Privacy Policy
Short privacy notice (the same text is shown where we collect your data: on the sales page, next to the purchase button, on the app sign-in page and on the withdrawal and complaints forms):
Privacy: 45.791.707 GUILHERME COSTA FERNANDES (GDIST), Rua Oceânica Amábile, 207, Apt 43, bloco Cristiana, Ocian, Praia Grande - SP, 11704-420, Brazil, is responsible for your personal data. We use your name, e-mail, country, purchase details and access data such as your IP address (card data is handled by Stripe) to give you access, keep the app secure, send receipts, provide support and meet legal and dispute obligations. We only send marketing e-mails if you separately agree to them. Your journal, which may reveal religious beliefs (sensitive data), is stored only if you give both of its separate consents in the app. You can withdraw them or delete your account in Settings, or write to contato@gdistbrasil.com.br. Full privacy policy: https://www.gdistbrasil.com.br/privacy.html
1. Who is responsible for your data
The controller of your personal data under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018) is 45.791.707 GUILHERME COSTA FERNANDES, a Brazilian MEI (Microempreendedor Individual), CNPJ 45.791.707/0001-00, doing business as GDIST (Guilherme Dist) ("GDIST", "we", "us"), Rua Oceânica Amábile, 207, Apt 43, bloco Cristiana, Ocian, Praia Grande - SP, 11704-420, Brazil. Legal representative: Guilherme Costa Fernandes. Biblianza is a product of GDIST, so GDIST is also the controller for Biblianza.
Channel for data subjects and authorities: contato@gdistbrasil.com.br (this address also receives communications from data-protection authorities), +55 11 92019-1877 (Mon–Fri, 9am–6pm Brasília time, UTC−3), our contact page, or a letter to the address above. Privacy requests are handled directly by the legal representative. No prevention officer (encargado de prevención) has been designated.
Representative for the territory of Peru: see section 16.
2. What this policy covers
This policy covers the website gdistbrasil.com.br (institutional pages, contact and legal pages) and Biblianza, our guided Bible study web app (its sales and offer pages, the Stripe checkout, the app at gdistbrasil.com.br/biblianza/app and the e-mails we send). GDIST also maintains digital health and wellness products, which are sold through other channels, not on this website; this policy does not describe the data collected on those channels. It concerns the following people: visitors to the website, people who contact us, customers (adults aged 18 or over) and Biblianza users, and people who submit a withdrawal request or a complaint.
3. Personal data we collect and where it comes from
| Category | What it includes | Source |
|---|---|---|
| Contact and support | Name, e-mail address, phone number and the content of your message | You |
| Purchase | Name, e-mail address, country, currency, items bought, amounts, date and time, and Stripe payment and customer references. Never the full card number. | You, at checkout; Stripe |
| Consent and offer-acceptance records | Saved-card agreement and Terms: text version, language, date and time. Journal consent and journal transfer consent, each recorded separately: user, text version, language, date and time, and IP address. Acceptance of each post-purchase offer (your click on its button): date and time, IP address, user, item (SKU), price, currency and page version, kept as proof of your consent to that charge, including in a card dispute. | Our systems, when you accept |
| Biblianza account | E-mail address, language, time zone and the reminder times you choose | You, in the app |
| Biblianza progress | Sessions completed in each study and products unlocked | The app, as you use it |
| Biblianza journal (only with your consent) | What you write in the journal | You |
| Access logs | Date and time, IP address, browser (user agent) and session when you sign in and use the app | Our systems |
| Withdrawal requests and complaints | E-mail address and order reference; for the Libro de Reclamaciones also name, address, identity document number, phone, details of a parent or guardian if the person filing is a minor, amount, description and request | You, through the BOTÓN DE ARREPENTIMIENTO or the Libro de Reclamaciones |
| Technical data from visits | IP address, browser and pages requested, processed to deliver and protect the website | Your browser |
We do not collect personal data from publicly accessible sources and we do not buy personal data.
4. Sensitive data
Religious belief is sensitive personal data under the LGPD (art. 5 II), including when it is revealed by other data (art. 11 §1), and under the data-protection laws of Chile, Colombia, Mexico, Peru and Argentina. Two kinds of Biblianza data can reveal it:
- Journal entries. We store them only if you accept two separate consents: one to store your entries and one to store them outside Brazil. Both are shown in the app before your first entry, apart from the Terms and the saved-card agreement, each with its own unticked box. Both are optional and recorded; the journal turns on only when you accept both, and your access to Biblianza does not depend on them.
- The fact that you bought or use Biblianza, and your progress. We use this only to provide the product you bought. We never use it to build advertising profiles, we never sell it, and we share it only with the providers in section 8, for the services described there.
Journal consents — texts shown in the app, in two separate unticked boxes
1. Storing your journal (sensitive data; LGPD art. 11 I)
Optional. I agree that 45.791.707 GUILHERME COSTA FERNANDES (GDIST), the company behind Biblianza, may store what I write in the Biblianza journal. I understand that my entries may reveal my religious beliefs, which are sensitive personal data. I can withdraw this consent at any time in Settings; my entries are then deleted, and I can download them first. My access to Biblianza does not depend on this choice.
2. Storing your journal outside Brazil (international transfer; LGPD art. 33 VIII)
Optional, needed for the journal. I agree that my journal entries are stored and processed outside Brazil, on Cloudflare servers in the United States, only to keep my journal. I can withdraw this consent at any time in Settings; the journal then turns off and my entries are deleted, and I can download them first.
The journal turns on only when both boxes are ticked. Without both consents the journal stays off, the writing prompts still show (you can write on paper), and everything else in Biblianza works. If you withdraw either consent, the journal turns off and all your entries are deleted; before that, the app offers you a download of them. No entry is kept without both consents.
This website does not ask for health information. Please do not send it in messages unless your request needs it.
5. Purposes and legal bases
| Purpose | Data | Legal basis (LGPD) | Needs your consent? |
|---|---|---|---|
| Selling and delivering products; creating and running your Biblianza account; sign-in links; saving progress; post-purchase offers under the saved-card agreement; purchase confirmation e-mails | Contact, purchase, account, progress, consent records | Performance of the contract you requested (art. 7 V). Where this data reveals religious belief: exercise of rights under a contract (art. 11 II "d") | No |
| The Biblianza journal | Journal entries | Your specific and highlighted consent to store them (art. 11 I) and, for storing them outside Brazil, a second, separate consent (art. 33 VIII; section 9) | Yes, two optional consents; you can withdraw either at any time |
| Customer service, refunds, withdrawal requests and complaints | Contact, purchase, request data | Performance of the contract (art. 7 V) and compliance with legal obligations, including consumer rules (art. 7 II) | No |
| Tax, accounting and dispute records, including card disputes | Purchase, consent and offer-acceptance records | Legal obligation (art. 7 II) and exercise of rights in proceedings (art. 7 VI) | No |
| Security and prevention of fraud and abuse | Access logs, technical data | Legitimate interest (art. 7 IX): keeping accounts and payments secure and being able to answer card disputes. Never used for sensitive data. | No; you can object (section 12) |
| Marketing e-mails | E-mail address | Consent (art. 7 I). We do not send them without it. | Yes |
| Analytics or advertising measurement (not in use today) | See section 14 | Consent through the cookie notice (art. 7 I) | Yes; nothing runs today |
6. What is required and what is optional
- Required to buy: an e-mail address and the payment details that Stripe asks for. Without them we cannot sell or deliver a product.
- Optional: the journal, reminders and marketing e-mails. Saying no has no effect on your access to what you bought.
- Withdrawal requests and complaints: the required fields are marked on each form. In the Libro de Reclamaciones, a complaint without at least a name, identity document, address or e-mail, date and description is treated as not filed, as the Peruvian regulation provides.
7. Automated decisions and profiling
We do not take decisions about you based solely on automated processing, and we do not build profiles of you. Stripe screens payments automatically to prevent fraud, and this can block a payment; if that happens, contact us and we will look into it.
8. Who receives your data
We never sell or rent personal data. The providers below process data for us, under their data-processing terms and only for the service described. Stripe also uses some data for its own purposes, as its row explains.
| Recipient | What for | Data | Where it processes data |
|---|---|---|---|
| Stripe (our contract is with Stripe Brasil Soluções de Pagamento - Instituição de Pagamento Ltda) | Payment processing, saving the card under the saved-card agreement, receipts and fraud screening. Stripe processes this payment data for us, as a service provider, under its agreement with us. It also uses personal data collected across its services to detect and prevent losses for its business users, its financial partners, the people who pay and itself. See the Stripe Privacy Policy. | Purchase data, e-mail address, IP address, card details (typed directly into Stripe's checkout) | United States and other countries where Stripe and its service providers operate (see the Stripe Privacy Policy) |
| Cloudflare | Hosting of the website and the web app, database and file storage, content delivery and security | Everything the app stores (account, progress, journal, consent and offer-acceptance records, logs, requests) and technical data | United States (primary location of the app database); the website and the app are delivered through Cloudflare's global network |
| Resend | Sending sign-in links, purchase confirmations and replies | E-mail address and message content | United States |
| Turbo Cloud | Hosting the contato@gdistbrasil.com.br mailbox where your messages to us arrive | Contact and support messages | Brazil |
| Meta Platforms (Meta Pixel) | Advertising measurement, only if we add it | Nothing today. See section 14. | Not in use |
| Public authorities and courts | When the law requires it | Only what is required | — |
9. International transfers
GDIST is established in Brazil. If you live in another country, your data is sent to Brazil, where the LGPD protects it. From Brazil, some of the providers in section 8 process data in other countries:
| Provider | Destination country | Data | Legal basis for the transfer (LGPD) |
|---|---|---|---|
| Stripe | United States and other countries where Stripe and its service providers operate (Stripe Privacy Policy) | Payment data | Art. 33 IX: necessary to perform the contract you requested (art. 7 V) |
| Cloudflare | United States (primary location of the app database); global delivery network for the website and the app | Account, progress, consent and offer-acceptance records, logs, requests and technical data | Art. 33 IX: necessary to perform the contract you requested (art. 7 V) |
| Cloudflare | United States | Journal entries | Art. 33 VIII: your specific and highlighted consent, given separately and with prior information about the international nature of the transfer (the second journal consent, section 4) |
| E-mail sending provider (section 8) | The country stated in section 8 | E-mail address and message content | Art. 33 IX: necessary to perform the contract you requested (art. 7 V) |
The contato@gdistbrasil.com.br mailbox is hosted in Brazil (Turbo Cloud), so the messages you send to it are not transferred outside Brazil by us. If we ever add an advertising tag, its transfer will rely on your consent in the cookie notice (art. 33 VIII), stated there before it loads.
We do not use the standard contractual clauses of Brazil's data-protection authority (ANPD) as a transfer mechanism. We do not rely on any decision recognising these destination countries as offering an adequate level of protection, and we do not state that they offer one: these transfers rely on the LGPD art. 33 bases in the table above, together with each provider's data-processing terms and the security measures in section 11.
10. How long we keep data
- Biblianza account, progress and settings: while your account exists. When you delete it, access ends at once, journal entries are erased immediately, your e-mail address is replaced by an anonymous placeholder, and the remaining account data is purged within 30 days.
- Journal entries: until you delete them, withdraw either journal consent (the journal turns off and all entries are deleted, after the app offers you a download), or delete your account.
- Access logs: 12 months.
- Purchase records (date, item, amount, currency, Stripe reference and consent log): kept after account deletion for as long as tax rules and card-dispute rules require.
- Support messages, withdrawal requests and complaints: for as long as needed to handle them and, when linked to a purchase, together with the purchase records.
- Stripe keeps its own payment records under its own legal obligations.
11. Security and incidents
- The website and the app are served only over HTTPS.
- Card details are typed into Stripe's checkout, which complies with PCI DSS; we never receive or store the full card number.
- There are no passwords: you sign in with single-use links that expire, and your session uses a secure, HTTP-only cookie.
- Your journal and progress are available only to your signed-in account and never appear on a public page.
- Administrative access to our systems is limited to GDIST, and we keep access logs to detect misuse.
No method of transmission or storage is completely secure. If a security incident may affect your personal data, we investigate and contain it, and we notify the competent authorities and the people affected as the applicable laws require, including within the 48-hour period set by Peru's data-protection regulation (DS 016-2024-JUS, art. 34.3).
12. Your rights and how to exercise them
Wherever you live, you can ask us, free of charge, for:
- confirmation that we hold your data, and access to it;
- correction of incomplete, inaccurate or outdated data;
- anonymisation, blocking or deletion of data that is unnecessary, excessive or unlawfully processed, and deletion of data processed with your consent;
- portability of your data;
- information about who we share it with, and about the option of not giving consent and what follows from that;
- objection to processing, including processing based on legitimate interest;
- withdrawal of consent at any time, without affecting the lawfulness of processing carried out before the withdrawal.
In Mexico these include your ARCO rights (access, rectification, cancellation and opposition).
How: in Biblianza Settings you can export your data, delete journal entries, withdraw either journal consent and delete your account. For anything else, write to contato@gdistbrasil.com.br, call +55 11 92019-1877 or send a letter to the address in section 1. To protect your data, we may ask you to confirm the request from the e-mail address linked to your account. We answer within the deadlines set by the law that applies to you.
Authorities: if we reject your request or do not answer in time, you can go to a data-protection authority: in Brazil, the Autoridade Nacional de Proteção de Dados (ANPD); in Chile, the Agencia de Protección de Datos Personales; in Peru, the Autoridad Nacional de Protección de Datos Personales; in Colombia, the Superintendencia de Industria y Comercio; in Argentina, the Agencia de Acceso a la Información Pública; in Mexico or any other country, the competent authority of your country.
13. Ways to limit the use of your data
- Leave the journal off, or withdraw either journal consent in Settings.
- Turn reminders off in Settings.
- Do not opt in to marketing e-mails, or unsubscribe at any time.
- Refuse or change optional cookies in Cookie settings (none are in use today).
- Ask us by e-mail to restrict or stop a specific use of your data.
14. Cookies and browser storage
Today we use essential storage only:
- a secure, HTTP-only session cookie that keeps you signed in to Biblianza;
- your browser's storage, to remember your cookie choice and to cache the app's basic files.
No analytics or advertising tag loads on this website or in the app today. If we ever add one (for example the Meta Pixel), we will name it in section 8 before it starts, it will load only after you accept it in our cookie notice, and it will never receive your name, e-mail address, card details, journal entries or progress. You can change your choice at any time in Cookie settings.
15. Children
Our website and products are intended for adults, and you must be 18 or over to buy. Biblianza family content is meant to be used by an adult with children; children do not have accounts. We do not knowingly collect personal data from children. Please do not write children's personal details in the journal. If you believe a child has given us personal data, contact us and we will delete it.
16. Information for specific countries
- Chile
- This policy provides the information required by article 14 ter of Law 19.628 as amended by Law 21.719: policy date and version (top of the page), controller and legal representative (section 1), contact channel (section 1), data, people concerned, recipients, purposes and legal bases including legitimate interests (sections 2, 3, 5 and 8), security (section 11), rights and recourse to the Agencia (section 12), international transfers with the destination country of each provider and the basis relied on (section 9), retention (section 10), sources (section 3), withdrawal of consent (section 12) and automated decisions (section 7). The e-mail address for data subjects and for the Agencia is contato@gdistbrasil.com.br. Sensitive data (the journal) is processed only with your express consent.
- Peru
- Law 29733 and its regulation (DS 016-2024-JUS). Representative for the territory of Peru (para el territorio peruano), contact point with the Autoridad Nacional de Protección de Datos Personales and for data subjects: Guilherme Costa Fernandes (GDIST), e-mail contato@gdistbrasil.com.br. Databases: "GDIST customers and contacts" and "Biblianza users". The information required by article 6.1 of the regulation is in sections 1, 3, 5, 6, 7, 8, 9, 10 and 12. Publishing this policy does not replace your consent where consent is required.
- Mexico
- This page is our full privacy notice (aviso de privacidad integral) under the Federal Law on Protection of Personal Data Held by Private Parties (LFPDPPP): identity and address of the controller (section 1), data and sensitive data (sections 3 and 4), purposes, showing which need consent (section 5), options to limit use (section 13), ARCO rights (section 12) and how we communicate changes (section 17). The simplified privacy notice (aviso de privacidad simplificado) at the top of this page is shown where we collect your data: on the sales page, next to the purchase button, on the app sign-in page and on the withdrawal and complaints forms; it links to this page.
- Colombia
- Law 1581 of 2012: providing sensitive data is optional, and no part of Biblianza depends on the journal. Your rights are in section 12.
- Argentina
- Law 25.326: your rights are in section 12.
- United States and other countries
- The rights and choices in sections 12 to 14 are available to everyone.
17. Changes to this policy
When we change this policy, we publish the new version on this page with a new version number and date. If a change affects how we use data you have already given us, we tell Biblianza account holders by e-mail before it applies, and if a change requires your consent (for example for the journal), we ask for it again before applying it.
18. Contact
45.791.707 GUILHERME COSTA FERNANDES (GDIST), CNPJ 45.791.707/0001-00, Rua Oceânica Amábile, 207, Apt 43, bloco Cristiana, Ocian, Praia Grande - SP, 11704-420, Brazil · contato@gdistbrasil.com.br · +55 11 92019-1877 (Mon–Fri, 9am–6pm Brasília time, UTC−3) · contact page.