Privacy Policy

Last updated: July 23, 2026

POPME Inc. (“POPME”) Headquarters: 8 THE GREEN STE A, DOVER, Delaware — USA

The purpose of this Notice is to demonstrate our commitment to safeguarding your privacy and protecting your Personal Data, establishing the rules regarding Processing, as well as explaining what your rights are and how to exercise them.

Please read this Notice carefully and, if you still have any questions, feel free to contact us through the Service Channels provided here.

About PopMe

PopMe is not just a video app: it is a digital trust infrastructure. We were born to reverse the logic of traditional social networks: here, trust comes before reach, context before popularity, and human control before algorithmic optimization. This Notice explains how we process your personal data in compliance with the Brazilian General Data Protection Law (LGPD - Brazilian Law No. 13.709/2018) and other applicable legislation, ensuring that your real experiences remain under your control.

At PopMe we believe that digital trust only exists if you are the true owner of your identity and your moments. PopMe allows users to use technology to build their own digital reputation, giving them the control button over which layers of context they wish to share.

Basic Concepts

For a better understanding of this Notice, the following definitions should be considered:

Algorithm: a set of rules that provides a sequence of operations capable of solving a specific problem or performing a task.
Notice: this Privacy Notice.
Personal Data: data relating to a natural person that is capable of identifying them or making them identifiable. For example: name, email, ID number, personal preferences, IP address, geolocation.
Sensitive Personal Data: any Data concerning racial or ethnic origin, religious belief, political opinion, membership in a trade union or in a religious, philosophical, or political organization, data concerning health or sexual life, genetic or biometric data, when linked to a natural person.
Data Protection Officer (DPO): a person appointed by PopMe to act as a communication channel between us, the Personal Data Subjects, and the competent national authority, such as the ANPD (Brazilian National Data Protection Authority) within Brazil.
Applicable legislation: all legislation dealing with privacy and the protection of Personal Data, especially Law No. 13.709/2018 (Brazilian General Data Protection Law – LGPD), the California Consumer Privacy Act (CCPA), and the General Data Protection Regulation (GDPR).
Our environments: designates the PopMe application.
Personal Data Subject: you, the natural person to whom the Personal Data refers, whether in the capacity of a User of the application.
International data transfer: the transfer of personal data to a foreign country or to an international organization of which the country is a member.
Processing: any operation carried out with Personal Data, such as those relating to collection, production, receipt, classification, use, access, reproduction, transmission, distribution, processing, filing, storage, deletion, evaluation or control of information, modification, communication, transfer, dissemination, or extraction.

How We Collect Your Data and Context Proof

At PopMe, your data will be processed when you interact with us:

What we process?	Why we process it?
Contact information: Name, National identification document, Address, Date of birth, Country/Region, Email, Photo, Phone number, Gender	To identify and authenticate you; to fulfill the obligations arising from our services, including compliance with legal and regulatory provisions; to comply with contractual obligations and for algorithmic training in order to direct content; to protect you with respect to the prevention of fraud and associated risks, as well as compliance with legal and regulatory obligations; to expand our relationship, such as when conducting surveys; to inform you about news, features, content, updates, and other events that we consider relevant to you, especially those related to our products and services.
Digital identification information: IP address and Source Logical Port, Device (operating system version), Geolocation, Date and time records, Screens accessed, Session ID, Cookies	To identify and authenticate you; to comply with the legal record-keeping obligations established by the Brazilian Internet Civil Framework (Marco Civil da Internet - Law 12.965/2014); and to develop new features and improvements.
Sensitive information: Biometric data	To identify and authenticate you, for the purpose of fraud prevention and the Subject’s security.

Accuracy and truthfulness of the Data. You are solely responsible for the accuracy, truthfulness, or updating of the Data you provide to us. We are not obligated to process your Data if there are reasons to believe that such Processing could result in a violation of any applicable law, or if you are using our environments for any illegal or unlawful purposes.

Database. The database formed through the collection of Data is our property and is under our responsibility, and its use, access, and sharing, when necessary, will be carried out within the limits and purposes described in this Notice.

We do not use any type of solely automated decision-making that affects your interests.

Records of Real Experiences (Videos)

Unlike other networks that apply filters and artificial intelligence to modify your image, PopMe records videos at the moment they happen. We do not use facial recognition for commercial profiling, nor do we sell your information to third-party databases.

Context Metadata

To ensure that a video is real, we need context. When capturing an experience, PopMe records the time and geolocation.

Timestamp (Exact Time): to prove that the record is current.
Validated Geolocation: we use the GPS signal only to confirm that the video was recorded at the indicated location.
Human Control: you decide whether the exact location will be displayed publicly or whether only the system’s “authenticity validation” will be shown.

At PopMe, your trust is our greatest asset. The sharing of information occurs only in strategic situations, always guided by best practices and in accordance with current legislation. The Data processed and the recorded activities (logs) may be shared:

With competent judicial, administrative, or governmental authorities, whenever there is a legal determination, request, requisition, or order to that effect;
With service providers or partner companies, to facilitate, provide, or perform activities related to Our Environments, including infrastructure and cloud providers and authentication services; and
Automatically, in the case of corporate transactions, such as a merger, acquisition, or incorporation of PopMe.

If you have any questions about who we share your Data with, please contact us through the Service Channels provided at the end of this Notice.

Data Anonymization. For the purposes of market intelligence research, disclosure of information to the press, and the running of advertisements, the Data will be shared in an anonymized manner, in a way that does not allow for your identification.

How We Protect Your Data and How You Can Also Protect It

Security and Governance Practices. To safeguard your privacy and protect your Data, we have a governance program that contains rules of best practices, internal policies, and procedures, which establish conditions of organization, training, educational actions, and mechanisms for the supervision and mitigation of risks related to the Processing of Personal Data.

Data access, proportionality, and relevance. Internally, the Data processed is accessed only by duly authorized professionals, respecting the principles of proportionality, necessity, and relevance to our business objectives, in addition to the commitment to confidentiality and the preservation of your privacy under the terms of this Notice. In the event of individual leaks or unauthorized access relating to your Personal Data, we may promote, provided that these represent relevant harm or risk to you and you agree, direct conciliation under the terms of Art. 52, § 7 of the Brazilian General Data Protection Law.

Adoption of best practices. You are also responsible for the confidentiality of your Data and must always be aware that sharing passwords and access data violates this Notice and may compromise the security of your Data and of Our Environments. If you identify or become aware of a compromise in the security of your Data, contact our Data Protection Officer through the Service Channels provided at the end of this Notice.

External links. When you use Our Environments, you may be directed, via link, to other websites, portals, or platforms, which may collect your Data and have their own privacy policy. It will be your responsibility to read such policies, and it is your responsibility to accept or reject them. We are not responsible for the privacy policies of third parties, nor for the content of any websites or services linked to environments other than our own.

Processing by third parties under our guidelines. We seek to carefully evaluate our partners and service providers and enter into contractual obligations with them regarding confidentiality, information security, and Data protection, with the aim of protecting you.

Encryption at Rest and in Transit. Your videos and context data are encrypted from the moment of recording until storage.

Pseudonymization. We adopt the technique of replacing identifiable data with internal identifiers (PIDs), ensuring that the analysis of the system’s integrity does not need to expose your real identity.

At PopMe, the privacy and confidentiality of your data are priorities. To foster the development of our trust infrastructure and to contribute to the understanding of real experiences, we adopt the following statistical processing practice:

Aggregate and Statistical Processing

As with market best practices, PopMe processes usage information in an aggregate and statistical manner. This means that:

The data is grouped by segments and trends, and not individually.
We use these metrics to generate knowledge about real behavior, the validity of contexts, and digital security.
Anonymization: whenever possible, we will use technical means so that the data loses the possibility of direct or indirect association with you, transforming it into Anonymized Data (as per Art. 5, XI of the LGPD), which is not considered personal data for the purposes of the law.

Purpose of Data Intelligence

The use of this statistical data has the following objectives:

To improve the accuracy of our context proofs.
To develop new services that reinforce user security.
To share trend reports with partners and clients, ensuring that no individual identity is revealed in this process.

Confidentiality Guarantee

The personal information of our users that has not been anonymized remains protected. The sharing of statistical intelligence with third parties will not include information that would allow for your re-identification.

How We Store Your Data and the Activity Log (Logs)

At PopMe, the life cycle of your data is guided by the real usefulness of the information for your trust infrastructure.

Storage location. We store your personal data and activity records (logs) on our own servers or on the servers of carefully selected partners. To protect your privacy, we adopt strict security measures, both technical and administrative, to ensure that your data is secure, accessible only by authorized persons, and protected against improper alterations. Our commitment is to preserve the confidentiality, integrity, and availability of your data throughout the entire period in which it is under our responsibility.

If the storage of your personal data occurs on servers located outside Brazil, we may be facing an international data transfer; in this case, the provisions of the International Data Transfer section will apply.

Storage period. We store the Data only for the time necessary to fulfill the purposes for which it was processed or to comply with any legal or regulatory obligations, or for the preservation of rights.

Data disposal. Once the retention period and the legal necessity have ended, the Data will be deleted using secure disposal methods or used in an anonymized manner for statistical purposes.

Account Inactivity

Following the standard of security and governance, if your account becomes inactive for any reason, your information and personal data may continue to be processed. This occurs to:

Ensure the integrity of the interactions and “context proofs” that you generated for other users.
Maintain activity histories and contractual aspects.
Respond to audits or judicial and public authorities.

International Data Transfer

Regarding the data collected in Brazil, in order to enable and improve the performance of our activities, some of our resources and servers, as well as those of our partners and service providers, are located outside Brazilian territory, thus characterizing an international transfer of your personal data for the following purposes:

Purpose	Destination Countries
Cloud storage	USA

We take the necessary care to ensure that the transfers comply with the guidelines established by current legislation, and we only transfer your personal data to partners who demonstrate compliance with applicable legislation, maintaining a level of compliance similar to or more stringent than that provided for in Brazilian legislation.

We maintain contracts with these partners that require rigor in the protection of your personal data and in information security. These contracts ensure that your personal data is kept confidential and processed only to fulfill the purposes indicated above.

What Your Rights Are and How to Exercise Them

Your basic rights. The Data is yours, and the applicable legislation provides a series of rights related to it, which may be exercised by you through a request to our Data Protection Officer via the Service Channel provided at the end of this Notice.

Confirmation and access: you may request confirmation of the existence of Processing and access to your Data, including through a request for copies of the records we have about you.
Correction: you may request the correction of your Data that is incomplete, inaccurate, or outdated.
Anonymization, blocking, or deletion: you may request the anonymization of your Data, so that it can no longer be related to you, the blocking of your Data, temporarily suspending the possibility of Processing for certain purposes, or the deletion of your Data.
Portability: you may request that we provide your Data in a structured and interoperable format for the purpose of transferring it to a third party, respecting our intellectual property or trade secrets.
Information about sharing: you may request information about third parties with whom we share your Data, limiting this disclosure to information that does not violate our intellectual property or trade secrets.
Withdrawal of consent: you may choose to withdraw consent for any purpose to which you have consented. This withdrawal will not affect the legality of any Processing carried out previously. If you withdraw your consent for purposes fundamental to the regular functioning of our environments and services, these may become unavailable to you.
Objection: you may object to the Processing of your Data if you do not agree with any purpose.
Review: in the case of decisions based exclusively on automated processing, you may request a review of the decision, indicating your interests that may have been affected.
Access to contractual clauses: if your personal data is transferred internationally, based on standard or specific contractual clauses, you may request access to these clauses, subject to the confidentiality of our commercial and industrial secrets.

Request. For your security, whenever you submit a request to exercise your rights, we may request additional information to verify your identity, seeking to prevent fraud.

Non-fulfillment of requests. We may fail to fulfill a request to exercise rights if fulfilling it would violate our intellectual property or trade secrets, as well as when there is a legal or regulatory obligation to retain Data. In addition, we may fail to fulfill your request if we need to retain the Data to enable our defense or that of third parties in disputes of any nature.

Responses to requests. We are committed to responding to all requests within a reasonable period and always in accordance with applicable legislation.

Petition to the ANPD. In any case, you have the right to petition the ANPD (Brazilian National Data Protection Authority) regarding the processing of your Personal Data, if you believe that your rights have been violated or that we have not adequately addressed your request.

Permanent Deletion

If you wish to end your journey on PopMe and permanently delete your data, you may do so at any time through the app’s settings or by sending an email to dpo@popme.io.

What happens after the deletion request?

Removal of Identifiers: your identifiable personal data will be deleted from our production databases.
Statistical Data: as mentioned in the sharing section, the data that has already been anonymized (having lost its link to you) will remain in our database for statistical purposes and for improving the infrastructure, as permitted by the LGPD.
Legal Retention: only the information strictly necessary for compliance with legal obligations (such as the access records required by the Brazilian Internet Civil Framework - Marco Civil da Internet) or for defense in judicial proceedings will remain in our database.

Information About This Notice

Amendment of content and updates. You acknowledge our right to change the content of this Notice at any time, according to purpose or necessity. When relevant updates occur in the Notice, you will be notified through the contact details you provide to us or by disclosure on our official profiles.

Inapplicability. If any point of this Notice is deemed inapplicable by a Data Authority or judicial authority, the remaining conditions will remain in full force and effect.

Service Channels. In case of any questions regarding the provisions contained in this Notice, including to exercise your rights, you may contact our Data Protection Officer, who is available at the following addresses:

Data Protection Officer: DPO
Contact email: dpo@popme.io
In-App Trust Center: the “Download your data” and “Delete account” tabs are available on the platform for exporting and deleting data.

Applicable law. This Notice will be interpreted in accordance with the applicable privacy legislation.