Privacy policy
How we handle your personal data in eFlow. The company behind it is seated in Brazil and serves customers in the European Union, so Brazilian Law 13.709/2018 (LGPD) and Regulation (EU) 2016/679 (GDPR) apply together, alongside Portuguese Law 58/2019 where you live in Portugal.
Last updated: [EFFECTIVE DATE]
Fields in square brackets ([…]) are waiting on the company’s official details and are filled in before public launch.
Controller
[COMPANY LEGAL NAME], a Brazilian company with its seat at [ADDRESS], Rio de Janeiro, Brazil, CNPJ [CNPJ]. It is the controller for LGPD purposes and the controller for GDPR purposes. Representative in the European Union (article 27 GDPR): [EU REPRESENTATIVE]. Data protection officer, who also serves as the encarregado required by article 41 LGPD: [DPO NAME]. Privacy contact: [PRIVACY EMAIL].
How we collect data
Directly from you, when you create the account, write instructions, upload photographs, contact support or buy credits. Automatically, when you use the application: IP address, date and time, pages and operations, device and browser type, error logs. From third parties: Stripe tells us the payment status and transaction identifiers, never the card number; Google gives us your name, email address and account identifier if you choose to sign in with it.
What data we process
Account: name, email address, hashed password, language, stated profession, platform role, email verification status. Content: the photographs and text you upload, the instructions you write, the generated output, projects and assistant conversations. Property photographs can contain identifiable people, number plates and signage; you decide what to upload. Billing: plan, subscription history, invoices and Stripe identifiers. We never receive the card number. Security: the network prefix you sign in from, used to recognise connections already approved, and the history of sign-in approvals. Technical: IP address, access and error logs, date and time of operations, device and browser type.
Purposes and legal bases
Providing the service, managing the account and running generations: performance of the contract (article 6(1)(b) GDPR; article 7, V LGPD). Verifying the email address and approving sign-ins from new networks: performance of the contract and legitimate interest in account security (article 6(1)(f) GDPR; article 7, IX LGPD). Billing, accounting and tax obligations: legal obligation (article 6(1)(c) GDPR; article 7, II LGPD). Security, fraud prevention and service improvement: legitimate interest (article 6(1)(f) GDPR; article 7, IX LGPD). Non-essential cookies and marketing messages: consent (article 6(1)(a) GDPR; article 7, I LGPD), withdrawable at any time.
Processors and recipients
Stripe Payments Europe and Stripe group companies: payment processing and invoicing. They receive your name, email and transaction data. Amazon Web Services: application hosting, database and file storage, in a European Union region. Receives all data as a processor. Resend: delivery of transactional email (email verification, sign-in approval, password reset, billing notices). Receives your email address and the message content. OpenRouter: image and video generation and enhancement, and routing of eFlow Assistant messages to the language models. Receives the photographs you upload, the instructions you write and the text of the conversation, and forwards them to the models that produce the output. Read this part plainly: your photographs leave our infrastructure and are transmitted to this vendor to produce the output you asked for. Google: if you choose to sign in with Google, and — only with your consent to optional cookies — Google Analytics 4, which receives the pages you view, your truncated IP address and device and browser data. Without that consent it is not loaded. PostHog: product usage analytics, hosted in the United States, and only with your consent to optional cookies. It receives the pages you view and the actions you take (creating a project, requesting a plan, starting a payment), your internal user identifier and that of your billing account, the plan, and device and browser data. It never receives your name, your email, your briefings or your photographs. All of them act as processors, or operadores in LGPD terms, under data processing agreements. We do not sell or share personal data for advertising, and we do not use your content to train models of our own.
International transfers
The company behind the service is seated in Brazil. Data belonging to customers in the European Union is therefore transferred outside the European Economic Area. Brazil is not covered by a European Commission adequacy decision. That transfer relies on the standard contractual clauses approved by Implementing Decision (EU) 2021/914, together with a transfer impact assessment and the technical measures described in the security section. Primary hosting and file storage are in a European Union region of Amazon Web Services. Some vendors process data outside the European Union and Brazil, on the basis of an adequacy decision or the same standard contractual clauses. On the Brazilian side, international transfers follow articles 33 to 36 LGPD and the standard contractual clauses approved by ANPD Resolution CD/ANPD 19/2024.
Retention
Account and content: as long as the account exists. You can request deletion inside the application. After the request there is a 7-day grace period, after which the content is deleted and the account anonymised. Billing and payment records: 5 years, under the lapse and limitation periods of the Brazilian National Tax Code. Records of sales declared under the European Union One Stop Shop are kept for 10 years, as required by article 63c of Implementing Regulation (EU) 282/2011. Technical security and access logs: up to 12 months. The application logs required by article 15 of the Brazilian Marco Civil da Internet are kept for 6 months. Once those periods end, data is deleted or irreversibly anonymised.
Your rights
Under the GDPR you have the right of access, rectification, erasure, restriction of processing, portability and objection, and to withdraw consent at any time without affecting the lawfulness of earlier processing (articles 15 to 22). Under the LGPD you also have the right to confirmation that processing exists, to information about who we share data with, to review of automated decisions, and to be told you may refuse consent (article 18). You exercise any of them by email to [PRIVACY EMAIL]. We answer within one month, extendable by two months in complex cases; LGPD requests are answered within 15 days. You can complain to the Portuguese data protection authority (CNPD) or the supervisory authority of your Member State, and in Brazil to the National Data Protection Authority (ANPD).
Security
The session is held in an HttpOnly cookie, traffic is served over HTTPS, and passwords are stored with a key derivation function. Files are served through signed links with a short lifetime. The email address is verified through a link valid for 24 hours. A sign-in from a network the account has never used requires an approval by email, valid for 30 minutes. Both requests are rate limited. No system is completely secure. In case of a personal data breach involving high risk we notify you and the competent authorities, the CNPD and the ANPD, within the legal deadlines.
Artificial intelligence and automated decisions
Content is generated automatically by third-party models from what you upload. This is not an automated decision producing legal effects or similarly significant effects on you within the meaning of article 22 GDPR or article 20 LGPD. We do not profile you for advertising. If we ever introduce automated processing with effects on you, we will tell you and guarantee human review.
Minors
The service is aimed at professionals and is not directed at anyone under 18. We do not knowingly collect data about minors. If you learn that a minor has created an account, write to [PRIVACY EMAIL] and we will delete the data. If you upload photographs showing children or adolescents, article 14 LGPD and the best interests of the child apply: make sure you are authorised to do it.
Changes to this policy
We may update this policy. Material changes are announced by email or inside the application at least 30 days in advance, and the last-updated date at the top of the page always changes. If a change involves new processing based on your consent, we ask for that consent before starting it.
Contact and complaints
Privacy: [PRIVACY EMAIL]. General support: [SUPPORT EMAIL]. Postal address: [ADDRESS], Rio de Janeiro, Brazil. Representative in the European Union: [EU REPRESENTATIVE].