International Data Transfer - Rufi

Last updated: May 22, 2026

1. What is an International Data Transfer?

An international transfer occurs when your personal data is sent to servers located outside Brazil. The LGPD (Law 13,709/2018, Art. 33) requires that such transfers have an adequate legal basis and that you are informed.

2. Where may your data be transferred?

2.1 OpenAI — United States

• Purpose: Processing of financial analyses and the AI assistant
• Data: Anonymized transactions (categories, rounded amounts, no merchant names)
• Legal basis: Consent of the data subject (Art. 33, VIII of the LGPD)
• Protection: OpenAI follows the privacy policy available at openai.com/privacy

2.2 Cloudflare R2 — Global Infrastructure

• Purpose: Secure storage of images and profile files
• Data: Avatar photos and item images (not personally identifiable data)
• Legal basis: Performance of a contract

3. Your Rights

Under the LGPD, you have the right to:

• Be informed about international transfers (done in this document)
• Revoke consent for transfers for AI purposes at any time
• Request information about the safeguards applied

4. How to Revoke Consent

You can turn off the use of AI in the app settings under Settings → Privacy → AI Analysis. After revocation, your data will no longer be sent for external processing.

5. DPO Contact

For questions about international data transfer: dpo@rufi.app