What we keep, and why

1. Who handles your data

The controller is [preencher: razão social], registered under CNPJ [preencher: CNPJ], with offices at [preencher: endereço].

For any request about your data, the channel is [preencher: e-mail do encarregado]. Every request is answered, within 15 days.

2. What is collected from site visitors

In the diagnosis form and the contact form: name, email, company, role, and the answers you write. Stored alongside them are the page language, the browser you used, and a code derived from your IP address.

That code is not your IP. It is the output of a salted hash applied to the IP and truncated to 32 characters, and it exists only to contain form abuse. There is no way back from it to the original address, and when the salt is not configured the field stays empty.

There is no advertising cookie, social pixel, or third-party tracker on the site.

3. What is collected from clients

Your registration: name, email, and the account you belong to. Authentication is handled by a third-party provider, and your password never reaches us in readable form.

What you build inside the platform: your professional identity, your subject territories, your brand, the writing samples you send so the platform can recognise your voice, the briefs, the generated pieces, and your notes about them.

If you upload them, we also keep your photo and your brand images. If you use the Insights area, we keep the numbers you bring from your own LinkedIn reports, exactly as you send them.

And we keep the operational record of every generation: which stage ran, which model was used, what it cost, and whether it worked. That is what supports the house's accounting and your credit statement.

4. What it is for, and on what legal basis

For those filling in the diagnosis, the basis is your consent, given in the box you tick before sending. There is a single use: preparing and presenting the assessment, and talking to you about it. You may withdraw consent at any time.

For clients, the basis is performance of the contract: without the data in this section the platform cannot produce what you hired it for. The operational cost record rests on compliance with legal obligation and on the legitimate interest of keeping the accounting correct.

Your data is never sold, rented, or handed to third-party advertising, under any circumstance.

5. Who else touches this data

The platform runs on third-party services, and they are processors in LGPD terms: hosting and database, transactional email delivery, payment processing when you buy a plan, and the artificial intelligence providers that generate text and images.

What goes to the AI providers is the content needed to produce the piece you asked for: your brief, your identity material, and your voice samples. The API contracts the platform uses provide that this content is not used to train their models.

Some of these services have servers outside Brazil, which constitutes an international transfer. It happens under article 33 of the LGPD, to perform the contract with you.

6. How long it is kept

The diagnosis and contact data are kept for as long as the commercial conversation lasts, and are deleted when you ask.

Client material is kept while the account exists. Once the account is closed, you may request deletion of the content, and it is carried out.

Cost records and audit logs are kept for the statutory accounting and tax retention period, because the law requires it. They contain an account identifier and amounts, not the content of your pieces.

7. Your rights

Article 18 of the LGPD guarantees you: confirmation that processing exists, access to the data, correction of anything incomplete or wrong, anonymisation or deletion of what is unnecessary, portability, information about who we share with, and withdrawal of consent.

All of them are exercised through the same channel: [preencher: e-mail do encarregado]. We charge nothing for it and ask for no justification.

8. Security

Database access is isolated per account at the data layer itself, not only at the screen: one account cannot reach another's material even if someone bypasses the interface.

When support needs to enter your account to investigate something, it enters in read mode: it sees everything and writes nothing, and spends none of your credit. That access is logged.

No system is immune. In the event of an incident with relevant risk to you, we notify you and the Brazilian data protection authority within the statutory deadline.

9. Changes to this text

When this document changes, the date at the top changes with it. A change that alters the purpose of processing or the legal basis is communicated to account holders before it takes effect.