Draft — to be reviewed. This page is a draft and hasn't been checked by a UK lawyer yet. It may change before Deberi opens in the UK.
Privacy notice
Last updated: 26 October 2026
This notice explains what personal data Deberi collects, why, who we share it with and the rights you have under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. It covers our website (deberi.app), the Deberi app and our WhatsApp number.
1. Who we are
Deberi is a trading name of Jailton Rocha Cardoso Ltda, a company registered in Brazil (CNPJ 37.200.262/0001-00), at Rua Tomé de Souza, 07, Caetité – BA, 46400-000, Brazil. For the personal data described here, we are the controller. Contact us about privacy at help@deberi.app.
Because we're based outside the UK, we will appoint a representative in the UK, as the UK GDPR requires. Their details will be added here before Deberi opens in the UK.
2. What we collect
About you and your business
- Your name, your business name and what you sell.
- Your mobile number (to send your login codes by WhatsApp and, if you want, to use Deberi from WhatsApp).
- If you log in with Google: your name, email address and profile picture from your Google account.
- Your VAT number and your accountant's email address, if you add them.
What you record in Deberi
- Your items, prices and stock.
- Your sales: what was sold, the amount, the time and how it was paid (cash, card or bank transfer).
- Your expenses and bills.
- Your till: the float, cash put in or taken out (and why), and what you counted when you cashed up.
- Your WhatsApp number, and the messages, voice notes and photos you send to our number (for example a photo of your menu), together with our replies.
Your subscription
- Paddle, our online reseller, handles payments. We get your subscription status, plan, country and invoices from Paddle. We never see your full card details.
Technical data
- Your IP address, the type of device and browser you use, the pages you open and error reports. We count visits on our own server without cookies.
3. Why we use it and our lawful basis
| What we do | Lawful basis |
|---|---|
| Create your account, log you in and run your till, reports and files for your accountant | Contract |
| Let you sell, cash up and log expenses from WhatsApp, and send your end-of-day summary | Contract |
| Read the items and prices from a photo, list or voice note you send, to set up your items for you | Contract |
| Manage your trial and subscription with Paddle | Contract |
| Answer your questions and help when something goes wrong | Contract, and our legitimate interest in giving good support |
| Keep Deberi secure, prevent fraud and misuse, and fix errors | Legitimate interests |
| Tell you about new features by email or WhatsApp (you can opt out at any time) | Legitimate interests |
| See which of our ads work, with cookies (only if you accept them) | Consent |
| Keep the records the law requires, such as for tax | Legal obligation |
We don't sell your data and we don't use it to make decisions about you that have legal or similarly significant effects.
4. Who we share it with
We only share personal data with companies that help us run Deberi, under contracts that protect it:
- Cloudflare: hosts the website and the app, and stores your data.
- Meta (WhatsApp Business Platform): carries the messages between you and our WhatsApp number, and sends your login codes by WhatsApp.
- Paddle.com: sells the subscription as Merchant of Record and takes the payment. Paddle is also a controller of the payment data it collects, under its own privacy notice.
- Google: lets you log in with your Google account, if you choose to.
- Our email provider, to send you emails, and the providers that read text from photos and turn voice notes into text.
- Google Analytics and the Meta Pixel: only if you accept cookies (see below).
We may also share data if the law requires it, or to protect our rights or the safety of others.
5. Data you put in about other people
If you record personal data about your customers or staff in Deberi (for example a customer's mobile number to send a receipt), your business is the controller of that data and Deberi is your processor: we only use it to provide Deberi to you, following your instructions. Our duties as your processor are set out in our Terms of Use. If you're one of those customers, please contact the business directly.
6. Transfers outside the UK
We're based in Brazil, and our providers may process data in other countries. When personal data leaves the UK, we use the safeguards UK law requires, such as UK adequacy regulations, the ICO's International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
7. How long we keep it
- While you have an account, we keep your data so Deberi can show your history and reports.
- If you close your account, we delete your business records within 90 days. Download them first if you want to keep them.
- If you don't subscribe after the free trial, we delete the account after 12 months without use, or sooner if you ask.
- We keep records we need for tax, legal claims or security (such as invoices and our messages with you) for up to 6 years.
8. How we keep it safe
Your data travels encrypted (HTTPS), access is limited to the people who need it to run Deberi, and logging in needs a code sent to your WhatsApp or your Google account.
9. Your rights
You have the right to:
- get a copy of your personal data;
- have it corrected if it's wrong;
- have it deleted;
- restrict or object to how we use it, including for legitimate interests and new feature messages;
- get the data you gave us in a format you can take elsewhere;
- withdraw your consent at any time, for example to cookies.
To use any of these rights, email help@deberi.app. It's free, and we'll reply within one month. We may ask you to confirm who you are first.
10. Complaints
If you're unhappy with how we use your data, please tell us first at help@deberi.app. You also have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.
11. Children
Deberi is for businesses and isn't meant for anyone under 18.
12. Cookies
Cookies are small files a website saves in your browser. We use some that are essential for Deberi to work. We only use the others, for measuring our ads, if you click "Accept all" or turn them on in "Customise". Nothing non-essential is set until you choose.
Essential (always on)
| Name | What it does | How long |
|---|---|---|
better-auth.session_token and similar login cookies | Keep you logged in | Until you log out, or up to a few weeks |
deberi:uk:cookies (stored in your browser) | Remembers your cookie choice | Until you clear it |
| Sales waiting to be sent (stored in your browser) | Keeps the sales you make without internet until they reach Deberi | Until they're sent |
Ads and measurement (only if you accept)
| Name | What it does | How long |
|---|---|---|
_ga, _ga_* (Google Analytics) | Counts visits and shows which pages and ads bring people to Deberi | Up to 2 years |
_fbp, _fbc (Meta Pixel) | Shows Meta which of our Facebook and Instagram ads led to a visit or a sign-up | Up to 90 days |
deberi_fbc | Our own copy of the Meta ad you clicked, so a sign-up can be matched to that ad | 90 days |
You can change your mind at any time. If you turn these cookies off, we delete them from this website.
13. Changes to this notice
If we change this notice in a way that matters to you, we'll tell you by email or in the app. The date at the top shows the latest version.
14. Contact
Email help@deberi.app or write to Jailton Rocha Cardoso Ltda, Rua Tomé de Souza, 07, Caetité – BA, 46400-000, Brazil.