Custí Privacy Policy
Effective October 14, 2026. This is a courtesy translation: if there is any conflict, the Portuguese version prevails.
Custí is an app for people who make and sell food: recipes, production, inventory, pricing, quotes and orders. This policy explains, in plain language, which data the app and this website use, why, who it is shared with, how long it is kept and what your rights are, under Brazil's General Data Protection Law (LGPD, Law 13,709/2018) and, for users outside Brazil, the applicable local laws such as the EU GDPR.
1. Who is responsible for your data
Controller: ARVISTUDIO MARKETING COMERCIO E
PRODUCOES LTDA, Brazilian company registration (CNPJ) 66.495.497/0001-74
("Arvistudio", "we").
Address: Av. Paulista, 1636, Conj. 4, Pavimento 15,
Bela Vista, São Paulo/SP, Brazil, ZIP 01310-200.
Data protection officer (DPO) channel and data subject requests:
support@arvistudio.com.br.
2. The principle: your business data is yours
Everything you write down in Custí (ingredients, recipes, costs, prices, customers, quotes, orders, sales) is stored securely on your device and synced with your account in the cloud. We do not sell that data and we do not use it for advertising.
- An account is required: to use the app you sign in with Google, Apple or e-mail. We keep your e-mail and a user identifier for login.
- Free plan: your catalog (business profile, including the logo, ingredients, supplies, products and recipes), purchases (with the batch and cost they create) and quotes are synced with our servers, tied to your account only, so they work on more than one device and are not lost with the device.
- Premium subscription: in addition, production runs, inventory, sales, orders, customers and fixed costs are synced too.
3. Which data we process, why, and on what legal basis
| Data | Purpose | Legal basis (LGPD) |
|---|---|---|
| Account: e-mail, user identifier, login provider (Google or Apple) and name, when the provider sends it. If you use a password, it is never stored in readable form. | Create the account, authenticate, recover access and link the subscription. | Performance of a contract (art. 7, V). |
| Business data (in the cloud on every plan; production runs, inventory, sales, orders and fixed costs only with premium): business profile (name, legal name, tax ID, phone, e-mail, address, logo), ingredients, recipes, products, inventory, production runs, prices, quotes, orders and sales. | Sync between devices and restore on a new device. | Performance of a contract (art. 7, V). |
| Third-party data you enter (premium feature): customers (name, phone, address, notes). | Record quotes and orders. For this data you are the controller and we are the processor: we only store and sync it on your behalf and on your instructions. You are responsible for having a legal basis to use it and for answering your customers' requests. | Performance of a contract (art. 7, V), on the user's behalf. |
| Subscription: user identifier, technical install identifier, receipts and subscription status. | Activate, maintain and restore the premium plan and block misuse. Processed by the Apple and Google stores and by the service that manages subscriptions. | Performance of a contract (art. 7, V). |
| Usage and crash telemetry: app usage information, technical device data (such as model, operating system and app version) and crash logs. It does not include your business content and is not linked to your account. | Understand usage, measure stability and fix bugs. | Legitimate interest (art. 7, IX). |
| Notifications: production and delivery reminders are scheduled on and stay on the device. For remote notices (subscription, app news) we use a technical identifier to deliver them. | Deliver the reminders you turn on and notices about your subscription and news. News notices can be turned off in Settings → Notifications. | Performance of a contract (subscription) and legitimate interest (news), with the option to opt out. |
| Advertising in the free version: device advertising identifiers and technical data about the ad shown. | Show the ads that support the free version. With your consent (tracking prompt on iPhone and, where the law requires it, a consent form), ads may be personalized; without consent we show non-personalized ads. Premium shows no ads. | Consent (art. 7, I) for personalization; legitimate interest for non-personalized ads. |
| Campaign measurement: an anonymous install identifier and app events, such as subscribing. | Measure the results of Custí's own marketing campaigns. Your business data is never shared. Where the device asks for tracking authorization, only with your permission. | Legitimate interest (art. 7, IX); consent (art. 7, I) where tracking requires authorization. |
| Biometrics: if you enable the app lock, the device's operating system performs the check (fingerprint or face). | Lock the app. Custí does not receive or store biometric data: the system only answers whether the check passed. | No biometric data is processed by Custí. |
| Photos: the business logo you pick from your gallery. | Show the logo on quote, order and report PDFs. It is stored with your account data. We do not access other photos. | Performance of a contract (art. 7, V). |
Data copy: the app does not produce backup files. The copy of your business data is your account's cloud: signing out clears the device, and signing in again brings everything back.
4. Who the data is shared with
Only with the processors needed for the app to work, under contract and only for the purposes in this policy:
- Cloud service: login and storage of synced data, on every plan;
- Analytics and notification tools: usage statistics for the app and for visits to this website, crash reports and notification delivery;
- Subscription service: subscription management and validation;
- Ad network: ad serving in the free version, according to your consent;
- Advertising platforms: measurement of Custí's own marketing campaigns;
- Apple App Store and Google Play: processing of purchases and subscriptions. We never receive your card details;
- Public authorities, when there is a legal obligation or court order.
We do not sell personal data and we do not share your business data with advertisers. The list of processors is available on request at support@arvistudio.com.br.
5. International transfer
Some of these processors may store or process data outside Brazil. These transfers follow art. 33 of the LGPD and rely on standard contractual clauses and on those processors' data protection commitments. More information is available on request through our contact channel.
6. How long we keep data
- Local data: stays on the device until you delete it, start over from the danger zone in settings, sign out, or uninstall the app.
- Account: as long as it exists. When you delete the account, the user and all cloud data tied to it are erased immediately.
- Synced data of the free plan (catalog, purchases and quotes): as long as the account exists.
- Synced data of premium (production runs, inventory, sales, orders, customers and fixed costs): while the subscription is active. After it ends, it stays in the cloud for 6 months in case you come back (the app shows the countdown) and is then removed automatically. Data on your device is not deleted.
- Telemetry: usage statistics for 2 months counted from your last activity in the app, and crash reports for up to 90 days.
- Subscription and purchases: purchase records are kept by the stores and by the service that manages subscriptions for as long as legal and tax obligations require (art. 16, I, LGPD), even after the account is deleted.
- Notification identifier: until you uninstall the app or turn notifications off.
7. Your rights and how to exercise them
The LGPD (art. 18) gives you the right to: confirm whether we process your data, access it, correct it, anonymize, block or delete it, request portability, know who we share it with, know what happens if you do not consent, withdraw consent, object to processing based on legitimate interest, and file a petition with Brazil's National Data Protection Authority (ANPD). In practice:
- Access and take your data (portability): request it by e-mail at support@arvistudio.com.br, from the account's e-mail, and we will help you.
- Delete the account and everything in the cloud: in the app, Settings → Account → delete my account; or on the web at custi.arvistudio.com.br/en/delete-account.html (sign in and confirm). Deletion is immediate and irreversible.
- News notices: turn off in Settings → Notifications. Local reminders are turned on and off there as well.
- Personalized ads: on iPhone, Settings → Privacy & Security → Tracking; on Android, Settings → Google → Ads (reset or delete the advertising ID). Where the consent form is shown, your choice can be revisited through the form itself.
- Any other request (correction, objection, sharing information, etc.): write to support@arvistudio.com.br. We reply within 15 days, as the LGPD requires.
Important: deleting the account does not cancel the subscription, which is managed by the store. Cancel it first in the App Store (Settings → Subscriptions) or Google Play (Payments & subscriptions), otherwise billing continues.
8. Children and teenagers
Custí is a work tool intended for adults aged 18 or older. It is not directed at children or teenagers, and we do not knowingly collect data from anyone under 13. Creating an account and subscribing to premium require being 18 or having a legal guardian's authorization.
9. Security
We adopt technical and administrative measures to protect your data against unauthorized access, loss or alteration, on the device and in the cloud, and access to synced data is restricted to your account. In the event of a security incident that may cause you relevant risk or harm, we will notify the ANPD and the affected users, as the LGPD requires.
10. This website
This website uses Google Analytics, a Google service, to count visits and clicks: which pages are opened and in which language, which links are clicked (the app stores, the terms, this policy, the calculator, the pages for each type of business, the language switch and the menu), which page or search the visit came from, the approximate location (city and country, worked out from your IP address, which is not stored) and the type of device and browser. To recognize the same browser from one visit to the next, Google Analytics stores cookies in your browser that last up to 2 years.
We do this to learn how many people visit the website and what leads them to download the app, so we can improve the website and how we promote Custí. The legal basis is legitimate interest (art. 7, IX). This data is kept in Google Analytics for 2 months from your last visit and does not include your name, your email or anything you type into the calculator, which stays in your browser. We do not use it for ads and we do not link it to your Custí account or your Google account.
To opt out, install the Google Analytics opt-out browser add-on or use a content blocker in your browser. Blocking this website's cookies stops your browser from being recognized from one visit to the next. If you visit from the European Union, the European Economic Area, the United Kingdom or Switzerland, the website stores no analytics cookies and your visit only counts toward an estimate.
This website also uses tools from the advertising platforms where Custí is promoted, to measure those ads. They record the pages opened and taps on the app store buttons, and store cookies in your browser. The purpose is to learn which ads lead people to download the app and to show Custí's ads to people who are more likely to be interested. These tools are only turned on if you accept cookies in the website's notice (consent, art. 7, I), and you can change your choice at any time through the website's Cookies link.
Fonts are served by this website itself. The account deletion page loads a component from an external service, which receives your IP address only to deliver the file.
11. Users outside Brazil
Where Custí is available in other countries, the rights and legal bases above apply equivalently under local law (for example the GDPR in the European Union and the United Kingdom), including the right to lodge a complaint with your country's data protection authority. The contact for exercising those rights is the same as in this policy.
12. Changes to this policy
If this policy changes, we will update this page and the effective date at the top. Material changes will also be announced in the app.
13. Contact
ARVISTUDIO MARKETING COMERCIO E PRODUCOES LTDA, CNPJ 66.495.497/0001-74, Av. Paulista, 1636, Conj. 4, Pavimento 15, Bela Vista, São Paulo/SP, Brazil, ZIP 01310-200. Questions, privacy and data subject rights: support@arvistudio.com.br.