Privacy Policy

1. Who takes care of your data

Paulo Roberto Appolinario Alonso (CPF No. 452.723.298-30), responsible for Boa Vista Farm, is the controller of the personal data described in this policy.

The data protection officer in charge of the processing of personal data (LGPD, Art. 41) is Paulo Alonso, who can be reached by email at pauloa65@gmail.com.

Boa Vista Farm is offered by Paulo Roberto Appolinario Alonso, CPF No. 452.723.298-30, located at Moacyr Biguetti, 41, Park Real, Indaiatuba - SP. Customer service: contato@boavistafarm.com.br or the support center.

2. Data we use

• Account: account identifier, name and email address provided by Google or entered when signing up with email. We do not ask for access to Gmail, Google Drive, your contacts or files in your Google account.
• Profile: username, avatar and, if you choose to provide it, gender. This field can be left as “Prefer not to say”.
• Game: progress, items, preferences, achievements and activity records used to protect the Game against cheating.
• Support: the messages and information you send in support tickets.
• Chat and friends: the messages you send in the town chat and in private conversations, friend requests, blocks, and the reports you make or receive.
• Suggestions: the text you send on the suggestions page, with your username and your farm's level at the time, the date, the time, whether it came from the website or the app and whether you chose to appear on the community board, plus the support you give to suggestions on the board.
• Technical data: IP address, date and time of access, browser and device type, and the time the Game last contacted the server, used to show how many players are online.
• Purchases: order number, pack, amount, payment method, status and dates. For cards, the provider may give us only partial data, such as the card brand and the last four digits; for Pix, it may give us the name and CPF of the payer, as part of the payment receipt. We never receive or store the full card number or the security code.
• Acceptances: version of the documents accepted, date, time, IP address and browser at the time of acceptance.

We do not ask for documents to play and we do not process sensitive personal data, such as racial origin, health, religion or biometrics.

3. What we use it for and on what legal basis

• Creating and keeping your account, saving and syncing your progress and providing the Game: performance of a contract (LGPD, Art. 7, V).
• Processing purchases, crediting gems and handling withdrawal and refund requests: performance of a contract and compliance with a legal obligation (Art. 7, V and II).
• Keeping access records for 6 months, as the Marco Civil da Internet (Brazil's Civil Rights Framework for the Internet, Law No. 12,965/2014, Art. 15) requires, and purchase records for the period set by law: compliance with a legal obligation (Art. 7, II).
• Preventing fraud, cheating and abuse and protecting the accounts and the service: legitimate interest (Art. 7, IX).
• Answering support tickets: performance of a contract (Art. 7, V).
• Showing the town chat and private conversations and moderating what is sent (automatic filter, reports, muting and bans): performance of a contract and legitimate interest (Art. 7, V and IX).
• Showing other players your username, your avatar and your results in the Game, such as your level and the week's fish in the ranking, and your farm when someone visits it: performance of a contract (Art. 7, V).
• Playing on the square's screen the video chosen by the team while you are on the square: performance of a contract (Art. 7, V).
• Reading the suggestions sent on the suggestions page, answering when needed and using them to improve the Game: legitimate interest (Art. 7, IX).
• Showing your suggestion on the community board, with your username and your farm's level, only if you tick that option when sending it: consent (Art. 7, I). Only players with an account see the board; they can support suggestions and see how many supporters each one has, but not who they are. You can withdraw your consent at any time by asking through the support center or by email at contato@boavistafarm.com.br to take the suggestion off the board or delete it.
• Sending news emails about the Game to account holders, always with a link to stop receiving them: legitimate interest (Art. 7, IX).
• Recording your acceptance of the documents: regular exercise of rights (Art. 7, VI).
• Understanding how the Game is used and where players struggle, with statistics of visits to the website (Google Analytics) and heatmaps and recordings of sessions on the website and in the Android app (Microsoft Clarity): legitimate interest (Art. 7, IX). The recordings show clicks, taps and scrolling on the Game's screens; the chat, private messages, the guest book and text fields are hidden in them.

We do not sell personal data, we do not use your data for third-party advertising, and there are no advertising or ad-tracking tools in the Game. Our news emails are only about Boa Vista Farm.

Our anti-cheat system may automatically limit unusual earnings. You can ask for a review of these automated decisions through the support center or by email at contato@boavistafarm.com.br (LGPD, Art. 20).

4. Who we share it with

• Supabase: authentication, database and storage for the account and the Game.
• Vercel: hosting and delivery of the website.
• Google: sign-in with Google, according to the settings of your Google account.
• YouTube (Google): the videos on the square's screen. When the event square appears on your screen, the screen's video starts playing by itself, and the YouTube player, in privacy-enhanced mode (youtube-nocookie.com), receives technical data such as your IP address and your browser and device type, under Google's privacy policy. If you prefer it to load only when you tap the screen, untick “Play by itself” in the screen's player; with your phone's data saver on, it also waits for a tap. In the Android app, the video opens on YouTube only when you tap to watch.
• Google Analytics (Google): statistics of visits to the website, such as pages viewed, device type and approximate region.
• Microsoft Clarity (Microsoft): heatmaps and recordings of sessions on the website and in the Android app, to understand where players struggle, with the chat, messages, the guest book and text fields hidden.
• Resend: sending account emails, such as the sign-up confirmation and password recovery, and news emails.
• Payment provider: when you buy gems, it receives the order number, the amount and the email address of the account, plus the details you give it during payment, such as name, CPF and card details. It processes Pix and card payments, the anti-fraud review and reversals. The name of the provider appears on the payment screen.
• Public authorities: when there is a legal obligation or a court order.

These partners process the data on our behalf or as independent controllers, as the case may be, and must protect it.

5. International transfer

Some partners may store or process data outside Brazil, for example in the United States or in the European Union. In these cases, the transfer follows the safeguards provided for in Article 33 of the LGPD and in the regulations of the National Data Protection Authority (ANPD).

6. How long we keep it

• Account, profile and Game: while the account is active. After deletion, the data is deleted or anonymized within 30 days, and backups are replaced in the normal rotation cycle.
• Access records: 6 months.
• Orders, payments and support tickets about purchases: 5 years after the purchase, to meet tax and consumer protection obligations.
• Acceptance records: while the account exists and, if there were purchases, up to 5 years after the last purchase.
• Other support tickets: while the account is active.
• Chat: town messages for up to 24 hours and private conversations for up to 30 days. A copy of a reported message is kept for up to 30 days in the town, and up to 90 days after the report is resolved in private conversations.
• Suggestions and support: while the account exists, or until you ask us to delete them. When the account is deleted, they are deleted with it.

7. Your rights

Under the LGPD (Art. 18), you can request, at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary or excessive data, or of data processed in breach of the law;
• portability of the data;
• deletion of the data processed on the basis of your consent, and revocation of that consent;
• information about who we share your data with and about the possibility of not consenting;
• review of decisions made solely on the basis of automated processing (Art. 20);
• objection to processing that does not comply with the law.

Make your request through the support center or by email at contato@boavistafarm.com.br. We may ask for information to confirm that the account is yours. We reply within 15 days.

You can also file a complaint with the ANPD on its website, gov.br/anpd.

To delete your account, ask through the support center or by email at contato@boavistafarm.com.br. Deletion erases your progress, gems and items, and cannot be undone.

8. Children and adolescents

The Game is for a general audience. We process data of children and adolescents in their best interest (LGPD, Art. 14), only as much as the Game needs to work, with the most protective settings by default.

We do not profile children and adolescents or direct advertising at them (Law No. 15,211/2025, ECA Digital, Brazil's Digital Statute of Children and Adolescents). The account of a child under 12 must be created by a legal guardian, who gives the specific consent provided for in Art. 14, § 1 of the LGPD.

Parents and guardians can ask through the support center or by email at contato@boavistafarm.com.br for access to, correction or deletion of a minor's data, as well as for purchases on the minor's account to be blocked or limited.

9. Storage in the browser

We use the browser's local storage and strictly necessary cookies to keep your sign-in session, your preferences, the record of your acceptance and a local copy of progress not yet sent to the cloud. On the website, Google Analytics and Microsoft Clarity use measurement cookies to understand how the Game is used; in the Android app, Microsoft Clarity keeps a measurement identifier of the same kind. We do not use advertising cookies.

You can delete this data in your browser settings. This ends the session and may delete progress that has not been synced yet. The sign-in pages of Google and of the payment provider, and the YouTube player on the square's screen, may use their own cookies and storage.

10. Security

We use an encrypted connection (HTTPS), access control by account, security rules in the database and restricted, logged administrative access.

No system is completely secure. If a security incident occurs that may cause relevant risk or harm, we will notify you and the ANPD, as required by Article 48 of the LGPD.

We will never ask for your password, card details or verification codes through support.

11. Changes to this policy

When this policy changes, we will update the version and the date at the top of the page and announce relevant changes in the Game.