Privacy Policy
Last updated: 2026-04-04
1. Data Controller
PREDITAS ("we", "us", "our") is the controller of the personal data processed under this Policy. To contact our Data Protection Officer (DPO) or exercise your rights, please email: [email protected].
2. Data We Collect and Legal Basis
We collect and process the following personal data under the legal bases established by Brazil's LGPD (Law 13,709/2018):
Registration data (full name, email address, password — stored as a hash, never in plain text): required for identification and authentication. Legal basis: contract performance (Art. 7, V).
Google identifier (for users who choose Google login): required for OAuth authentication. Legal basis: contract performance (Art. 7, V).
Investment portfolio and watchlist (stock tickers, quantities, average prices): provided voluntarily to use platform features. Legal basis: contract performance (Art. 7, V).
Saved screeners: user-created filter configurations. Legal basis: contract performance (Art. 7, V).
AI Agent conversation history: messages exchanged with our financial analysis assistant. Legal basis: contract performance (Art. 7, V).
AI usage metrics (credits consumed and usage dates): used for limit management and billing. Legal basis: legitimate interest (Art. 7, IX).
Stripe payment references (customer and subscription identifiers — never card data): required for subscription management. Legal basis: contract performance (Art. 7, V).
Billing data (CPF, billing address): sent to Stripe for payment processing and tax documentation. Legal basis: contract performance (Art. 7, V) and legal obligation (Art. 7, II).
Administrative audit logs (IP address, browser user-agent, action taken): maintained for security and incident investigation. Legal basis: legitimate interest (Art. 7, IX).
Session data: session cookie required to keep you authenticated. Legal basis: contract performance / legitimate interest (Art. 7, V and IX).
Interface preferences (theme, language, chart settings): stored locally in your browser (localStorage) and/or on the server for personalization. Legal basis: consent (Art. 7, I) and legitimate interest (Art. 7, IX).
3. Purpose of Processing
We process your data to:
• Create and manage your user account
• Authenticate your access to the platform
• Provide financial analysis features (dashboards, screeners, portfolio, watchlist)
• Operate the AI financial analysis Agent
• Manage your subscription and billing via Stripe
• Send transactional emails (email verification, password reset)
• Send marketing communications if you have opted in
• Maintain platform security and investigate incidents
4. Retention Periods
We retain your data for the following periods:
• Account data (name, email, portfolio, chat history): while your account is active. After account deletion, all data is permanently erased.
• AI usage records: retained as long as necessary for limit management, periodically consolidated into anonymous summaries.
• Administrative audit logs: up to 365 days.
• Session data: automatically expire after a configured period.
5. Sharing with Third Parties
We share data with the following third parties solely to provide our services:
Google Cloud AI: receives the text of chat messages to generate AI Agent responses. Does not receive name, email, portfolio, or other identifiable data. See Google's policy: https://cloud.google.com/terms/cloud-privacy-notice
Stripe: receives name, email, CPF (for Brazilian users), and billing address for subscription creation, management, and tax documentation. Card data is handled exclusively by Stripe and is never stored on our servers. CPF is registered as a tax identifier (tax ID) on Stripe. See Stripe's policy: https://stripe.com/privacy
Transactional email provider: receives your email address for transactional email delivery (verification, password reset).
Cloudflare Web Analytics: collects page views and browser metadata anonymously, without tracking cookies and without identifiable personal data.
Google OAuth: when you choose Google login, we receive your name and email from your Google profile.
We do not sell, rent, or commercialize your personal data to third parties.
6. International Data Transfers
Google Vertex AI and Stripe are services with infrastructure in the United States and other countries. By using PREDITAS, you acknowledge that your data may be processed outside Brazil by these subprocessors. These providers maintain data protection standards equivalent to or exceeding those required by the LGPD, including certifications such as GDPR, SOC 2, and ISO 27001. International transfers are carried out based on Standard Contractual Clauses (SCCs) as regulated by ANPD, or equivalent safeguards provided under the LGPD (Art. 33).
7. Data Security
We implement technical and organizational measures to protect your data, including:
• Passwords stored as cryptographic hashes with a random salt — never in plain text
• Session cookies with appropriate security settings
• HTTP security headers
• Rate limiting for attack prevention
• Infrastructure access restricted and monitored
8. Your Rights (LGPD Art. 18)
You have the following rights regarding your personal data:
• Access: know what data we process about you
• Rectification: correct inaccurate or outdated data (available in Settings > Privacy & Data)
• Portability: export your data in a structured format (JSON) — available in Settings > Privacy & Data > Download My Data
• Erasure: permanently delete your account and all your data — available in Settings > Advanced Options > Delete Account
• Information about sharing: know which third parties receive your data (see section 5 above)
• Withdrawal of consent: revoke consent for marketing communications at any time — available in Settings > Privacy & Data
• Objection: object to processing based on legitimate interest
To exercise any right not covered by the above features, please email [email protected].
10. Marketing Communications
We only send marketing emails to users who have expressly opted in during registration or subsequently in Settings > Privacy & Data. You may revoke this consent at any time without affecting your use of the platform. Transactional emails (email verification, password reset) are sent regardless of marketing preferences, as they are necessary for the service to function.
11. Changes to This Policy
We may update this Policy periodically. For material changes, we will notify you by email or by prominent notice on the platform before the changes take effect. Continued use of the platform after the new terms take effect constitutes acceptance of the changes.
12. Contact
For questions about this Policy or about the processing of your personal data, contact our Data Protection Officer at: [email protected].