PRIVACY AND DATA PROTECTION POLICY

1. WHAT DATA WE COLLECT

The experimental and interactive nature of the PLATFORM requires collecting different types of data, depending on your interaction:

• 1.1. Browsing and Device Data (Automatic Collection): When accessing the PLATFORM, we automatically collect server logs, IP address, browser type, language, time zone and operating system. We use technologies such as cookies and local storage to keep your preferences and interface settings.
• 1.2. Registration and Identification Data: For access to exclusive areas, courses or newsletters, we may collect: full name, email address, username (handle) and, occasionally, links to social profiles (GitHub, LinkedIn).
• 1.3. Data for Interactive Experiments (Sensitive Inputs): For AI and automation tools to work, you may voluntarily provide:
  • Media: Photos, images or audio for analysis or content generation.
  • Free Text: Prompts, project descriptions or code snippets.
  • Context: Personal or professional preferences entered in interactive forms.
• 1.4. Facial and Biometric Data (IMGen, AI Photo Generation): When using the professional photo generation tool (IMGen), you will voluntarily provide photographs of your face or of an authorized person. Under the LGPD (Art. 11) and the GDPR, facial data may be considered sensitive personal data. You should know:
  • a) Reference photos (input): Photographs submitted as reference are stored on the PLATFORM infrastructure (database and CDN) and remain linked to your account. The PLATFORM does not separate files by the purpose declared at upload: what you upload joins your account library, so the generation can be reproduced, audited and shown alongside its result. You can delete these files at any time through the interface, and deleting your account removes them under section 7.
  • b) Third-party processing: Reference photos are sent to third-party APIs specifically for: image cropping and processing (FAL.ai) and generation via AI model (Google Imagen/Gemini). Each provider has its own privacy and retention policy.
  • c) Generated results: AI-generated images are stored in your account indefinitely, subject to your account's storage limits. When the storage limit is reached, older images may be removed automatically to free space.
  • d) Deletion by the user: You can delete any generated image directly through the PLATFORM interface, at any time, without requesting it from the MAINTAINERS.
  • e) Consent for third-party images: By submitting a reference photo, you declare to be the person portrayed or to hold that person's express authorization for the use of their image in this context.
• 1.5. Behavioral and Session Data (Microsoft Clarity): The PLATFORM uses Microsoft Clarity (Microsoft Corporation) for aggregated behavioral analysis. With the USER's prior consent via the cookie banner, Clarity captures: clicks, mouse movements, scrolls, touch patterns, session replays and heatmaps. Recordings are automatically sanitized by Microsoft to mask input fields, typed text and sensitive elements. This data is used exclusively to understand usage patterns, identify UX friction points and improve the PLATFORM experience. It is stored by Microsoft under its own privacy policy (privacy.microsoft.com). The USER can refuse this tracking by clicking "Refuse" on the cookie banner.
• 1.6. Financial Data: We do not process payments directly on our servers. Transactions for courses or products are handled entirely by third-party payment processors (e.g. Stripe), to whom you provide your banking data directly.
• 1.7. Personality and Trail Data (Synthetic and "Reflection of Self"): To build your Synthetic and self-knowledge tools, we process your own trail within the ecosystem: texts you publish (chat, Forum theses), generation prompts, Repertoire choices and personality test answers (including MBTI-like typology). This processing generates a "voice", which is a model of your written text style, not a clinical profile and not a recording of your audio voice. The personality code is used only as internal seasoning of tone; it is not published nor converted into clinical statements about you. Text generation involves the Google Gemini model.
• 1.8. AI Narration and Voice: Narration and audio generation tools use curated third-party synthetic voices (ElevenLabs). Article narration uses the PLATFORM's standard voices; we do not clone your audio voice for general use.
• 1.9. Session Token for External Clients (MCP): If you connect an external AI client (e.g. Claude, Gemini, Cursor) to your account, we generate and store a session token that authorizes that client to act on your behalf for a limited period (about 30 days, renewable). While active, the commands and data you send through that client travel through its operator's infrastructure (see section 3). Logging in again revokes the previous token.

2. PURPOSE OF DATA PROCESSING

We use your data for the following strict purposes:

• 2.1. Service and Experiment Execution: Processing your inputs (texts/images) through our own algorithms or third-party APIs to deliver the result promised by the interactive tool.
• 2.2. Security and Protection: Monitoring PLATFORM usage to prevent attacks, fraud, unauthorized scraping and to ensure system integrity.
• 2.3. Communication: Sending updates about courses, new experiments, newsletters (if consented) and important technical or legal notices.
• 2.4. Continuous Improvement: Analyzing usage metrics (anonymized whenever possible) to understand how experiments are used and improve the user experience.

3. SHARING, THIRD-PARTY SERVICES AND PLATFORM NATURE

Sapiens Sintéticos largely acts as a user experience (UX) interface and cultural translation layer for foundational technologies developed by third parties.

• 3.1. Pass-Through Nature: When using our image or text generation tools, the PLATFORM works as a channel that transmits your commands to powerful external APIs.

  This means the actual processing (the "intelligence") and the physical storage of data occur on infrastructures outside our direct control, specifically:

  • AI Models: Google Gemini, Imagen and other foundational models (responsible for processing and content safety rules at the source).
  • Image Processing: FAL.ai (used for cropping, background removal and reference image pre-processing).
  • Storage (CDN): Bunny.net and other cloud services (where image files are physically hosted).
  • AI Audio and Video: ElevenLabs (narration voices and music), Google (Lyria/Vertex for music, Veo for video) and providers routed via WaveSpeed (ByteDance, Kuaishou, Alibaba) for video generation.
  • Analytics and Behavioral Insights: Microsoft Clarity (session replays, heatmaps), Google Analytics and Google Tag Manager, Vercel Analytics (performance and usage metrics), and campaign measurement tags managed via Tag Manager, such as Pinterest and Metricool. These services are only activated upon the USER's explicit consent via the cookie banner, and the list of tags may vary according to active campaigns.
• 3.2. Public Content and Behavior:

  By choosing to "Publish" or make any creation of yours visible in the Community Gallery:

  • a) Remix License: You automatically grant other PLATFORM users the right to use your image as reference, inspiration or base for new generations ("Remix").
  • b) Irreversibility: You acknowledge that publishing is permanent and that, once public, the image cannot return to a private state.
  • c) Privacy Waiver: You acknowledge that information associated with the image (such as the prompt used, technical parameters and your username) will become public.
• 3.3. Tools with Public Financial Data: Some tools (e.g. AI Ecosystem Atlas, Portfolio, Leverage, Weekly briefing) consume public data about financial markets and listed companies, aggregated from:
  • Yahoo Finance: live quotes, historical series and marketCap (via public APIs).
  • Massive Market Data: company overviews, Form 4 (insider transactions) and news with sentiment.
  • SEC (Securities and Exchange Commission): public filings referenced via Massive.
  • xAI (Grok) / X: public signals from authors curated by the Atlas (these are public third-party posts, not personal data of PLATFORM users).

  This data is about listed companies, not natural persons. The PLATFORM USER has no personal data shared with these sources; we only query their public APIs on behalf of the PLATFORM as a whole.

• 3.4. Mandatory Sharing: We may share data with public authorities if required by law or to protect our rights in judicial proceedings.
• 3.5. External AI Clients (MCP): When you connect a third-party AI client to operate your account (e.g. Claude/Anthropic, Gemini/Google, Cursor), the commands, prompts and data you transmit through it are processed by the respective operator's infrastructure. Each operator is an independent data controller, subject to its own privacy policy, outside the PLATFORM's control. We only store a session token authorizing the client to act on your behalf (see section 5).
• 3.6. Community and Forum (Public Content): Messages and theses you publish in the social areas (Community/chat and Forum) are visible to other users and, as applicable, to the public, together with your username. Content posted through an external client receives a transparency marker (e.g. " · via Claude").
• 3.7. Recorded Mentorships: Live mentorship sessions may be recorded and transcribed by third-party tools (e.g. Fathom) for later access by participants. Excerpts are only publicly displayed as social proof upon the participant's recorded consent.
• 3.8. Messaging Channels: If you link an external channel (e.g. Telegram) or interact with us through messaging apps (e.g. WhatsApp), messages travel through those services under their privacy policies.

4. INTERNATIONAL DATA TRANSFER

The PLATFORM is operated from Portugal but uses global infrastructure. By using our services, you are aware and consent that your data may be transferred to, stored and processed on servers located in the United States or other countries that may not have the same data protection laws as your country of residence. We adopt standard contractual safeguards to ensure the security of this data.

5. DATA RETENTION

• 5.1. Registration Data: Kept while your account is active or as needed to provide services.
• 5.2. Experiment Data (Inputs): Texts and images sent to AI tools are, as a rule, transient (processed and discarded), unless the tool specifies it will save the history for your own future access.
• 5.3. Uploaded Files, Including Reference Photos: Files you upload, including photographs used as facial reference, are stored on the PLATFORM infrastructure (database and Bunny.net CDN) for as long as your account exists or until you delete them. They are also transmitted to the AI providers required for processing (for example Google and FAL.ai), each with its own retention policy. You can delete any file through the interface at any time. The MAINTAINERS may also freely remove any file that should not be online, under clause 2.4 of the Terms of Use.
• 5.4. Generated Images (Results): Images produced by IMGen are stored in your account indefinitely, allowing access, download and management. If the account's storage limit is reached, older images may be automatically removed. The USER can delete any generated image at any time through the interface.
• 5.5. Logs: Kept for the period required by law (in Portugal and Brazil) for audit and security purposes (usually 6 to 12 months).
• 5.6. Feed Nature and Technical Control: Sapiens Sintéticos provides a public RSS feed for external distribution and indexing. Given the permanent nature of publishing on the PLATFORM, once an image is indexed by third-party services (such as Pinterest), its public state is consolidated. When you delete content on our PLATFORM, we guarantee the deactivation of the destination link, but physical deletion in third-party databases must follow those platforms' removal terms and procedures.
• 5.7. Removal Requests on Official Channels: Sapiens Sintéticos values its creators' wishes. If you removed content from the site and it still appears on our official social profiles (such as Pinterest) after 72 hours, you may request manual deletion by sending the content link to [email protected].
• 5.8. Sapiens Search Data (Semantic Search): When using Sapiens Search, we collect and store: the textual content of your queries, your identifying email, date/time and detected language. This data is used exclusively for: (a) protection against abuse and malicious requests; (b) continuous improvement of result quality; (c) anonymized statistical analysis of search trends.
• 5.9. Search Log Retention: Search records are kept for a maximum of 90 (ninety) days for audit and security purposes, after which they are automatically anonymized or deleted.
• 5.10. Synthetic Trail and Personality Data: The writing "voice" and the personality data feeding your Synthetic are kept while your account is active and may be regenerated as you produce more content. You may request deletion under section 7.
• 5.11. External Client Session Token (MCP): The token authorizing an external client to act on your account is valid for about 30 (thirty) days, expiring automatically or when you log in again, which revokes the previous token.
• 5.12. Mentorship Recordings: Recordings and transcripts of live sessions are retained for participant access and service improvement. Public use of excerpts as social proof depends on recorded consent and may be revoked.

6. IMAGES ON PROMOTIONAL PAGES, LANDING PAGES AND EXTERNAL PROMOTION

• 6.1. Image Origin: Images displayed on the PLATFORM's promotional landing pages (such as the template pages at /foto-ia/) are images published by the user community in the public Gallery, and are therefore subject to the publishing and remix rules described in section 3.2.
• 6.2. Illustrative Nature: Images are illustrative examples of possible AI-generated results. Individual results may vary depending on the reference photo, the AI model used and the parameters applied.
• 6.3. Promotion on External Channels: Content you publish to the public area of the PLATFORM may be promoted outside it: on platforms that automatically consume our public feed (such as Pinterest), on the house's official channels (social networks, messaging channels, newsletter, video) and on channels of partners and sponsors. This applies from the moment of publication. Private content never leaves the PLATFORM through this route. The full rules of this distribution are in section 11 of the Terms of Use.
• 6.4. Personal Data Involved in the Promotion: To credit the work to you, this promotion may expose your display name, your username on the PLATFORM, the link to your public profile, the link to your portfolio, a short link pointing to any of them, and the social media accounts you yourself have provided in your profile. The form of the credit is chosen according to the channel, and any of them satisfies attribution. Nothing beyond that is published, and no social media account is presumed by us: we only tag where you declared the identifier. The legal basis is the performance of the contract established in the Terms of Use, combined with the legitimate interest of giving visibility to the work and its creator.
• 6.5. Takedown Requests: The PLATFORM has no unpublish feature: publishing to the public area is definitive and is what authorises the circulation described above. There is no way to keep the work published and selectively refuse this promotion. The withdrawal of a specific work is exceptional and depends on a formal request by e-mail to [email protected], reviewed case by case, with no guaranteed timeframe, and with no obligation to recover what has already circulated beyond here (items 11.4, 11.5 and 11.9 of the Terms of Use). This does not affect your legal rights over personal data, described in section 7, which remain exercisable through the same channel.

7. YOUR RIGHTS (GDPR AND LGPD)

You have rights over your data, including:

• Access and Portability: Requesting a copy of your data.
• Rectification: Correcting inaccurate data.
• Deletion ("Right to be Forgotten"): You can delete your account directly on the PLATFORM, in Profile, under the "Danger zone" section. Your personal data and the private content you created are removed; records whose retention is required by law (fiscal and contractual) are anonymized and retained for the legal period. The step-by-step is in item 7.1.
• Consent Withdrawal: Unsubscribing from marketing communications at any time.

For other rights, or if you prefer not to use the in-interface deletion, contact us through the official channel indicated below.

7.1. How account deletion works

• You initiate it yourself, in Profile, under the "Danger zone". To confirm, we send a code to your email and ask you to type your username. This protects the account: someone accessing your session without your email cannot complete the deletion.
• 14-day grace window: the deletion is scheduled and nothing is erased during this period. You can cancel at any time by signing in, and we notify you by email when the request is registered, with the path to cancel.
• After the 14 days, we remove your personal data and private content from our systems. Records with legal retention obligations (fiscal and contractual) are anonymized: amounts and dates remain in our books, unlinked from you.
• Public content you published (posts, comments) has its authorship anonymized, so as not to leave holes in other people's conversations.
• Generated media: at deletion time, you can indicate that you also want the files of your images, music and videos removed from our servers. Copies that have already become public elsewhere (social networks, or used by someone else as reference) cannot be recalled: the internet does not give back what has already left, we can only erase what is under our control.

8. SECURITY

We implement technical measures (SSL/TLS encryption in transit, access controls) to protect your data. However, given the nature of the internet and the experimental character of the platform, we cannot guarantee absolute security against sophisticated intrusions. The user acknowledges this residual risk.

9. GENERAL PROVISIONS

• 9.1. External Links: The PLATFORM contains links to other sites. We are not responsible for third parties' privacy practices.
• 9.2. Changes: This policy may be updated. Continued use of the PLATFORM after changes implies acceptance.
• 9.3. Content Removal by the CONTROLLERS: Regardless of any request from the data subject, the MAINTAINERS may freely remove or delete any hosted file or generation that, at their sole discretion, should not be online, under clause 2.4 of the Terms of Use. This faculty exists to protect the PLATFORM and third parties, and does not constitute a duty of prior monitoring.

10. CONTACT AND DATA PROTECTION OFFICER

For matters related to this Policy or data protection, contact the PbrasilDAO/Sapiens Sintéticos administration:

Email: [email protected]

This is the single channel for privacy questions, data subject rights, content removal requests and copyright notices. Requests about personal data are answered within the applicable legal deadline (up to 30 days under the GDPR, extendable in the cases provided for, and up to 15 days under the LGPD). Please use one of these subject lines: "Personal Data", "Content Removal" or "Copyright". The address [email protected] remains monitored and forwarded to this channel.