Privacy policy

What we collect

We collect only what the product needs to work and improve:

• Account: e-mail, name and, if you sign in with Google, your profile photo.
• The Instagram profile you enter: the handle and its public data (photo, posts, colors, niche), read to build your brand.
• What you create: carousels, ideas, answers about your business and your saved brand.
• Payment: handled by Stripe. We never see or store your card number; we keep the subscription status and the billing history.
• Browsing: IP address, browser, pages visited and where you came from (campaign parameters such as utm and the ad click identifiers fbclid and gclid).

Why we use it

• To provide the service: sign-in, profile analysis, generating and storing content, billing the subscription.
• Security: limiting abuse (for example, how many analyses one IP can run per hour) and investigating errors.
• Measuring and improving the product: understanding which screens work and where people drop off.
• Measuring our ads: knowing whether someone who came from an ad entered a handle, created an account or subscribed.

Legal bases

We use account, content and payment data to perform our contract with you. Security and ad measurement rely on our legitimate interest in keeping the service safe and knowing whether our marketing works; you can object at any time (see "Your rights"). Analytics cookies in the browser are only turned on after you accept the site notice.

Who we share it with

We do not sell data. We share it only with the providers that run the service, each for its own purpose:

• Meta (Facebook and Instagram): when you enter a handle, create an account or subscribe, our server tells Meta through the Conversions API to measure and optimize ads. It sends the IP, the browser and the click identifier; and, at sign-up and purchase, the e-mail and the account id as a hash (an irreversible code). This also applies to people who did not accept cookies, based on legitimate interest.
• Amazon Web Services: hosting, database and sign-in e-mail.
• Stripe: payment and subscription.
• Apify: reading the public Instagram profile you enter.
• Anthropic and OpenAI: generating text and images from your profile and your answers.
• Resend: sending the sign-in code by e-mail.
• PostHog: product usage measurement (behind the browser cookie notice).
• Sentry: error tracking.

International transfer

These providers may process data outside Brazil, mainly in the United States, under the contractual safeguards each of them offers.

How long we keep it

We keep account data and content while the account exists. When you delete the account, we erase that data, except what the law requires us to keep (such as billing records). Browsing and measurement data follow each provider's retention periods.

Your rights

You can ask at any time for: confirmation that we process your data, access, correction, deletion, portability, information on who we share it with, and to object to processing based on legitimate interest (including sending it to Meta). Write to oi@cardume.ai. A deletion request includes notifying the providers that received the data. You can also complain to Brazil's National Data Protection Authority (ANPD).

Changes to this policy

When this policy changes, the date at the top changes too. Important changes are also announced in the app.

Contact

Privacy questions: oi@cardume.ai.