Privacy Policy

1. Data we process

Account: name, email and, with Google sign-in, profile picture.

Access and security: sessions, IP address, browser and technical logs.

Content: uploaded documents, extracted data, playbooks, skills and example files.

Billing: customer identifier, plan, invoices and credit history. Card details, tax ID (CPF/CNPJ) and billing address are collected directly by Stripe.

Contact: name, email, company and message sent through the Talk to us page.

2. Purposes and legal bases

Providing the service, authenticating you and billing plans and top-ups: performance of a contract.

Issuing tax documents and meeting legal duties: legal obligation.

Preventing fraud and abuse, keeping the service secure and improving it: legitimate interest.

Answering contact messages: pre-contractual steps or legitimate interest.

3. AI processing

To extract data, document content is sent to a language model provider (Google, Gemini API) only while it is processed. [CONFIRM: use of the provider's paid tier, whose terms forbid using this content to train models.] We do not use your documents to train models.

4. Who we share data with

We use processors acting on our behalf: Amazon Web Services (file storage, queue, processing and email), Vercel (hosting), Neon (database), Google (AI and sign-in), Stripe (payments) and Cloudflare (DNS). Some are outside Brazil; such international transfers rely on contractual clauses and the safeguards provided by the LGPD.

We do not sell personal data.

5. Retention and deletion

Documents, extractions and playbooks are kept until you delete them or your account. Deleting a file also deletes its extraction result.

Payment and tax records are kept for the legal period (usually 5 years). Technical logs are kept for 14 to 30 days. Contact messages are kept as long as needed to answer them, up to 2 years.

6. Your rights

You may request confirmation, access, correction, anonymization, portability and deletion of your data, information about sharing, and withdrawal of consent (LGPD art. 18). Much of this is built into the application: exporting results, deleting files and deleting your account.

For other requests, contact our data protection officer at diegohabrasil@gmail.com. You may also complain to Brazil's National Data Protection Authority (ANPD).

7. Security

Data is encrypted in transit (TLS) and at rest, access is restricted, and sign-in uses short-lived one-time codes instead of passwords.

8. Cookies

We only use essential cookies: sign-in session and language. Your theme preference stays in your browser. We use no advertising or third-party tracking cookies.

9. Changes

This policy may be updated. Relevant changes will be announced on the website or by email.