Draft, to be reviewed by a lawyer before launch
Privacy policy
Last updated: 20 October 2026. This policy follows Brazil's General Data Protection Law (LGPD, Lei 13.709/2018).
Who is responsible
The data controller is [SELLER LEGAL NAME], CNPJ [00.000.000/0000-00]. Data protection officer (encarregado): [NAME], [DPO EMAIL].
What we collect
| data | why | legal basis |
|---|---|---|
| Email, and the name, company and use case you choose to give | to create your key, send it to you and support you | contract (Art. 7, V) |
| IP address at sign-up, and API call logs (time, action, status, number of results) | security, abuse prevention, quotas and billing | legitimate interest (Art. 7, IX) |
| Billing details (name, CPF or CNPJ, email) for paid plans | invoices and tax records | contract and legal obligation (Art. 7, II and V) |
We don't collect card numbers; the payment provider handles them. We store only a hash of your API key, never the key itself.
Who we share it with
Only providers that help us run the service: Cloudflare (hosting), Supabase (database, São Paulo region), Brevo (email), Asaas and, later, Stripe (payments). Some of them process data outside Brazil under the safeguards of LGPD Art. 33. We never sell your data.
How long we keep it
Account data while your key is active and for up to 12 months after it ends. Call logs for 12 months. Billing records for 5 years, as tax law requires.
Your rights
Under LGPD Art. 18 you can ask to confirm, access, correct, export or delete your data, and to withdraw consent where we rely on it. Email [DPO EMAIL] and we'll answer within 15 days. You can also complain to the ANPD (Autoridade Nacional de Proteção de Dados).
Security
Traffic is encrypted (HTTPS), keys are stored hashed, database access is restricted to the service, and we back up nightly.
Changes
We'll email key holders about material changes at least 15 days before they take effect.