English (US)
Privacy Policy
How your data is collected, used and protected across the Blipen ecosystem.
1. Data Controller and Scope
This Privacy Policy applies to all applications, mobile services (iOS and Android), APIs and websites operated by THJ Telecom LTDA ("Blipen" or "we"), a private legal entity registered under Brazilian corporate taxpayer number (CNPJ/MF) 42.667.398/0001-64, acting as the Personal Data Controller under Article 5(VI) of Law No. 13,709/2018 (Brazilian General Data Protection Law — LGPD).
By creating your account and using the Blipen ecosystem — for personal management (PF), the Family Hub or business management (PJ) — you acknowledge that you have read, understood and agreed to this Privacy Policy.
2. Data Collected and Collection Methods
We collect only the information needed to provide the financial consolidation and intelligence features requested by the user:
Registration and Access Data
- Full name and registered company name / trade name (PJ);
- Brazilian individual or corporate taxpayer number (CPF or CNPJ);
- Email address and phone number verified by SMS/WhatsApp;
- Four-digit PIN (never stored on the device; verified on the server using an irreversible cryptographic hash);
- Biometric authentication is performed by the operating system on supported devices; Blipen does not receive biometric data.
Financial Data via Open Finance
- Connected banking institution and branch/account number;
- Consolidated checking and savings account balances;
- Bank transaction statements (PIX, TED, debits, credits);
- Credit card statements (limits, transactions, installments);
- Income and expense categorization metadata.
3. Purposes and Legal Bases for Processing
Blipen's processing of personal data is always supported by the lawful bases established in the LGPD (Article 7, items I, II and V), primarily for:
- Performance of the Service Agreement: Enable bank account aggregation, statement reconciliation, card statement closing and real-time cash flow monitoring.
- Automated Intelligence and Insights: Categorize purchases, display information about statements and budget goals set by the user, and send card due-date reminders according to their notification preferences.
- Security and Fraud Prevention: Detect logins from unrecognized devices and validate the integrity of the application's session.
- Compliance with Legal or Regulatory Obligations: Comply with joint resolutions of the Central Bank of Brazil (BACEN) and the Brazilian Securities Commission (CVM) applicable to Open Finance.
4. Privacy in the Family Hub and Exclusive Blind Mode
Blipen has a proprietary architecture designed specifically for couples and families to share financial planning while preserving each member's financial individuality.
How Blind Mode protects you:
- • Balances and details in Blind Mode: Blind Mode has two independent controls. Transaction Blind hides transactions except those you share. Balance Blind hides balances, bills and limits and excludes your amounts from family calculations. Enable either or both; shared transactions remain visible, including their amounts. You keep access to your data in your Personal profile.
- • Voluntary Expense Sharing: With Balance Blind off, shared accounts and cards contribute to family balances and summaries. Transaction details follow Transaction Blind and your sharing choices.
- • Immediate Withdrawal: Each member can disable sharing or leave the family group at any time directly from the application's Settings screen.
5. Security, Encryption and Storage
Blipen uses the following data protection and access controls:
Encryption in Transit
Communication with Blipen servers uses HTTPS with TLS. Data is processed on the server to provide app features.
Data access controls
Access to stored data is checked on the server based on identity, profile and sharing permissions.
6. Sharing with Infrastructure Processors (Pluggy)
To enable the technological connection and aggregation of banking data via Open Finance with institutions authorized by the Central Bank of Brazil, Blipen uses services provided by Pluggy Brasil Instituição de Pagamento LTDA (CNPJ: 37.943.755/0001-30), a Payment Initiation Service Provider (ITP) duly authorized by BACEN.
• Pluggy's Role: It acts as a technology processor within Open Finance, securely reading encrypted balances, statements and cards with your explicit consent.
• Exclusive Purpose: Shared data is used solely for analytical consolidation and transaction reconciliation in your Blipen account. Any sale or unauthorized transfer is prohibited.
• Security and the LGPD: According to its published policy, Pluggy uses AES-256 for data at rest and TLS for data in transit. See the partner’s documentation for controls and processing terms.
To view our aggregation partner's legal documents, see the Pluggy Privacy Policy and the Pluggy Terms of Use.
7. Sharing with Third-Party Artificial Intelligence Providers (OpenAI)
To provide the intelligent financial assistant (Blipen Copilot), answer natural-language queries and enable optical character recognition of payment receipts and sales receipts (OCR), Blipen integrates high-precision artificial intelligence services provided by OpenAI, L.L.C. ("OpenAI"), headquartered in the United States of America.
Personal Data Transmitted and Collected
- Text Messages and Prompts: Queries, questions and budget descriptions entered in the chat;
- Voice Commands and Transcriptions: Voice recordings voluntarily converted to text;
- Receipt and Payment Confirmation Images: Photos taken or selected from the gallery to extract the merchant, date, amount and purchased items;
- Minimum Analytical Context: Only the financial data strictly necessary to answer the specific question asked by the user.
Data processing and protection at OpenAI
- Model training: By default, the OpenAI API does not use content for training; explicitly opting into data sharing can change this setting;
- Encryption in Transit: Communication between Blipen servers and OpenAI uses HTTPS with TLS;
- Data retention: Retention depends on the feature and contracted controls. Abuse monitoring logs may remain for up to 30 days, with legal and safety exceptions;
- Subprocessors: Processing may involve OpenAI subprocessors subject to contractual data protection obligations.
Prior, Informed Consent and Withdrawal by the Data Subject
Sending data to the third-party artificial intelligence provider is strictly voluntary and requires the user's prior, explicit and prominent consent, collected directly in the mobile application before any transmission.
You may withdraw your consent at any time directly in the application under Settings > Terms & Privacy > Artificial Intelligence, or choose to use all the platform's other features (manual accounts, cards, statements and charts) without interacting with the AI service.
To view the AI provider's security and privacy commitments, see the OpenAI data use and retention documentation.
8. Non-Sharing of Mobile Phone and SMS Data (A2P 10DLC Compliance)
The company THJ Telecom LTDA ("Blipen") prioritizes the utmost confidentiality and security of its users' authentication channels.
Strict Non-Sharing Commitment (Mobile & SMS Opt-In):
No mobile phone number, messaging consent data (SMS opt-in) or mobile contact information collected by Blipen will be shared, sold, rented or transferred to third parties, affiliates or business partners for marketing, advertising or promotional purposes under any circumstances.
Mobile Privacy Commitment (English):
"No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. All other categories exclude text messaging originator opt-in data and consent; this information will not be shared with, sold, or transferred to any third parties."
The mobile phone numbers provided are used strictly to send one-time verification codes (OTP), two-factor authentication (2FA) and critical security alerts requested directly by the user.
9. Your Rights as a Data Subject (Article 18 of the LGPD)
You have full control over your information and may exercise the following legally guaranteed rights at any time:
To request complete and irrevocable deletion, open the application and go to Settings > Security > Delete Account. Your registration data and banking tokens will be permanently removed from our active records.
Without access to the app, you can also request deletion of your Blipen account by writing to privacidade@blipen.com. Provide the email or phone linked to your account, without sending your password or PIN; we will verify ownership before deletion. The request covers account information, financial history, content and connections stored in the account. Optional ad references expire within 30 days; data already received by external providers follows their respective privacy channels.
10. Data Protection Officer (DPO) and Contact
For clarification, requests to exercise your rights or questions about the processing of your personal data, contact our Data Protection Officer directly:
Dedicated Privacy and DPO Channel
privacidade@blipen.com
Support on business days, with a response within 48 hours.
11. Google sign-in and Google Calendar
These terms apply when you choose Google features available in your Blipen account. Marketplace installation does not grant a Pro subscription.
Google sign-in and Google Calendar. Google sign-in for Blipen Web is optional and requires an active Pro plan. When you link Google, we receive basic identity information and store your Google account identifier and verified email to recognize that link. Names or profile photos supplied during sign-in are not used to automatically merge accounts. Initial linking requires an authenticated Blipen session and PIN confirmation. Your PIN is not sent to Google. Google sign-in and Calendar authorization are separate.
When you connect Calendar, we create a secondary calendar for your authorized personal account and export the commitments selected in your preview. Dates, status and generic titles are used by default. Descriptions and amounts are included only if you enable details for your personal account. We do not read your primary or other personal calendars, import calendar events as financial transactions, make payments, add attendees or send email invitations.
We receive identifiers and metadata for app-managed events to synchronize them and detect edits. Calendar credentials are encrypted on our server. Connection identifiers and mappings remain as needed for synchronization and reconciliation. Execution history is automatically discarded under a 90-day TTL policy. Sign-in attempts expire after five minutes; OAuth attempts also expire and are validated by the server and removed through TTL. Physical TTL deletion is not immediate.
You may pause synchronization or disconnect, choosing to keep or request removal of mapped events. Modified events or events missing their ownership marker may require review to avoid unintended deletion. Disconnecting erases local Calendar credentials; retained events remain in Google. Removing Google sign-in is separate and ends its corresponding SSO Web session. You may also revoke access in Google account settings. Deleting your Blipen account removes local links, credentials and mappings but does not automatically erase previously exported Google events; request cleanup before deleting your account.
Information received from Google APIs is used only for authentication, synchronization and controls you request. We do not sell it, use it for advertising or send it for AI model training. Our use and transfer of Google API data follow the Google API Services User Data Policy, including Limited Use requirements. The contact and rights channels in Blipen's general privacy policy remain applicable.
12. Optional OpenAI ad measurement
When you separately allow OpenAI measurement on the website and in the app, we link the ad click reference to a completed signup. We send OpenAI only the original click reference, a random event identifier, the event type and signup time. We do not send your name, phone, email, PIN, documents or financial data, or encoded versions of these data.
The click reference is protected on the server for up to 30 days and removed after confirmed delivery or revocation. The local link is optional and separate from Google preferences. This choice does not enable ad personalization. On iOS, system tracking permission is also required. Without permission or a valid link, signup works normally and no OpenAI conversion is sent.
You can revoke in website preferences or Privacy in the app. Revocation stops new sends after reaching the server; events already received by OpenAI are not deleted by this command. If offline, the revocation attempt remains pending for retry. Going through the store may require returning to the ad page and tapping Open Blipen before completing signup.
13. Optional signup measurement with Google
With your specific permission in the app, we use Google Analytics for Firebase to measure completed signups and the performance of Blipen ads. The service receives usage events, an installation identifier, technical app and device information, and approximate location derived from the connection. We do not send names, phone numbers, email, PINs, documents or financial data for this measurement.
Measurement is off by default, is independent of the OpenAI option, and does not enable personalized advertising. On iOS, it also requires system tracking permission. You can disable it in Settings > Privacy; this stops new events but does not automatically erase data already received by Google. Declining does not prevent signup or use of the app. Linking with Google Ads allows ads to be evaluated using consented events.