Privacy Policy

1. Data We Collect

Account data: email and password (hash) when you register. Payment data: CPF/CNPJ for processing via Appmax; card data is processed directly by Appmax and not stored on our servers.

Processed files: the PDFs you upload are processed for the requested operation and automatically deleted within 24 hours. We do not access or analyze the contents of your files.

Usage data: aggregated metrics (tools used, processing volume) for service improvement. We do not individually track your activity for advertising purposes.

2. How We Use Your Data

• Provide and maintain the Service;
• Process payments and manage paid access periods;
• Send notifications about your account and service updates;
• Prevent fraud and misuse;
• Fulfill legal obligations.

3. Legal Basis (LGPD)

We process your data based on: contract execution (provision of the Service), consent (communications), legal obligation, and legitimate interest (security and fraud prevention). You may withdraw your consent at any time.

4. Data Sharing

We share data only with:

• Payment processor: receives CPF or CNPJ, the purchase amount, and card details. It's the one who charges, not us.
• Cloudflare: hosts the application and stores the uploaded files (R2). Receives your IP address and the file contents.
• AI infrastructure providers: run summarization, translation, AI OCR, and the AI Detector. They receive the document text during task execution. They only come into action when you use one of these tools.
• Google: only if you choose to sign in with your Google account. In that case, the login happens on their side.
• Transactional email provider: sends registration confirmation, password recovery, and account notifications. Receives your email.
• Error monitoring: logs application failures so we can fix them. May store your account identifier and technical browser data.

We do not sell or rent your data to third parties.

5. Data Retention

Processed files: deleted within 24 hours. Account data: retained while your account is active; deleted within 90 days after deletion request. Financial data: retained per legal obligation (5 years).

6. Your Rights (LGPD/GDPR)

You have the right to:

• Access the data we hold about you;
• Correct incomplete or inaccurate data;
• Request deletion of your data (“right to be forgotten”);
• Data portability;
• Revoke consent at any time.

To exercise your rights, contact [email protected].

7. Security

We use TLS 1.3 encryption in transit, passwords stored with bcrypt, JWT with 24h expiration, and per-user data isolation. Access to production data is restricted and audited.

8. International Transfer

Your data may be processed on servers in the European Union (Cloudflare R2) and in Brazil. Transfers follow standard contractual clauses approved by the ANPD.

9. Children

The Service is not directed at individuals under 16. We do not knowingly collect data from minors.

10. Contact

For privacy matters: [email protected].