PRIVACY & DATA SOVEREIGNTY

OCCABUZZ// is the controller of the data described here. The accountable operator is Quene Pereira da Silva, Chief Intelligence Officer. For any privacy request, write to contact@occabuzz.com.

We do not vacuum your data. When you open an account and connect a device, you choose — category by category — exactly what OCCABUZZ may read. You can connect only your glucose, only your sleep, or everything. You can change or revoke any category later, at any time.

Biometric and health data are sensitive personal data. We treat them accordingly — see security and erasure below.

Your data is processed for exactly one purpose: to produce your Performance Dossier and the guidance you paid for. That is the whole finality.

• ›We never sell your data. Not to advertisers, not to brands, not to anyone.
• ›We never use your data to train models or build a profile of you for anything other than your own dossier.
• ›We never share it without your explicit instruction.

The legal basis is your explicit, specific, informed consent (LGPD). Consent is captured at the moment you connect a data source — through a distinct, affirmative action, next to a plain statement of what is read and why, with a link to this policy. Each consent is recorded with its date and the version of this policy. Consent is never bundled into something else, and you can withdraw it — for one category or all of them — at any time, without losing access to what you already paid for.

This is the part that matters most, so it is the plainest:

• ›You can delete any single category of data at any time, from your account, in one action.
• ›You can delete all of your data at any time, in one action.
• ›If you delete your account — or if you stop using the platform — all of your personal and health data is permanently destroyed. Not archived. Not anonymized-and-kept. Destroyed, including from routine backups within the ordinary backup cycle.

Erasure is a right, not a favor. We may retain only the minimum a law strictly requires us to keep (for example, a proof-of-purchase record), and nothing more.

Your wearable data reaches us through a self-hosted connection layer — it flows to OCCABUZZ's own infrastructure rather than being handed to a third-party data broker. Data is encrypted in transit and at rest, and access is restricted to what is strictly needed to build your dossier. When you connect a device, you authorize a scoped, read-only link that you can revoke at the source at any time.

Under the LGPD, you can, at any time:

• ›Confirm what data we hold about you, and access a copy of it.
• ›Correct data that is inaccurate or incomplete.
• ›Delete any category, or all of it, at any time.
• ›Export your data in a portable format.
• ›Withdraw your consent — in whole or per category — at any time.
• ›Ask how your data is processed and with whom, if anyone.

To exercise any of these, use the controls in your account or write to contact@occabuzz.com. We respond within the timeframe the law requires.

We keep the chain as short as possible. The only third parties that may process your data are the ones strictly needed to run the service: the wearable provider you personally choose to connect (via a read-only link you authorize), our infrastructure host, and a transactional-email provider used only to deliver your dossier. We do not add data brokers, advertisers, or analytics that profile you.

OCCABUZZ is intended for adults. We do not knowingly collect data from anyone under 18.

If this policy changes materially, we update the version and effective date above and, where the change affects how your data is used, we ask for fresh consent. Prior versions are available on request.