Manifest

Privacy Policy

Version 1.0 · Last updated: 20/10/2026

1. Who we are and to whom this Policy applies

1.1. Tric is the artificial intelligence (AI) agent for couples, a product of NOH PAY LTDA ("Noh", "we"), registered with the CNPJ (Brazilian National Registry of Legal Entities) under No. 44.179.162/0001-04, headquartered at Rua José Filipe da Silva, 326, sala 3, Jardim Ester, São Paulo/SP, CEP 05372-040. For purposes of the LGPD (Brazil's General Data Protection Law, Law No. 13,709/2018), Noh is the controller of the personal data processed in Tric, except in the cases indicated in this Policy.

1.2. This Policy applies to anyone who uses the Tric apps for iOS and Android, the tric.bot website and Tric's official channels (the "Services"), including anyone who joins the waitlist, receives an invitation or participates in a Group with Tric ("You"). It is an integral part of Tric's Terms of Use (Part II of this document).

1.3. Tric is offered only in Brazil, and the processing of personal data in the Services is governed by Brazilian law.

1.4. Tric is a standalone app, separate from Noh's joint account app. Using Tric does not open a payment account, card or Noh account. If You are also a customer of the Noh app, the data from that app remains governed by Noh's Privacy Policy (www.noh.com.br/politica-de-privacidade).

1.5. Data sharing via Open Finance and the initiation of Pix payments are carried out by Iniciador Instituição de Pagamento Ltda. (CNPJ 44.471.172/0001-19), an institution authorized by the Central Bank of Brazil (Banco Central do Brasil, BCB). Iniciador acts as an independent controller of the data it processes for these purposes, in accordance with its own policy and Tric's Open Finance Terms (Part III of this document).

2. How Tric works, in summary

2.1. Tric participates in a single group chat with the two people in the couple (or pair). She organizes their routine: reminders, lists, calendar, household bills, division of chores, and trip and event planning. With Your approval, she also carries out tasks, such as paying a bill by Pix, making a reservation or a purchase, and sending an email.

2.2. Privacy principles that guide the product:

3. Definitions

3.1. For convenience, we use these terms:

4. What data we process and for what purposes

4.1. Waitlist and invitations. Data: mobile or WhatsApp number, date and source of registration, and invitation code. Purpose: to notify You of the launch and when it is Your turn to join, to manage the invitation queue and to prevent fraud. Legal basis: consent (Art. 7, I) and legitimate interest (Art. 7, IX).

4.2. Registration. Registration requires only a mobile number, used to create and authenticate Your account and the Group. Legal basis: performance of a contract (Art. 7, V). By accepting the Terms, You declare that You are 18 years of age or older.

4.3. Data provided in conversation. During use, Tric may naturally ask for Your name, age, routine, work, important dates and other information that helps the couple. Answering is optional: You share only what You want, and Tric works with whatever she has. Legal basis: performance of a contract.

4.4. Group conversations and submitted content. Data: messages, audio, images, files, spreadsheets, boletos (Brazilian bank payment slips) and documents sent, reactions (such as the 👍 for approval) and the Group history. Purpose: to understand requests, respond, carry out tasks and maintain the couple's joint history. Legal basis: performance of a contract and regular exercise of rights (Art. 7, V and VI).

4.5. Memory and personalization. Data: information You tell Tric or that Tric picks up from the Connected Services, such as birthdays, agreements on splitting bills and chores, preferences (restaurants, travel, diet, allergies), and information about children, pets and family members. Purpose: to personalize assistance, remember what matters and anticipate problems. Legal basis: performance of a contract and, for sensitive data, clause 5. Tric separates what she was told from what she inferred: inferences are treated as hypotheses and confirmed with You before being used or stored.

4.6. Financial data via Open Finance. Data: CPF (Brazilian individual taxpayer ID, requested only when connecting a bank), account holder identification, accounts, balances, transactions and the combined assets of the connected accounts. Purpose: to show the couple's consolidated view, categorize spending, calculate the split and balance, alert about upcoming bills and unusual charges, and suggest which account to pay from. Legal basis: specific consent given in the Open Finance journey (Art. 7, I), performance of a contract and BCB regulations, in accordance with Tric's Open Finance Terms. No one may connect the bank account of another CPF.

4.7. Pix payments (JSR). Data: transaction data (amount, payee, Pix key, QR Code), linked bank and account, limits, device risk signals (operating system, identifiers, integrity, language, time zone, root/jailbreak indicator and, if authorized, geolocation) and the record of the approval. Purpose: to link the account, initiate and record payments and prevent fraud. Legal basis: performance of a contract, compliance with legal and regulatory obligations and legitimate interest in fraud prevention (Art. 7, II, V and IX). Noh and Iniciador do not collect Your biometrics: authentication takes place on Your device, using the FIDO2 standard.

4.8. Connected Services (email, calendar, files and others). Data: what each Connector makes available within the permissions You granted, such as appointments, emails, files and contacts. Tric reads this data and also acts on it, for example by creating or changing events, organizing files and preparing and sending emails, always within Your permissions and the approval rules of the Terms. Purpose: to carry out tasks, alert You to deadlines and conflicts and act on Your behalf. Legal basis: performance of a contract and consent. Before each connection, Tric informs You what she will read, what she may do, what Your partner will be able to see and that You may disconnect whenever You wish. New Connectors may be added over time, always with Your authorization.

4.9. Secure Vault: credentials and cards. Passwords for third-party services and Your card details, when You decide to save them, are kept in the Secure Vault, an encrypted vault provided by a specialized vendor. They are used only at the moment of an approved action, such as a purchase on a third-party website, without the AI model seeing the secrets. Verification codes (OTP) are treated as opaque references and are used only after Your approval.

4.10. Personal documents. CPF, RG (Brazilian identity card), certificates and account numbers are not stored in Tric's Memory. Documents You ask Tric to keep are stored in encrypted files, appear only in the Group, are used only for the task that requires them and are passed on to third parties only with approval.

4.11. Actions and approvals. Data: the record of each task and routine, who requested it, who approved it, when, with what amount and conditions, and the result. Purpose: to execute safely, provide evidence of approvals and payments and allow review and dispute. Legal basis: performance of a contract, regular exercise of rights and legitimate interest.

4.12. Technical and usage data. Data: IP address, date and time of access, device, operating system, app identifiers, notification token, usage events, crashes and, if authorized, approximate location. Purpose: security, fraud prevention, retention of access logs (Art. 15 of the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet, Law No. 12,965/2014)) and product improvement. Legal basis: compliance with a legal obligation and legitimate interest.

4.13. Notifications and communications. Every chat message generates a notification on Your phone, and Tric has no quiet hours. We also send relationship and marketing (CRM) notifications, which may arrive at any time. WhatsApp and SMS are used only for transactional notices, the waitlist and invitations, and Tric does not converse through these channels. Legal basis: performance of a contract for transactional communications; consent or legitimate interest for marketing. You may turn off notifications in Your phone settings and unsubscribe from marketing at any time.

4.14. Customer support. Data: conversations with Noh's support team (ajuda@tric.bot), which steps in in exceptional cases. Before a team member joins a conversation or task, Tric gives notice. Legal basis: performance of a contract and regular exercise of rights.

5. Sensitive data and minimum age

5.1. Sensitive personal data (Art. 5, II, of the LGPD) may appear in Tric, such as health data (appointments, medications, health plan), data that reveals or allows inference of sexual orientation (e.g., the makeup of the couple), religion, as well as information about the relationship and emotional well-being.

5.2. We process only the sensitive data You decide to share, for the requested purpose (e.g., reminding You of the time to take a medication), based on specific and highlighted consent collected on a dedicated screen during onboarding (Art. 11, I) or, where applicable, to protect life or physical safety (Art. 11, II, "e"). You may revoke this consent at any time. Tric does not diagnose, does not give treatment guidance and does not presume the makeup of the couple.

5.3. Financial data is not sensitive under the LGPD, but it is protected by confidentiality and by BCB rules, and receives enhanced care.

5.4. Emotional risk. If someone in the Group shows signs of serious emotional risk or of being afraid of someone, Tric follows a fixed protocol: she responds in the Group with neutral text, without exposing who said what, and points to official channels (CVV 188 (Centro de Valorização da Vida, a suicide-prevention hotline), Central de Atendimento à Mulher 180 (Women's Assistance Hotline), 190 and 192). Tric does not notify third parties, family members or authorities on her own and does not call anyone.

5.5. Minimum age. Tric is only for people over 18. Age is confirmed by self-declaration upon acceptance of the Terms and, when there is a bank connection, by the CPF via Open Finance. If we identify that a user is under 18, including through information given in conversation, the account is suspended and the user's data is deleted, except for retention required by law.

5.6. Data about children and third parties. Tric may keep information about children and other people that You share (e.g., school schedule, vaccination, birthday), always in the best interest of the child or adolescent (Art. 14 of the LGPD), only to help with the family's routine and without sharing it outside the Group. Share only what is necessary. By sharing data about children, You declare that You are their father, mother or legal guardian.

6. How privacy works between the two people in the couple

6.1. Joint history. The Group is a single, shared chat. Everything written in it, by You, by Your partner or by Tric, is seen by both people and is kept as the couple's joint history. Until Your partner joins, the Group is just You and Tric, and that history becomes visible to Your partner upon joining.

6.2. Individual data. Individual data, including Open Finance data, is linked to each person (P1 or P2), even when the information was provided by the other person. Each person authorizes their own banks and Connectors and chooses what the other person can see, for example only the free and busy times on their calendar. When information from one of Your Connectors is brought into the Group, it becomes visible to both of You.

6.3. Open Finance. The banking data You share (balances and transactions) is visible to Your partner, as configured. You may revoke this sharing at any time, without needing the other person's agreement, and future data will no longer appear.

6.4. What one person says about the other. If P1 provides data about P2 (name, birthday, routine), that data is linked to P2. P1 declares that P1 has a legitimate basis to share it. Upon joining, P2 is informed of what Tric already knows about P2 and may correct it or ask for it to be deleted.

6.5. No surveillance. Tric does not monitor or report one person's activities at the other's request, does not on her own compare who spends more or does more chores, and does not use what she knows about a person to persuade that person of something.

6.6. Actions on a person's behalf. Messages or emails on a person's behalf are sent from that person's account, signed only with that person's name, after that person approves. Payments go out only with the biometrics of the person paying.

6.7. One person leaving and separation. Either person may leave the Group at any time, without needing the other's agreement. When a person leaves:

Deleting the app or logging out on the phone does not close the Group: to do so, You must leave the Group through the app or request it through the support channels.

6.8. Account deletion. If a person deletes their account, their messages are deleted or anonymized, subject to the legal retention set out in clause 9. The other person's portion is deleted only when that person also requests it.

6.9. Each person's rights. Each person is the data subject of their own data and exercises their rights (clause 8) individually. Requests involving joint content are handled in a way that respects the rights of both people.

7. With whom we share data

7.1. Noh does not sell Your personal data. We share data only in the cases below and to the extent necessary:

AI providers process data only to provide the service to Noh and are contractually prohibited from using Tric data to train their own models.

7.2. Third-party content that Tric reads (emails, websites, files, transaction descriptions) does not give orders to Tric and does not expand what she may do or share.

8. Your rights as a data subject

8.1. Under Art. 18 of the LGPD, You may request at any time: (i) confirmation that we process Your data; (ii) access; (iii) correction; (iv) anonymization, blocking or deletion of data that is unnecessary, excessive or processed in noncompliance with the law; (v) portability, in accordance with the regulations of the ANPD (Brazil's National Data Protection Authority, Autoridade Nacional de Proteção de Dados); (vi) deletion of data processed based on consent; (vii) information about with whom we share data; (viii) information about the possibility of not giving consent and the consequences of refusing; (ix) revocation of consent; (x) objection to processing carried out on another legal basis, in the event of noncompliance with the LGPD; and (xi) review of automated decisions (clause 10). You may also file a petition with the ANPD and consumer protection agencies.

8.2. In-app controls. You may:

8.3. Response times. Confirmation and access in simplified format: immediately. Complete statement: within 15 days. Other requests: within 30 days, with notice to You if a complex case requires more time. We may request information to confirm Your identity before fulfilling a request.

9. How long we keep data

9.1. The LGPD does not set a minimum retention period. Data is deleted when the purpose that justified the processing ends (Art. 15) and is kept only when necessary to comply with a legal or regulatory obligation or to exercise rights (Art. 16).

9.2. Retention periods:

9.3. The couple's separation does not change these periods. After they end, the data is deleted or anonymized, and backup copies are overwritten in the normal backup cycle.

9.4. Death. In the event of a user's death, a family member may submit the death certificate through the support channels. The account is closed, and the data is kept for the legal period and then deleted.

10. Artificial intelligence and automated decisions

10.1. Tric uses AI models to understand messages, generate responses, categorize transactions, suggest which account to pay from, calculate the couple's split and balance, identify unusual spending, propose the division of simple chores and moderate the Group name.

10.2. These functions support the couple's decisions but do not replace them: actions that involve a cost, involve third parties or are hard to undo depend on approval. Simple chores may be assigned directly, and either person may decline or adjust them.

10.3. Tric does not make decisions about credit, employment, housing, insurance or any other rights of Yours.

10.4. You may request clear information about the criteria for an automated decision that affects Your interests and request its review (Art. 20 of the LGPD) by email to privacidade@tric.bot, subject to commercial and industrial secrets.

10.5. Improving Tric and training models. Noh uses conversations and interactions with Tric to improve the service, including to evaluate and train AI models. To do so, we remove direct identifiers, such as names, phone numbers, emails and CPF, and unlink the interactions from Your account. You may refuse this use at any time in Settings. The AI providers engaged by Noh are contractually prohibited from training their own models with Tric data.

10.6. Advertising. We do not share the content of Group conversations or Connector data with advertisers.

11. International data transfer

11.1. Data is processed in the cloud, including outside Brazil, mainly in the United States, by vendors such as AI and infrastructure providers. These transfers are based on the standard contractual clauses approved by the ANPD (ANPD Board Resolution CD/ANPD No. 19/2024; Art. 33, II, "b", of the LGPD), and we require vendors to provide security and protection guarantees equivalent to those in this Policy.

12. Cookies on the tric.bot website

12.1. The tric.bot website uses: (a) essential cookies, necessary for the website to work and to store Your choices; (b) measurement cookies, to understand visits and website performance (e.g., Google Analytics and Google Tag Manager); and (c) advertising cookies, to measure campaigns and show ads (e.g., Google Ads).

12.2. Non-essential cookies (measurement and advertising) are activated only after Your consent in the website banner, and You may change Your choice at any time. The apps do not use cookies, but they collect technical data, as described in clause 4.12.

13. Information security

13.1. We adopt technical and administrative measures such as: encryption in transit and at rest (including of documents and the Secure Vault), need-based access control, authentication, logging and traceability of Tric's actions, environment segregation, periodic vulnerability testing and backups.

13.2. Agent-specific protections: approval and payment checks run outside the AI model; there are protections against malicious instructions hidden in emails, websites and files ("prompt injection"); and the AI model does not see passwords, cards, biometrics or verification codes.

13.3. No system is infallible. Review Tric's actions and grant only the access You are comfortable with. Tric and Noh never ask for a password, code, document or payment via WhatsApp, SMS, email or phone call. Anyone asking for this on Tric's behalf is attempting a scam.

13.4. In the event of a security incident that may cause relevant risk or harm, we will notify the ANPD and the affected data subjects, under Art. 48 of the LGPD.

14. How to contact us

14.1. Data Protection Officer (DPO) (Encarregado pelo tratamento de dados pessoais): privacidade@tric.bot.

14.2. Support and reporting of unexpected behavior by Tric: ajuda@tric.bot or the in-app chat. Noh also maintains the customer service line (SAC) 0800 326 0965.

15. Changes to this Policy

15.1. We may update this Policy to reflect changes in the Services, the law or vendors, including in the illustrative list in clause 7. We will notify You in the app with reasonable advance notice and, when a change requires new consent, we will ask for it.