Privacy Policy — Aventurix

Welcome to Aventurix. This Privacy Policy explains how Aventurix collects, uses, stores, shares, and protects your personal information when you use our interactive storytelling application powered by artificial intelligence.

This Policy applies to all Aventurix app users, regardless of country of origin, and was prepared to comply with Brazil's General Data Protection Law (LGPD) – Federal Law No. 13.709/2018, the General Data Protection Regulation (GDPR) – Regulation (EU) 2016/679 (European Union), and applicable data protection laws in other jurisdictions where we operate.

By creating an account and using Aventurix, you confirm that you have read and understood this Policy. If you do not agree with the terms described here, do not use the application.

Legal name: TROPICAL GAMES STUDIO LTDA

CNPJ: 66.393.771/0001-02

Address: AV PAULISTA 1471, São Paulo, SP

Country of registration: Brazil

Contact email: support@tropicalgames.com.br

The Data Protection Officer (DPO) can be contacted as indicated in Section 13 of this Policy.

2.1 Registration data

• Name (optional): Experience personalization — Legal basis: Consent / Legitimate interest
• Email (required): Identification, account access, communications — Legal basis: Performance of a contract
• Date of birth (required): Minimum age verification (13 years) — Legal basis: Legal obligation / Performance of a contract

We do not collect: phone number, profile photo, geographic location, time zone, or device technical data.

2.2 Social login

You may choose to create your account via social login with Google or Apple. We only receive the information you authorize when authenticating with the provider (typically name and email). We do not have access to your password on those providers. Use of data by Google and Apple is governed by those providers' respective privacy policies.

2.3 Voice and audio content

Aventurix offers voice interaction. We request your explicit consent before enabling audio recording. After recording, your audio is transcribed through a speech recognition service (Speech-to-Text – STT). Only the text transcription is stored in our systems — the original audio is not retained. Transcriptions are deleted when the adventure or the account is deleted, whichever occurs first. STT/TTS provider: OpenAI (United States). Legal basis: consent (Art. 7, I of the LGPD; Art. 6(1)(a) of the GDPR).

2.4 Story and conversation content

We store the history of your interactions with interactive stories ("adventures") so you can continue stories where you left off, provide context to the artificial intelligence during the active session, and save your adventure progress. Personal data is sent to the AI only if you voluntarily include it in your messages. Legal basis: performance of a contract (Art. 7, V of the LGPD; Art. 6(1)(b) of the GDPR).

2.5 Payment data

Financial transactions are processed exclusively by the app stores: Apple In-App Purchase (iOS) and Google Play Billing (Android). Aventurix does not store, process, or have access to credit card, debit card, or other financial data. We only store: contracted plan type (monthly, annual, or prepaid credits), subscription start and end dates, subscription status, and prepaid credit balance. Legal basis: performance of a contract and legal obligation.

2.6 Usage and analytics data

Our landing page uses Vercel Analytics, which does not use tracking cookies and collects only aggregated, anonymous browsing data. We do not use Google Analytics, Meta Pixel, or any other cookie-based tracking system.

We use your personal data exclusively to: create and manage your account; authenticate your access to the application; provide and personalize interactive stories; enable voice interaction; process subscriptions and credits; send service communications; protect users under 13; comply with legal obligations; and moderate inappropriate content.

We do not use your data for: sale to third parties, creating profiles for advertising, fully automated decision-making with significant legal effects, or training artificial intelligence models.

We share your data only with partners essential to operating the service:

• OpenAI (USA): active conversation history for AI content generation
• Amazon Web Services – AWS (USA, us-east-1): database data, infrastructure, and hosting
• OpenAI STT/TTS (USA): voice transcriptions with consent, for Speech-to-Text and Text-to-Speech
• Apple / Google (USA): payment data managed entirely by them, for purchase processing
• Vercel Analytics (USA): aggregated, anonymous landing page data

4.1 Artificial intelligence (OpenAI)

The active conversation history is sent to OpenAI to generate story content. Your conversations are not used to train AI models. Sensitive personal data is not sent automatically — only what you type or say during the story. OpenAI's use is governed by its data processing agreement, which limits use of the data to providing the service.

4.2 Disclosure by legal obligation

We may disclose your data to government authorities, regulators, or pursuant to a court order when required by applicable law, always observing the principle of proportionality and, when possible, notifying you in advance.

Your personal data will be transferred to and stored in the United States of America (USA), where our main infrastructure and AI providers are located (AWS region us-east-1 and OpenAI). For users in Brazil, the international transfer is carried out based on Art. 33 of the LGPD. For users in the European Economic Area (EEA), the transfer is carried out based on Standard Contractual Clauses (SCCs) approved by the European Commission, pursuant to Implementing Decision (EU) 2021/914. All of our USA providers adopt appropriate technical and organizational security measures, including certifications such as SOC 2 and ISO 27001.

6.1 Retention period

• Registration data: while the account is active or until deleted by the user
• Story and adventure history: while the account is active or until manually deleted by the user
• Audio transcriptions: deleted when the adventure or account is deleted, whichever occurs first
• Subscription and credit data: for the period required by applicable tax legislation (generally 5 years)
• Automatic backups (AWS RDS): 7 days | Manual snapshots: 30 days. Deleted users' data is removed from backups within 7 days.

6.2 Data deletion

You can delete your account directly in the application — deletion is immediate and removes all data associated with your account, subject to retention periods required by law. You can also delete specific stories and adventures granularly. Residual copies in automatic backups will be eliminated within 7 days.

We guarantee you the exercise of the following rights:

• Access (Art. 18, I LGPD; Art. 15 GDPR): know what data we hold about you — Email: support@tropicalgames.com.br
• Rectification (Art. 18, III LGPD; Art. 16 GDPR): correct data — Account settings in the app
• Erasure (Art. 18, VI LGPD; Art. 17 GDPR): request deletion of data — Directly in the app
• Portability (Art. 18, V LGPD; Art. 20 GDPR): receive a copy of your data — Email: support@tropicalgames.com.br
• Withdrawal of consent (Art. 18, IX LGPD; Art. 7(3) GDPR) — App settings or email: support@tropicalgames.com.br
• Objection, restriction of processing (GDPR) — Email: support@tropicalgames.com.br
• Complaint to the ANPD (Brazil): anpd.gov.br | Local supervisory authority (EU)

We will respond within 15 business days (LGPD) or 30 calendar days (GDPR).

Aventurix is intended for users aged 13 or older. We do not knowingly collect data from children under 13. We require date of birth during registration, and users under 13 are prevented from creating an account regardless of the registration method used. Users between 13 and 17 may use Aventurix, but content is filtered by default to remove material inappropriate for that age group. If we identify that we have inadvertently collected data from a child under 13, we will take immediate steps to delete that information — contact us at the email indicated in Section 13.

We adopt appropriate technical and organizational measures, including: encryption of data in transit (TLS 1.2+) and at rest; storage in AWS RDS with restricted and monitored access; role-based access control (RBAC); secure authentication with JWT tokens; access auditing and monitoring. In the event of a security incident, we will notify you and the competent authorities within the timeframes provided by applicable law (LGPD: within a reasonable time; GDPR: 72 hours for the supervisory authority).

The Aventurix application does not use cookies. Our landing page uses exclusively Vercel Analytics — cookie-free audience analytics with aggregated, anonymous data (pages visited, country of origin, device type). We do not use Google Analytics, Meta Pixel, Hotjar, or any other cookie-based tracking tools. A cookie banner is not required.

Aventurix uses artificial intelligence (provided by OpenAI) to create and narrate interactive stories in real time. You are interacting with an Artificial Intelligence — stories and responses are AI-generated and may contain incorrect or inappropriate information. Content should be used for entertainment only. Your conversations and stories are NOT used to train artificial intelligence models, either by Aventurix or by OpenAI. We adopt automatic filters to block explicit sexual content, extreme violence, political content, and any content that exploits or endangers minors. To report inappropriate content: projetoghes@gmail.com.

With your consent, we may send communications about Aventurix by email and push notifications. You may cancel at any time via the unsubscribe link in emails or through the app's notification settings. Transactional communications (payment confirmation, policy changes) continue to be sent regardless of marketing preference.

For privacy and data protection matters, contact: support@tropicalgames.com.br

Response time: up to 15 business days (LGPD) / 30 calendar days (GDPR).

If you are located in the European Union and believe that the processing of your data does not comply with the GDPR, you have the right to lodge a complaint with the local supervisory authority in your country.

We may update this Policy from time to time to reflect changes in our practices, applicable law, or our services. When we make material changes, we will notify you via a prominent notice in the application and by email to the registered address. Continued use of Aventurix after the changes take effect will constitute acceptance of the new terms.

This Policy is governed by the laws of the Federative Republic of Brazil. For dispute resolution, the courts of São Paulo, SP are elected, with express waiver of any other venue, however privileged. Users in the European Union may also contact the data protection authorities of their country of residence.

© 2026 Aventurix / Tropical Games Studio LTDA. All rights reserved.