LGPD for AI-built apps with users in Brazil: what you need
If your app processes personal data of people in Brazil, you need five things before launch: a list of the data you collect and why, a legal basis for each use, a privacy policy that matches the app, a contact channel for users and an incident plan. Breaches with relevant risk go to the ANPD within three business days.
Heartscale’s recommendation: before you write the policy, check table by table what the app collects and where each item is stored. With sensitive data, children’s data or real users, get a technical review before launch and take the legal side to a lawyer licensed in Brazil.
This is practical guidance, not legal advice. It follows Brazil’s Law 13,709/2018 (LGPD) and the rules of the ANPD, Brazil’s data protection authority, as checked in October 2026. For your specific case, talk to a lawyer licensed in Brazil.
Does the LGPD apply to your app?
Article 3 says the law applies to any processing, in any medium, when it happens in Brazil, when it aims to offer goods or services to people in Brazil, or when the data was collected in Brazil. Where the company or the server sits does not matter.
Personal data is any information related to an identified or identifiable natural person (art. 5, I). Name, email, phone number, CPF (the Brazilian taxpayer ID) and profile photo are common examples in apps.
It also does not matter whether you built the app with Lovable, Bolt, Base44 or Replit. You decide what happens to the data, so you are the controller (art. 5, VI). Services that store and process data on your behalf, such as your database and hosting, usually act as processors (art. 5, VII).
Micro and small companies, startups and individuals get simplified rules under Resolution CD/ANPD No. 2/2022. The resolution itself says the rest of the law still applies. Its definitions follow Brazilian company law, so a foreign startup should confirm with counsel whether it qualifies.
Step 1: list the data your app collects
Open your app and write down everything it asks for or records:
- sign-up fields, forms and profile data;
- your database tables (in Supabase, the Table Editor shows all of them);
- files uploaded by users;
- analytics tools, ad pixels and support chat;
- data sent to third-party APIs, including AI APIs that receive text typed by users.
For each item, note what it is for, where it is stored and who else can access it. This list is the basis of the record of processing activities required by article 37. Small processing agents may keep this record in a simplified form (Resolution No. 2/2022, art. 9).
In our reviews, we cross-check this list against the database and the code. We look for columns no screen uses, files in public buckets and calls that send data to outside services.
Step 2: collect only what you need
The necessity principle limits processing to the minimum required for its purpose (art. 6, III). The purpose principle requires legitimate, specific and explicit purposes that are disclosed to the user (art. 6, I).
In practice:
- do not ask for a CPF, birth date or address if the app does not use them;
- do not store a full ID document when you only need to know it was checked;
- set a retention period for each item and delete it when the purpose ends (arts. 15 and 16), unless a legal obligation requires keeping it.
App builders often generate extra fields and tables. Review what the AI created before you open sign-ups.
Step 3: pick a legal basis for each use
Article 7 lists ten legal bases. The ones that show up most in apps:
| Use of the data | Usual legal basis | Article |
|---|---|---|
| Create the account and deliver the service | Contract performance | art. 7, V |
| Keep data the law requires, such as tax records | Legal or regulatory obligation | art. 7, II |
| Prevent fraud and protect accounts | Legitimate interest | art. 7, IX |
| Newsletter, marketing and optional features | Consent | art. 7, I |
Legitimate interest does not apply when the user’s fundamental rights prevail, and article 37 asks for particular care in recording these cases.
Two groups have stricter rules:
- Sensitive data, such as health, racial origin, religion, biometrics and sex life (art. 5, II). Article 11 narrows the legal bases and requires specific, highlighted consent in most cases.
- Children. Article 14 requires specific consent from at least one parent or legal guardian.
If your app handles either, get legal advice before launch.
Step 4: ask for consent when it is the basis
Under article 8, consent must:
- be given in writing or by another means that shows the user’s will;
- refer to specific purposes, since generic authorizations are void;
- be revocable at any time.
The controller carries the burden of proving consent. In the app, that means an option separate from the terms of use, which the user ticks on their own, and a database record with the date and the version of the text accepted. Offer a simple way to withdraw consent too, for example in account settings.
Step 5: publish a privacy policy that matches the app
Article 9 says information must be given in a clear, adequate and prominent way. The policy needs at least:
- the purpose of each processing activity;
- how and for how long data is processed;
- who the controller is and how to reach them;
- who receives the data and why;
- the user’s rights and how to exercise them;
- the contact of the DPO or of the contact channel.
An AI-generated template helps you start, but check every line against your list from step 1. A policy that describes a different app informs no one. For users in Brazil, we recommend a Portuguese version.
Step 6: know where the data lives and lock down access
Write down the region of your database, file storage and backups. If data leaves Brazil, article 33 and Resolution CD/ANPD No. 19/2024 govern international transfers. Check which contractual safeguards your provider offers and say so in the policy.
Article 46 requires technical and administrative measures against unauthorized access. In Supabase apps, that starts with:
- RLS on every table, with per-operation policies. See Supabase RLS: how to configure and test it;
- the secret key kept out of the browser and the repository. See Supabase key exposed: which key is safe in the browser?;
- dashboard access limited to a few people with protected logins.
Step 7: get ready for data subject requests
Article 18 gives users, among other rights: confirmation that processing exists, access, correction, anonymization, blocking or deletion of unnecessary data, portability, information on who received the data, and withdrawal of consent.
Under article 19, confirmation and access are given immediately in simplified form, or within 15 days in a full statement. Small processing agents get double the deadline for these requests, under the applicable rules (Resolution No. 2/2022, art. 14).
Before launch, have two things ready: a way to export one user’s data and a flow to delete an account and the data tied to it.
Step 8: appoint a DPO or open a channel
Article 41 requires the controller to appoint a DPO (encarregado) and publish their identity and contact, preferably on the website. The DPO handles user complaints and communications from the ANPD.
Small processing agents are exempt from appointing one (Resolution No. 2/2022, art. 11), but they must keep a communication channel for users. The exemption does not cover high-risk processing or companies above the resolution’s revenue limits (art. 3). A dedicated email address, published in the policy, is the simplest way to offer that channel.
Step 9: have a security incident plan
Resolution CD/ANPD No. 15/2024 governs the notice required by article 48 of the LGPD. The key points:
- What to report: a confirmed incident involving personal data that may cause relevant risk or harm. Factors include sensitive data, data of children, teenagers or the elderly, financial data, authentication data and large-scale data, among others (art. 5).
- Deadline: three business days, to both the ANPD and affected users, counted from when the controller learns the incident affected personal data (arts. 6 and 9).
- How: through electronic filing on SEI!ANPD, using the incident notice form. Missing details can be added within 20 business days.
- To users: plain language, direct and individual whenever possible, by email, SMS or another channel your app already uses.
- Records: every incident, including those not reported, stays on record for at least five years (art. 10).
Resolution No. 2/2022 also gives small processing agents double the deadline for this notice, with exceptions. Check the current text when you need it.
Write the plan before launch: who decides, who can read the logs, how to rotate keys and passwords, and what message goes to users. Three business days go by fast.
What happens if you skip this
Article 52 provides for sanctions that include warnings, blocking or deletion of data, and a simple fine of up to 2% of revenue, capped at R$ 50 million per infraction. Article 42 requires repairing damage caused to users.
For a technical security review, see the AI-built app security page.
Do it yourself or hire help?
A small app with little data can cover most of this checklist without help. The table separates the technical side from the legal one.
| Situation | Path |
|---|---|
| Simple sign-up (name and email), no sensitive data, and you know your database tables | Follow steps 1 to 9 and publish a policy that matches the app |
| The app was generated by AI and you do not know which tables, fields and outside services receive data | Get a technical review of what the app collects and where it stores it |
| Sensitive data, children’s data or transfers out of Brazil | Talk to a lawyer licensed in Brazil before launch; a technical review comes in as a complement |
| The app already has real users and no data export or account deletion | Request a Heartscale diagnostic to map data, access and flows |
Request a Heartscale diagnostic
Our team maps the data your app collects, where it lives and who can reach it, and checks RLS, keys and the export and account deletion flows. You get a list of what to fix in the app and in the policy before launch. We do not give legal opinions; a technical review reduces the risk, it does not remove it.
The launch-price diagnostic costs US$ 19 (was US$ 79) and is credited toward the fix if you go ahead. We only work on apps whose owners can prove they own them.