Privacy Policy

1. Controller and contact

The controller of the personal data processed on the Platform is Iftale, CNPJ 49.729.187/0001-58.

To exercise your rights or ask privacy questions, contact our data protection officer (DPO) at privacidade@iftale.com.

2. Data we collect

We collect the following personal data:

• Registration data: name, email, and date of birth (used to verify the minimum age of 18).
• Profile data: display name, public identifier (“handle”), biography, avatar, and links you provide.
• Authentication data: when you sign in with Google, we receive your name, email, and account identifier from the provider.
• Usage and telemetry data: interactions with the Platform (pages read, choices in stories, tutorial events), plus technical data such as IP address, collected for security, metrics, and service improvement.
• Content you create or submit as an Author (which may contain personal data you choose to include).

3. Purposes and legal bases

We process personal data for the following purposes and legal bases (LGPD, arts. 7 and 11):

• Creating and maintaining your account and providing the service — performance of a contract.
• Ensuring security, preventing fraud and abuse — legitimate interest and compliance with a legal obligation.
• Sending marketing communications and news — consent (opt-in), which can be revoked at any time.
• Measuring usage and improving the Platform — legitimate interest, with data minimized whenever possible.
• Complying with legal obligations and responding to authorities — compliance with a legal or regulatory obligation.

4. Consent and how to revoke it

When processing is based on consent — such as sending marketing emails — it is free, informed, and specific, collected through an active choice (“opt-in”) and unchecked by default.

You can revoke consent at any time, as easily as it was given, without affecting processing already performed. Revocation can be done in your account preferences or by emailing privacidade@iftale.com.

5. Cookies, analytics, and similar technologies

We use cookies and local storage strictly necessary for authentication, security, and preferences (for example, keeping your session and your reading settings). These are essential to the service and do not depend on consent.

To understand and improve the product, we record usage events on our own servers (for example, creating or publishing a story, finishing a read) — linked to your account when you are signed in, or to an anonymous reading session when you are not. These records use no cookies or tracking identifiers and are not shared with third parties for advertising purposes.

We also measure site traffic in an aggregated and anonymous way (for example, number of visits and traffic source) through a cookieless analytics service provided by Vercel, without creating persistent identifiers about you.

We do not use non-essential cookies or third-party trackers for advertising or marketing.

6. Sharing and processors

We do not sell your personal data. We share data only with processors that support us in providing the service, under confidentiality and security obligations, including:

• Infrastructure, database, and storage providers (for example, Supabase and Vercel);
• Authentication provider (Google), when you choose to sign in with your Google account;
• Public authorities, when required by law or court order.

The list of processors may be updated; relevant changes will be communicated by reasonable means.

7. International data transfers

Some processors may process data on servers located outside Brazil. In such cases, we adopt adequate safeguards and require protection standards compatible with the LGPD (art. 33), ensuring the protection of your data regardless of where it is processed.

8. Data retention

We keep personal data for as long as necessary to fulfill the purposes described, meet legal obligations, and protect rights. Once the account is closed, data is deleted or anonymized within a reasonable period, except for mandatory retention cases provided by law and copies in backups, which are purged on a regular cycle.

9. Your rights as a data subject

Under the LGPD (art. 18), you may, at any time, request:

• confirmation that processing exists and access to your data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary data or data processed in noncompliance;
• portability and information about sharing with third parties;
• deletion of data processed based on consent and revocation of consent;
• deletion of your account and associated personal data, subject to legal retention requirements.

To exercise these rights, write to privacidade@iftale.com. We will respond within the timeframes and in the manner required by law.

10. Information security

We adopt technical and organizational measures to protect personal data against unauthorized access, loss, alteration, or improper destruction, including access controls, encryption in transit, and internal security policies. No system is completely immune to risk, but we work continuously to mitigate it.

11. Processing of minors' data

The Platform is intended exclusively for adults over 18 and does not knowingly collect data from minors. If we identify minors' data, we will take steps to delete it. Date of birth is collected only to verify the minimum age and is not used for purposes other than those described in this Policy.

12. Changes to this Policy

We may update this Policy at any time. Relevant changes will be communicated by reasonable means, and the date of the last update appears at the top of this document. Continued use of the Platform after the changes take effect implies awareness of the updated version.