CREATHORIA PRIVACY POLICY
Last updated: October 3, 2026
This Privacy Policy explains how IT Desenvolvimento de Software ME, headquartered at R. Floresta, 276, Nossa Sra. Aparecida, Florestal/MG, CEP 35690-000, Brazil, operating under the brand CREATHORIA ("Creathoria", "we"), collects, uses, shares, stores, and protects personal data when you:
- visit the website https://creathoria.com or any page that refers to this Policy;
- use the Creathoria web platform, mobile app, or skill for AI agents (the "Services");
- are invited to a project, contact us, participate in the partner program, or otherwise interact with us.
It also explains how we process data of people who are not users of Creathoria, such as the owners of public profiles analyzed in the Services.
This Policy follows the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD) and the Marco Civil da Internet (Brazilian Internet Civil Framework, Law No. 12,965/2014). Terms not defined here have the meaning given in the Terms of Service.
Questions or requests: contato@creathoria.com (subject "Privacy").
SUMMARY
- What Creathoria is: an authority content planner for creators and brands, with analyses and content generation by artificial intelligence.
- What data we process: registration and account data, the content of your brands and projects, billing data, technical usage data, and public data from social network profiles and posts that you ask us to analyze.
- Use of AI: we send to AI providers the information necessary to generate analyses and content. We do not train our own models with your data.
- We do not publish anything on your networks and we do not read your direct messages.
- We do not sell personal data.
- Your rights: you may request access, correction, deletion, and other rights provided by the LGPD at contato@creathoria.com or at https://creathoria.com/legal/remove-data.
TABLE OF CONTENTS
- Who processes your data
- What data we collect
- What we use the data for and the legal basis
- Artificial intelligence
- Data from third-party public profiles
- Integrations, Google login, and platform data
- Who we share data with
- International transfer
- Cookies and similar technologies
- How long we keep data
- Security
- Your rights
- Account deletion
- Children and adolescents
- Users outside Brazil
- Changes to this Policy
- Contact and Data Protection Officer
1. WHO PROCESSES YOUR DATA
1.1. Controller. IT Desenvolvimento de Software ME is the controller of the personal data processed to operate the website and the Services: registration, account, billing, usage, support, and partner program data, and public data collected for the analyses.
1.2. Processor. As to the personal data of third parties that you enter into your projects (for example, names or information of clients, employees, or other people mentioned in briefings, knowledge base documents, or conversations), the project owner acts as controller and Creathoria processes that data as processor, on behalf of the customer and to provide the Services.
2. WHAT DATA WE COLLECT
2.1. Data you provide to us
- Registration and account: name, email, phone number (optional), password (stored only as a hash), profile photo, preferred language.
- Projects and brands: project name, brand briefing (niche, audience, credentials, offer, tone of voice, topics to avoid), handles (@) of the brand's, references', and competitors' profiles, logos, palettes, fonts, reference images, files and documents (PDF, DOCX, TXT, MD), page links, notes, and pages imported from integrations.
- Use of features: messages sent in the AI chat, plans, pieces, edits, ratings (thumbs up/down and reasons), publication statuses and links reported by you, approval decisions and comments.
- Team: name and email of the people you invite to the project and the role assigned to them.
- Billing: cardholder name, CPF (Brazilian individual taxpayer ID) or CNPJ (Brazilian company taxpayer ID), company name, email, phone number, postal code, and address number. Card data (number and security code) is sent for tokenization at Asaas and is not stored by Creathoria; we keep only the card identifier (token), the brand, the last four digits, and the expiration date. We also keep the history of invoices, payments, credits, and coupons.
- Support: messages, attachments, and contact data sent to support, through the contact form (name, email, phone number, segment, and message), and through the data removal form.
- Partner program: CPF or CNPJ, full name or company name, PIX key (Brazilian instant payment system), photos of the identification document (RG or CNH, front and back), partner photo (optional), agency data (name, website, Instagram, LinkedIn, and address), Instagram handle (@), reason for applying, and record of acceptance of the terms (version, date, and IP address).
2.2. Data collected automatically
- Access logs: IP address and date and time of access, as required by the Marco Civil da Internet.
- Session and device data: operating system, device type, browser, login method, and approximate location derived from the IP address (country, region, city, time zone, and approximate coordinates). We do not collect GPS location.
- Device identifier: a pseudonymized code generated in the browser or app, used for security, fraud prevention, and metrics.
- Usage and performance: pages and features accessed, usage events, campaign parameters (UTM and ad click identifiers), credit consumption, errors, and technical performance.
- Mobile app: push notification token, platform, language, and notification preferences. Camera and gallery are only accessed when you allow it and choose to upload an image.
- Cookies and similar technologies: see section 9.
2.3. Data received from third parties
- Google login: name, email, and photo of the Google profile, when you choose to sign in with Google.
- Social networks (public data): public information from profiles and posts that you ask to analyze (see section 5).
- Connected integrations: data authorized by you when connecting an account (see section 6).
- Asaas: status and information about payments.
- IP geolocation provider: approximate location associated with your IP address.
2.4. Sensitive data
We do not ask for sensitive personal data (such as health data, racial origin, religion, political opinion, or sex life). We ask that you do not enter it into the Services. Analyzed public posts may occasionally contain information of this nature, which we do not seek and do not use to build profiles.
3. WHAT WE USE THE DATA FOR AND THE LEGAL BASIS
| Purpose | Main data | Legal basis (LGPD) |
|---|---|---|
| Create and maintain your account, authenticate access, verify email | Registration, session, device | Performance of a contract (art. 7, V) |
| Provide the Services: brands, analyses, chat, plans, pieces, radar, brand guide in PDF, team, and approvals | Project content, usage data, analyzed public data | Performance of a contract (art. 7, V) |
| Charge for the subscription and credits and issue receipts | Billing, financial history | Performance of a contract (art. 7, V) and compliance with a legal obligation (art. 7, II) |
| Collect and analyze public data from third-party profiles | Public data from social networks | Legitimate interest (art. 7, IX and paragraphs 3 and 4), see section 5 |
| Send communications about the account, billing, credits, approvals, invitations, and radar summaries | Email, push token, usage data | Performance of a contract (art. 7, V) |
| Send follow-up messages and personalized usage tips | Name, plan, usage, support history | Legitimate interest (art. 7, IX) |
| Send marketing and news | Legitimate interest or consent; you may unsubscribe at any time | |
| Handle support requests and data subject requests | Support data | Performance of a contract and regular exercise of rights (art. 7, V and VI) |
| Operate the partner program: registration, referral attribution, commissions, payments, and fraud prevention | Partner data, documents, IP, device | Performance of a contract (art. 7, V), legal obligation (art. 7, II), and legitimate interest in fraud prevention (art. 7, IX) |
| Security, fraud and abuse prevention | IP, device, sessions, billing signals | Legitimate interest (art. 7, IX) and credit protection (art. 7, X) |
| Keep access logs | IP, date and time | Compliance with a legal obligation (art. 7, II; Marco Civil, art. 15) |
| Measure audience, understand usage, and improve the Services | Analytics cookies, usage data | Legitimate interest (art. 7, IX) or consent, when required |
| Measure promotional campaigns | Cookies and ad identifiers, pseudonymized data | Consent or legitimate interest, as applicable |
| Comply with the law, orders from authorities, and defend rights | Data necessary for the case | Legal obligation and regular exercise of rights (art. 7, II and VI) |
When we rely on legitimate interest, we assess whether it overrides your rights and freedoms and adopt transparency and minimization measures.
4. ARTIFICIAL INTELLIGENCE
4.1. What we send to AI providers. To generate analyses and content, we send to AI providers only the information necessary for each task, such as the brand briefing, excerpts from the knowledge base, logos and reference images (when you request the visual summary), analyzed public content (captions, images, covers, and video transcriptions), your chat messages, and the plan context. Audio from public videos may be sent to transcription providers.
4.2. Providers. We use models from providers such as Google (Gemini), Anthropic (Claude), OpenAI, Groq, and OpenRouter (which may forward the request to other models as a contingency). These providers process the data to return the response, under their contracts and policies for API use.
4.3. No own training. Creathoria does not train its own AI models with your data and does not use your content for advertising.
4.4. Logs. We keep a record of AI requests and responses (including the content sent and generated) to deliver the result, allow auditing, support, security, and cost and quality control.
4.5. Cache of public analyses. Analyses of public posts may be stored and reused to serve other users who analyze the same post. This cache contains only the analysis of the public content, and not the private data of your project.
4.6. Personalized messages. Some follow-up messages sent to the project owner (by email, on the platform, or by push) may be drafted with the help of AI based on the project's usage information.
4.7. Automated decisions. The Services do not make automated decisions that produce legal effects on you, except for the automated fraud risk analysis in the partner program, which may withhold or cancel commissions. You may request a review of these decisions (art. 20 of the LGPD) through the contact email.
5. DATA FROM THIRD-PARTY PUBLIC PROFILES
5.1. What we collect. When a user requests the analysis of their own profile, of a reference or competitor profile, or of a specific post, we collect publicly available information on the supported social networks (currently Instagram and TikTok, and possibly others): username, name, bio, profile photo, external link, counts of followers, following, and posts, verified account indication, and, from posts, captions, hashtags, images, videos and their transcriptions, date, and public metrics (likes, comments, and views). We do not collect the text of comments, messages, data from private profiles, or information that requires logging in to the analyzed profile.
5.2. How we collect. Collection is carried out through third-party providers specialized in public data (such as Apify) and, where available, official APIs. Profile images and thumbnails are copied to our storage for display in the Services. For the reference radar, this collection is repeated periodically.
5.3. Purpose and legal basis. We process this data based on legitimate interest (art. 7, IX, and paragraphs 3 and 4 of the LGPD), to allow our users to study publicly published content and plan their own content strategy. This data is not sold, is not used for advertising, and is not used to contact the data subjects. The Terms of Service prohibit the use of these analyses to monitor, stalk, or expose people and to copy third-party content.
5.4. Your rights as a data subject. If your profile or post was analyzed in Creathoria, you may request information, objection, or deletion by email at contato@creathoria.com or at https://creathoria.com/legal/remove-data, identifying the profile in question.
6. INTEGRATIONS, GOOGLE LOGIN, AND PLATFORM DATA
6.1. Google login. If you sign in with Google, we receive the name, email, and photo of your Google profile, solely to create and authenticate your account.
6.2. Connected accounts. When available and at your choice, you may connect third-party accounts through official authentication (OAuth). In that case, we store the access token provided by the platform and access only the data permitted by the authorization, for example:
- Instagram (Meta): profile data (username, name, photo, bio, website, and counts) and the list of your posts (caption, media, link, and date);
- Notion: the pages you choose to import into the brand's knowledge base.
Creathoria does not publish, schedule, send messages, or reply to comments on your accounts. You may revoke access at any time by disconnecting the account in Creathoria or in the platform's settings; upon revocation, the token ceases to be used and the integration is deactivated or deleted.
6.3. Limited Use of Google data. Creathoria's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including its Limited Use requirements. Data received from Google APIs: (i) is used only to provide and improve user-facing features; (ii) is not used for advertising; (iii) is not sold; (iv) is not used to train generalized AI models; and (v) is not transferred to third parties, except where necessary to provide the Services, for security, to comply with the law, or with your consent. You may revoke access at https://myaccount.google.com/permissions.
6.4. The use of data from each platform also complies with that platform's terms and policies (Meta: https://developers.facebook.com/terms; TikTok: https://www.tiktok.com/legal; YouTube: https://www.youtube.com/t/terms and https://policies.google.com/privacy).
7. WHO WE SHARE DATA WITH
We do not sell personal data. We share data only in the situations below.
7.1. Suppliers (processors) that help us provide the Services, under contract and only for the purposes of this Policy:
| Category | Suppliers | Use |
|---|---|---|
| Hosting and infrastructure | Google Cloud / Firebase, contracted server providers, Cloudflare (R2 storage and Turnstile anti-bot protection) | Host the website, the API, the databases, and the files |
| Artificial intelligence and transcription | Google (Gemini), Anthropic, OpenAI, Groq, OpenRouter | Generate analyses, transcriptions, and content (section 4) |
| Public data collection | Apify | Collect public data from profiles and posts (section 5) |
| Payments | Asaas | Tokenize cards, charge, and pay commissions via PIX |
| Email and notifications | Mailgun, Expo (push notifications) | Send and receive emails and send notifications |
| Monitoring and analytics | Sentry, Google Analytics, Microsoft Clarity, IpInfo | Detect errors, measure usage, and estimate approximate location by IP |
| Support and internal operations | Discord | Forward support tickets and internal alerts to our team |
| Integrations chosen by you | Meta, Notion, Google | Operate the integrations you connect |
| Fonts | Google Fonts | Display typography on the website and in the brand guide |
7.2. Campaign measurement. We may share with advertising platforms, such as Meta and Google, conversion events (for example, sign-up or subscription) accompanied by click identifiers and contact data pseudonymized by hash, to measure the effectiveness of our campaigns.
7.3. Within your project. Project members see the brands, plans, and other content according to their role; approvers see the brands to which they were invited. If the project is managed by an approved Agency Partner, the agency's name, email, photo, website, and Instagram may be displayed to the project members.
7.4. Skill for AI agents. When you use the Creathoria skill in a third-party AI agent, the information queried or displayed passes through the provider of the agent you chose, under that provider's privacy policy.
7.5. Legal requirement and defense of rights. We may share data with public authorities, upon legal request or court order, or when necessary to defend our rights.
7.6. Corporate transactions. In case of merger, acquisition, reorganization, or sale of assets, data may be transferred to the successor, which will be bound to respect this Policy.
8. INTERNATIONAL TRANSFER
Some of our suppliers (such as AI, cloud, email, and analytics providers) are located or store data outside Brazil, especially in the United States and the European Union. These transfers are made to perform the contract with you and based on the mechanisms of article 33 of the LGPD, such as contractual clauses and protection safeguards offered by these suppliers.
9. COOKIES AND SIMILAR TECHNOLOGIES
We use cookies, browser local storage, and similar technologies:
| Type | Purpose | Approximate duration |
|---|---|---|
| Necessary | Keep you signed in, store preferences (language, selected project), record the cookie notice, security and fraud prevention | Session to 1 year |
| Referral | Record the referral link or coupon through which you arrived | 30 days |
| Analytics | Google Analytics (_ga, _ga_*) and Microsoft Clarity (_clck, _clsk), which measure visits and record interactions with the pages (such as clicks, scrolling, and navigation) so that we can improve the experience. When you are logged in, Clarity may associate the session with your user identifier and email |
Up to 2 years (Google Analytics) and up to 1 year (Clarity) |
| Campaign attribution | Meta and Google ad click identifiers (_fbp, _fbc, gclid) and a visitor identifier, to measure the origin of sign-ups |
90 days |
You may block or delete cookies in your browser settings; blocked necessary cookies may prevent login. For Google Analytics, you may also use https://tools.google.com/dlpage/gaoptout. Learn more about Clarity at https://privacy.microsoft.com/privacystatement.
10. HOW LONG WE KEEP DATA
We keep data only for as long as necessary for the purposes of this Policy or to comply with legal obligations:
| Data | Period |
|---|---|
| Account and registration | While the account is active. After deletion, identification data is anonymized (section 13) |
| Project and brand content | While the project exists, including after cancellation, to allow reactivation, until deletion by the owner or at their request. Files from a removed source or brand are deleted along with it |
| Analyzed public data | While linked to a brand or project, or for as long as necessary for the analysis cache; deleted along with the brand or project, or upon the data subject's request |
| Access logs (IP, date and time) | At least 6 months (Marco Civil, art. 15) |
| Billing and tax data | For the period required by tax and accounting legislation (as a rule, 5 years) |
| Partner program data | While you participate in the program and, afterwards, for the applicable legal, tax, and limitation periods |
| AI, support, and security logs | For as long as necessary for support, auditing, security, and defense of rights |
| Backups | Until replaced in regular backup cycles |
Once the periods end, data is deleted or anonymized.
11. SECURITY
We adopt technical and administrative measures to protect data, such as encrypted connections (HTTPS), storage of passwords only as hashes, card tokenization by the payment processor, access control by project and role, signed temporary links for private files, access tokens with expiration dates and restricted permissions for the app and the skill, and restricted internal access. No system is completely secure. In the event of a security incident that may cause relevant risk or harm, we will notify the affected data subjects and the Brazilian National Data Protection Authority (ANPD), under the law.
12. YOUR RIGHTS
Under article 18 of the LGPD, you may request:
- confirmation that we process your data and access to it;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of unnecessary or excessive data or data processed in violation of the law;
- data portability, under the regulations;
- deletion of data processed based on consent;
- information about the entities with which we share your data;
- information about the possibility of not giving consent and the consequences;
- revocation of consent;
- objection to processing based on legitimate interest;
- review of decisions made solely on the basis of automated processing.
How to exercise them. Send your request to contato@creathoria.com or use the form at https://creathoria.com/legal/remove-data. You may correct part of your data directly in your account. For your security, we may ask you to confirm your identity. We respond within the legal deadline; requests for full access are answered within 15 days. Some data may be kept when the law permits or requires it (section 10).
You may also file a complaint with the ANPD (https://www.gov.br/anpd) or with consumer protection bodies.
Marketing. You may stop receiving marketing emails at any time through the link in the email itself. We will continue to send messages necessary for the account, such as access and billing notices.
13. ACCOUNT DELETION
You may request account deletion through the app, the form at https://creathoria.com/legal/remove-data, or the contact email. Upon deletion:
- your name and email are anonymized, and your phone number, password, and photo are deleted;
- your access tokens (active sessions) and notification devices are removed, and you cease to be a member of other people's projects;
- the subscriptions of the projects you own are canceled and those projects are blocked. Their content may be kept as per section 10; if you also want that content deleted, request it expressly;
- we keep the data that the law requires or permits us to keep, such as access logs, tax and billing data, and records necessary for fraud prevention and defense of rights.
14. CHILDREN AND ADOLESCENTS
The Services are intended for people over 18 years of age. We do not intentionally collect data from children and adolescents. If we learn that an account belongs to a person under 18, it will be deactivated and the data deleted. Notify us at contato@creathoria.com. The Terms of Service also prohibit uploading data of children and adolescents to the Services without an adequate legal basis.
15. USERS OUTSIDE BRAZIL
If you are in the European Economic Area, the United Kingdom, or Switzerland, we process your data based on performance of a contract, legitimate interest, compliance with legal obligations, and, where applicable, consent, and you have rights of access, rectification, erasure, restriction, portability, and objection, and may also complain to your local data protection authority. If you reside in the United States, you may have similar rights under your state's law (such as access, correction, deletion, and the right to opt out of the sale of data or targeted advertising). We do not sell personal data. To exercise any of these rights, use the contacts in section 17.
16. CHANGES TO THIS POLICY
We may update this Policy to reflect changes in the Services, suppliers, or the law. The "Last updated" date indicates the version in force. Material changes will be communicated by email or on the platform.
17. CONTACT AND DATA PROTECTION OFFICER
For questions about this Policy or to exercise your rights, contact our data subject support channel and Data Protection Officer:
- Email: contato@creathoria.com (subject "Privacy")
- Form: https://creathoria.com/legal/remove-data
- Mail: IT Desenvolvimento de Software ME, R. Floresta, 276, Nossa Sra. Aparecida, Florestal/MG, CEP 35690-000, Brazil