução CD/ANPD nº 19/2024). If you want to know which instrument applies to a specific processor, ask through the channels in section 1.
14.3 Each processor receives only the set of data described in clause 12.1, and not your entire database.
14.4 If you want to know where a specific piece of your data is stored, ask through the channels in section 1.
15. HOW LONG WE KEEP YOUR DATA
15.1 The general rule is simple: we keep each piece of data for as long as it is necessary for the purpose that justified it, or for the period the law requires. After that, it is deleted or stops being linked to you.
15.2 The periods that are already fixed are these:
a) Account and profile: for as long as your account exists.
b) Performance tracking data: until you delete it or delete your account. It does not expire on its own.
c) Login code sent by e-mail: up to 30 minutes.
d) Record of a login attempt and IP blocking for abuse: up to 24 hours.
e) Click on an invitation link, kept only as a cryptographic digest of the IP: up to 7 days.
f) Group activity log: up to 30 days.
g) Technical diagnostics of performance tracking: up to 30 days.
h) Records of charges received and of events from the stores and from the payment institution: from 7 to 30 days.
i) Data of yours kept in cache to speed up the statistics and X-Ray screens: up to 24 hours.
15.3 The periods that depend on a criterion, and not on a date, are these:
a) Matches, statistics, ratings and the Group’s history: for as long as the Group exists. They are part of that Group’s collective history and remain even after you delete your account.
b) Entries in the Group’s financial management: for as long as the Group exists, detached from your profile and marked as belonging to a deleted user.
c) Payment records and the Professional registration: for the period required by tax law and by payment-services regulation.
d) Records of support contacts and of reports: for the period necessary to defend rights, subject to the applicable limitation periods.
e) The record of the tracking consent, including of its withdrawals: for as long as the account exists, as proof that consent was given and withdrawn.
f) Technical logs of the requests to the server and error reports, described in clause 4.2: for the retention period contracted with the log and error monitoring providers, at the end of which they delete them automatically. That period is not set by us inside the app; if you want to know what it is today, ask through the channels in section 1 and we will tell you.
15.4 The routine that erases records with a set period runs periodically, so short periods are approximate: deletion happens within a few minutes after expiry.
15.5 Backup copies are deleted in the normal technical cycle, which is longer than the periods above.
15.6 If you want to know the exact period that applies to a record of yours, ask through the channels in section 1 and we will tell you.
16. AUTOMATED DECISIONS AND HUMAN REVIEW
16.1 Some decisions inside Chega+ are made by calculation, without a person looking at each case. You have the right to know which ones they are and to ask for a review. They are these:
a) Your final rating as a player. It is not the simple average of the ratings received. In matches rated by the current formula, we discount each rater’s bias — those who tend to give ratings that are too high or too low — and we discard the most extreme ratings before calculating. Older matches, rated before that change, keep the previous formula, which gives less weight, or no weight at all, to the ratings furthest from the average received and does not correct the bias of whoever voted. The calculation takes in the ratings of that match and the behavior of whoever voted.
b) The raters’ ranking, which awards points to whoever comes close to the consensus and penalizes whoever strays far from it. It takes in the ratings you gave, compared with the ratings given by everyone else.
c) The order in which a Professional appears to whoever is hiring. It takes in the distance to the game venue and the average rating in the role: by default the list is sorted by distance; when the person hiring chooses “Best rated”, the average rating sorts the list and the distance breaks ties. Your attendance rate is displayed, but does not enter into that sorting.
d) The Professional’s public reputation. It takes in the ratings received per service, the number of ratings and the attendance rate, with an internal flag when the average of the latest ratings falls below the minimum threshold.
e) Automatic suspensions and bans in the hiring of Professionals. Two serious breaches in 90 days produce a 30-day suspension, and a further breach during the suspension produces a permanent ban. On the side of the hiring Group, three last-minute cancellations in 90 days produce a visible badge and a downgrade in search, and two lost disputes suspend the posting of vacancies for 30 days.
f) The team draw. It takes in each player’s position and rating and, when the Group turns that option on and does not hide the financial management from the Members in the manner of clause 11.2, also the situation of whoever owes money, who is then drawn last.
g) The automatic blocking of a payment for security reasons. It takes in the amount of the hire, how many hires you have already paid for that day, how much has already left your account that day and the PIX codes you generated that are still within their validity period, including those generated on previous days. Today’s limits are 5 hires and R$ 2.000,00 per payer per day, with a floor of R$ 20,00 and a cap of R$ 500,00 per hire — R$ 1.000,00 in the case of the barbecuer. Above those limits the charge is refused on the spot, and you can ask for it to be released through the channels in section 1.
h) The Professional’s precautionary suspension. When two different Groups open, within 90 days, a no-show complaint against the same Professional, they are suspended for 30 days before the complaint is examined. It is a precautionary measure, not a conclusion about what happened: the Professional is told about the complaint, may contest it within 24 hours and the suspension is reviewed by a person.
16.2 None of these decisions sets an individual price for you. Those that restrict use — suspension, ban and refusal of a payment — can always be reviewed by a person.
16.3 You can ask for an explanation of the criteria of any of them and request human review through the channels in section 1. We confirm receipt and reply within 7 days. When the request is the review of a suspension, of a ban or of a dispute over the hiring of a Professional, the conclusion of the analysis follows the deadlines of the Intermediation Terms, which govern that hiring: up to 5 (five) business days for the request to reactivate the profile and for contesting the precautionary suspension, and a reasonable period not exceeding 15 (fifteen) days for the analysis of a dispute.
17. YOUR RIGHTS AND HOW TO EXERCISE THEM
17.1 The LGPD guarantees you, in relation to your personal data, the right to:
a) Confirm that we process data of yours.
b) Access that data and receive a copy of it.
c) Correct data that is incomplete, inaccurate or out of date.
d) Ask for the anonymization, the blocking or the deletion of data that is unnecessary, excessive or processed outside the law.
e) Ask for the portability of the data to another supplier.
f) Ask for the deletion of data processed on the basis of your consent.
g) Know who we share your data with — the list is in section 12.
h) Be informed about the possibility of not giving consent and about what happens if you do not give it.
i) Withdraw consent at any time.
j) Ask for the review of automated decisions, in the manner of section 16.
k) Object to processing based on legitimate interest.
17.2 Some of these things you do on your own, right away, inside the app:
a) Delete your account, in Profile, then Account, then “Delete account”.
b) Delete only the performance data, without deleting the account, in the same place.
c) Turn tracking on and off and withdraw the consent for it.
d) Edit or remove your profile data.
e) Mute notifications by Group and by subject, and withdraw the device’s permissions in its settings.
17.3 The other requests are handled through the channels in section 1. That includes the copy of your performance data: today it does not come out through a button in the app — ask through the channels in section 1 and we send it in a readable format. We ask only for what is needed to confirm that the request is yours — normally confirmation from the registered e-mail address. We do not charge anything for this.
17.4 We cannot always comply in full. A request may be refused, in whole or in part, when the law requires us to keep the data, when it is necessary for the regular exercise of rights, or when deleting one Member’s data would also delete another person’s record — for example, the rating you gave, which is part of another player’s match. When that happens, we explain the reason.
17.5 If you are under 18, your father, your mother or your legal guardian may exercise these rights for you, through the same channels.
17.6 Besides the rights of the LGPD, Lei nº 12.965/2014 (Marco Civil da Internet, the Brazilian Internet Civil Rights Framework) guarantees you the inviolability of your intimacy and your private life, the confidentiality of your stored private communications save by court order, the non-disclosure to third parties of your personal data outside the situations provided by law, clear information about the collection and the use of your data and the definitive deletion of the personal data you provided, on request, at the end of the relationship, save for the mandatory retention situations provided by law.
17.7 If you are not satisfied with our answer, you may complain to the ANPD, through the gov.br/anpd website, and to the consumer protection bodies.
18. CHILDREN AND ADOLESCENTS
18.1 To have an account on Chega+ you must be at least 13 years old.
18.2 Anyone under 18 may only use the Platform with the authorization and assistance of a parent or legal guardian, whose role is to follow that use.
18.3 For anyone under 16, the account depends on specific and highlighted consent from one of the parents or from the legal guardian, which can be given and withdrawn through the channels in section 1. If we learn that a user is under 16, we require that consent in order to keep the account and to keep performance tracking on, and we turn tracking off until we obtain it. It needs to be clear how this control works today: since we do not verify age at sign-up (clause 18.5), it is not automatic — it depends on the information reaching us, from you, from the guardian or through a report. We are working so that the app itself will block the activation of tracking in that case.
18.4 From children and adolescents we collect only what is needed to use the Platform. Taking part in a match is never conditioned on providing data beyond what is indispensable, and we do not use minors’ data for targeted advertising.
18.5 We do not check documents and we do not verify age at sign-up. The age information is a statement made by you. If we receive a report or have signs that the account belongs to someone below the minimum age, we may suspend it and terminate it.
18.6 The father, the mother or the legal guardian may ask, at any time and through the channels in section 1, for information about the minor’s data, for it to be corrected and for the account to be deleted.
18.7 In any decision about children’s and adolescents’ data, their best interests are what guide our conduct.
19. INFORMATION SECURITY AND INCIDENTS
19.1 We adopt technical and administrative measures to protect your data. Among them:
a) Encryption of the communications between the app and our servers.
b) Encrypted storage of the CPF of whoever pays, decrypted only at the moment of generating the charge.
c) Use of an irreversible code, and not of the original data, for the Professional’s CPF and for the IP address recorded in invitations.
d) Automatic removal of documents, bank details, e-mail, telephone, date of birth, coordinates and heart rate from our technical logs and error reports, in the manner and with the limits of clause 12.1, item i.
e) Password-free access, by a single-use code sent to your e-mail, or through Google and Apple accounts.
f) Automatic blocking of mass login attempts, by e-mail and by IP address.
g) Internal access control: only those who need the data in order to work have access to it, and improper use is subject to disciplinary and legal sanction.
h) Use of cloud providers with recognized security certifications.
19.2 No system is completely immune. We do not promise invulnerability and we do not use that fact to excuse ourselves: if there is a failure on our part, we are liable as the law provides, including the Código de Defesa do Consumidor (Consumer Protection Code) and the LGPD.
19.3 If a security incident happens that may bring risk or relevant harm to you, we notify you and the ANPD within the periods provided by law and by regulation, stating the nature of the data affected, the risks involved, the measures we have taken and what you can do to protect yourself.
19.4 If you suspect improper access to your account, tell us immediately through the channels in section 1.
19.5 If you identify a security flaw in the Platform, tell us through the same channels. We are grateful for the warning and we take no action against anyone who reports in good faith.
20. COOKIES, IDENTIFIERS AND ADVERTISING
20.1 The app does not use cookies. Access is kept by our own credentials, and not by a browser cookie.
20.2 The chegamais.app website uses cookies from the provider of the page. Inside the app, the legal documents are displayed from our servers and do not use cookies; only when that display fails does the app open the same public page, served by our servers, also without cookies. The benefits club opens a partner’s website and uses that partner’s cookies, subject to that partner’s policy.
20.3 In the app we use the following identifiers: the device’s notification identifier; an internal identifier for your account; an identifier of the device that never leaves it and serves only to protect the data stored locally; and the device’s advertising identifier — on the iPhone, only if you authorize it in the system prompt; on Android, it goes along with the usage measurement, which comes turned on and which you may object to in the manner of clause 20.4. The advertising identifier is used only to allow the usage measurement described in clause 20.4; we do not hand it over to any advertiser.
20.4 On the iPhone, the system shows a prompt asking for authorization to track. If you refuse, the usage measurement by the analytics service is not turned on. On Android, that measurement is on; if you want to object to it, ask through the channels in section 1. On both systems, you can limit or reset the advertising identifier in your device’s settings. What that measurement records is described in clause 12.1, item c.
20.5 We display notices and offers inside the app, and they are ours. We may choose who sees each one based on attributes of your account: your plan and the status of your subscription, whether you are an Administrator of any Group, the type of pitch your Group plays on, whether you have already paid by PIX, coupons you have redeemed and specific recipient lists. We do not send this data to any advertising network and we do not receive money from advertisers to target you.
20.6 You can mute notifications by Group and by subject inside the app, turn them off in your device’s settings and ask to be unsubscribed from promotional communications through the channels in section 1. Essential notices, related to security, billing and contractual changes, continue to be sent.
21. ACCOUNT DELETION
21.1 To delete your account, go to Profile, then Account, then “Delete account”. If you prefer, or if you cannot access the app, ask through the channels in section 1: we handle it just the same.
21.2 When you delete your account, the following are deleted:
a) Your profile and your account.
b) All your performance tracking data and its technical diagnostics.
c) Your participation in all Groups.
d) Your attendance in each Group’s next game not yet played.
e) Your device’s notification identifiers.
21.3 Not everything disappears, and it is important that you know this before confirming. The following remain:
a) The entries in the financial management of the Groups you took part in. They are the Group’s cash, they are detached from your profile and marked as belonging to a deleted user, and they remain recorded for as long as the Group exists. Legal basis: regular exercise of rights and the Group’s legitimate interest in preserving the integrity of its own cash.
b) The payment records and the Professional registration, where they exist, for the period required by tax law and by payment-services regulation. Legal basis: compliance with a legal and regulatory obligation.
c) The matches you took part in, with the statistics, the results and the ratings already recorded. They are part of the Group’s collective history and of the other players’ history.
d) The content posted by other people and the reviews written about services you provided or hired.
e) The images already sent to the storage, for as long as removal of the file is not requested in the manner of clause 9.2.
f) Your e-mail address, if it is on our suppression list — the list that stops us from going on sending messages to an address that rejected the previous ones. We keep only the address, so as not to write to it again. Legal basis: legitimate interest. If you want that entry to be deleted too, ask through the channels in section 1.
21.4 We do not say that “all your data will be deleted”, because that would not be true. If you want the removal of some record that remained, ask through the channels in section 1: we look at it case by case and remove everything the law does not require us to keep.
21.5 Deletion may be temporarily refused when you are the only Member of a Group that has an active hire of a Professional, with money held. In that case, complete or cancel the hire and try again. If you have a balance receivable as a Professional, tell us beforehand: deleting the account is not a waiver of amounts owed to you, and we settle them anyway, in the manner of clause 20.4 of the Terms of Use.
21.6 Before deleting, ask for a copy of your performance data through the channels in section 1, if you want to keep it. After deletion we cannot recover it.
21.7 Uninstalling the app does not delete your account. To delete it, use the path in clause 21.1.
22. CHANGES TO THIS POLICY
22.1 We may change this Policy to reflect changes in the service, in the law or in our practices. Every new version gets a number and an effective date.
22.2 When the change is relevant — a new purpose, a new category of data collected, new sharing or a change of legal basis — we give you reasonable advance notice inside the app. When the processing depends on consent, we ask for a new consent before starting. And since this Policy forms part of the Terms of Use, a relevant change here is a relevant change to them: besides the notice, we ask for your express acceptance and, until you accept it, the conditions of the previous version continue to apply to you, in the manner of clauses 21.2 and 21.3 of the Terms of Use. If you do not accept it, you can close the account in the manner of section 21.
22.3 This version unified the two policies that existed before, one on the website and another inside the app, and corrected what they said wrongly. In short: we removed the authorization to commercialize personal data; we removed the mention of access to the contact list, which never existed in the app; we removed the figure of the owners of pitches and courts, which does not exist in the service; we corrected the information about the visibility of your telephone number; and we now state the legal bases, the retention periods, the processors we share data with, the international transfer, the automated decisions, the health data from tracking, the payment data and what remains after you delete your account. In this version we also state, in full, the flow of usage events sent to the measurement service (clauses 4.5 and 12.1, item c), the sending of the audio of the voice commands to the device’s speech service (clauses 3.5 and 12.1, item l) and the limitation of the delivery of data to authorities to what the law allows (clause 12.3, item c). Along with this version we also changed the product, not only the text: these documents are now displayed inside the app from our servers, in the five languages in which the app is published, without cookies and without opening a third-party page (clauses 1.6 and 20.2); we closed the channel that carried the body of the requests and the full address of the pages to the error-monitoring service, so that what you fill in on the Professional registration screen no longer reaches it (clauses 7.3 and 12.1, item i); we now require whoever looks up your profile to share at least one Group with you, including in the programming interface the app uses to talk to our servers (clause 11.9); and we took your WhatsApp out of the profile data package (clauses 4.7, item b, and 11.4). We also corrected three descriptions that were more generous than reality: the Professional’s public profile shows the date on which the professional profile was created, and not how long you have been on the Platform (clause 7.6); the automatic blocking of a payment also counts the PIX codes that are still within their validity period, including those generated on previous days (clause 16.1, item g); and the deadline for concluding the analysis of measures linked to the hiring of a Professional is the one in the Intermediation Terms (clause 16.3). We kept the guarantee from the old policy that the data read from HealthKit and Health Connect never goes to advertising, marketing or sale. On September 20, 2026, the public address of these documents became https://www.chegamaisapp.com/legal, with no change of content other than clauses 1.6 and 20.2.
22.4 Previous versions are stored by number and date. You can ask for a copy of any of them through the channels in section 1.
23. CONTACT US AND ANPD
23.1 For any question, request, complaint or suggestion about this Policy, talk to us:
a) E-mail: suporte@chegamaisapp.com
b) WhatsApp: +55 21 4121-2456, also through the “Contact Us” item in the app menu.
23.2 For requests about your personal data, write to suporte@chegamaisapp.com with the subject “Encarregado — LGPD”. The Encarregado is Rodrigo de Medeiros Manguinho, in the manner of clause 1.4.
23.3 We confirm receipt and reply within 7 (seven) days, subject to any shorter periods the LGPD requires.
23.4 You may also file a complaint with the Autoridade Nacional de Proteção de Dados, through the gov.br/anpd website, and turn to the consumer protection bodies and to the consumidor.gov.br platform.
23.5 This Policy is governed by Brazilian law, in particular Lei nº 13.709/2018 (LGPD), Lei nº 12.965/2014 (Marco Civil da Internet) and Lei nº 8.078/1990 (Código de Defesa do Consumidor).
23.6 This Policy is published in Portuguese and may be translated into other languages. In case of any discrepancy, the Portuguese version prevails.