Privacy Policy

Last updated: September 21, 2026

This policy explains how TokPilot handles personal data in accordance with Brazil's LGPD (Law 13.709/2018) and other applicable rules.

1. Data we collect

• Account: name, email, and password stored as an irreversible cryptographic hash.
• Platform usage: actions taken, credit consumption, and access logs, including IP address, path, method, date and time, browser, operating system, and device. Access logs are retained for 90 days.
• Payment: card payments and subscriptions are processed by Stripe; Pix credit payments are processed by Asaas. We do not store card numbers and process CPF/CNPJ and transaction metadata for Pix when necessary.
• Browsing: cookies and identifiers for functionality, measurement, and marketing (see Cookie Policy).
• Queried content: the parameters of your analyses (profiles, products, terms) to deliver the service.

2. How we use your data

• Provide, maintain, and improve the platform and its tools.
• Process credit purchases and issue receipts.
• Prevent fraud and abuse, and ensure security.
• Send support and updates; marketing only with your consent.
• Comply with legal and regulatory obligations.

3. Legal bases

We process data based on: performance of a contract (LGPD art. 7(V); GDPR art. 6(1)(b)); consent, for marketing cookies and communications (art. 7(I); art. 6(1)(a)); legitimate interest, for security and service improvement (art. 7(IX); art. 6(1)(f)); and compliance with a legal obligation (art. 7(II); art. 6(1)(c)).

4. Sharing

We do not sell your personal data. We share the minimum necessary with processors that support us, under contract and confidentiality: payment processors (Stripe and Asaas), hosting and infrastructure providers, AI and data providers, and measurement/marketing tools (when you consent). We may disclose data when required by law or competent authority.

5. International transfers

Some providers may process data outside Brazil (e.g., in the United States or the European Union). In those cases we apply appropriate safeguards, such as standard contractual clauses, as required by LGPD and GDPR.

6. Retention

We keep data for as long as necessary for the purposes above and to meet legal obligations (for example, tax obligations). Access logs are retained for 90 days. When an account is closed, data is deleted or anonymized, unless the law requires longer retention.

7. Security

We apply technical and organizational measures to protect your data, such as password encryption, access control, and secure connections (HTTPS). No system is fully infallible, but we work continuously to reduce risk.

8. Your rights

At any time you may: confirm processing; access, correct, update, or delete your data; request portability; withdraw consent; and object to certain processing. EU users (GDPR) and California residents (CCPA/CPRA) have equivalent rights, including not having their data "sold" — and we reiterate that we do not sell personal data. To exercise them, write to our DPO at contact@tokpilot.com.br.

9. Cookies

We use essential cookies and, with your consent, measurement and marketing cookies. Details and controls in the Cookie Policy.

10. Minors

The platform is intended for people aged 18 or older. We do not knowingly collect data from minors.

11. Changes

We may update this policy. Material changes will be posted on this page with an updated revision date.

12. Contact

Privacy questions? Contact our DPO: contact@tokpilot.com.br.