Privacy Policy

This Policy explains what data Play+ collects, why it collects it, with whom it is shared and what your rights are, under Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018).

1. Who the controller is

The data controller is Play+, responsible for Play+: a media player app, a per-device license and the web pages for activation and management. Play+ does not provide content; everything played comes from playlists added by the user.

2. Data we collect

From the device (for the license to work and to prevent fraud)

• device identifier: on Android, the system identifier reserved for the app (the same until the device is factory reset); on TVs via the web, a random identifier created the first time the app is opened. The app does not read the MAC address;
• device code and key, generated by our server;
• model, platform and app version;
• IP address and access dates.

Provided by the user

• playlist name, server address, playlist username and password;
• email address, when provided at purchase (optional, for the receipt);
• favorites, “continue watching” history and app preferences.

Payment data

Amount, date, status and transaction ID at Mercado Pago. We do not receive or store bank or card details.

We do not collect identity documents, precise location, contacts, photos or sensitive data.

3. What we use it for

• validating the license and the trial period of each device (performance of contract);
• connecting the app to the playlists the user added and syncing them between the web page and the device (performance of contract);
• confirming payments and releasing the activation (performance of contract);
• preventing fraud, abuse and attacks, and keeping the access logs required by Brazil's Internet Civil Framework (Marco Civil da Internet) (legal obligation and legitimate interest);
• providing support and handling data subject requests;
• complying with court orders and requests from authorities (legal obligation).

We do not sell data and do not use it for advertising.

4. Playlist credentials

Playlist usernames and passwords are stored on our server encrypted (AES-256), only so that the app can open the playlist on the user's device. We do not use these credentials for any other purpose. When the playlist is deleted, they are deleted with it.

5. Sharing

• Mercado Pago, to process the Pix payment (transaction data and, if provided, the email address);
• infrastructure providers (servers and network), under contract and only to operate the service;
• the partner who activated the device, who can see the code, model and license expiry of that device;
• authorities, upon a court order or legal request.

When a playlist is opened, the device and our server communicate with the playlist server chosen by the user. That third party has its own privacy policy, over which we have no control.

6. Security

We use encrypted connections (HTTPS), encrypted passwords and credentials, restricted access to our systems and backups. No system is completely immune to incidents; if one occurs that creates a relevant risk, we will notify the data subjects and the ANPD (Brazil's National Data Protection Authority), as required by law.

7. How long we keep data

• device data and playlists: while the device uses the service, and up to 12 months after the last access;
• access logs (IP, date and time): 6 months, as required by the Marco Civil da Internet;
• payment records: for the period required by tax law (up to 5 years).

8. Your rights

Under the LGPD, you may request at any time:

• confirmation that we process your data, and access to it;
• correction of incomplete or inaccurate data;
• anonymization, blocking or deletion of unnecessary data;
• portability;
• information about whom we share it with;
• withdrawal of consent, when consent is the legal basis for the processing.

To do so, use the channels below and include the device code. To confirm that the request is yours, we may ask for the key shown in the app. We reply within 15 days.

9. Storage on the device

The app stores the session, preferences and the last license status on the device itself, so it opens faster. The web pages use only one technical cookie, which expires after 2 hours, to keep access to the device page. We do not use advertising or tracking cookies.

10. Children and adolescents

The service is purchased by people aged 18 or over. The app has a parental control to hide adult content, which must be set up by the parent or guardian.

11. International transfer

Our servers are located in the European Union (France), with a provider subject to the GDPR, which offers a level of protection compatible with the LGPD. The transfer is made to provide the contracted service and with the safeguards required by Articles 33 et seq. of the LGPD.

12. Changes

This Policy may be updated. The version in force is always on this page, with the date at the top.

13. Data protection officer and contact

Data protection officer (encarregado): Play+.

Contact page.