ISAI Privacy Policy

1. Who processes your data

Controller: Aeroplano Filmes Produções Artísticas Ltda., Brazilian company registration (CNPJ) 03.230.193/0001-65, Rua Gomes Carneiro 50, apt. 302, Ipanema, Rio de Janeiro, RJ, Brazil, which operates the ISAI platform. Data protection officer (encarregado, the privacy contact): Felipe Lacerda, flipcorreio@gmail.com. We reply to data subject requests within 15 business days.

2. What we collect and why

2.1. Account data: name and e-mail from your Google account (or the e-mail you provide to receive the sign-in link), the name of your production company if you provide it, and your country if you provide it. Purpose: to identify you, authenticate you and talk to you about the service. Legal basis: performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).

2.2. Payment data: Asaas processes payments. From Asaas we receive payment confirmation, the amount, the date, a transaction identifier and the registration data you enter on the payment page (name, e-mail, address and, when required, CPF or CNPJ, the Brazilian taxpayer numbers). We do not receive or store card numbers. Purpose: to charge for the subscription or consulting package you bought and to issue the tax invoice. Legal basis: performance of a contract and legal obligation (tax).

2.3. User Material: transcripts, scripts, treatments and notes you upload. This is the most sensitive category on the Platform. Sole purpose: to provide the service to you. Legal basis: performance of a contract.

User Material often contains data about third parties, the people interviewed: names, stories, opinions, sometimes sensitive data (health, religion, politics, sexual orientation). For that data, you are the controller and ISAI is the processor: we process what you send, only for what you ask. It is up to you to hold the rights and authorizations over the material and to inform interviewees when the law requires it. We have no contact with these people and use their data for nothing beyond returning results to you.

2.4. Usage data: projects created (title, date, number of files), features used, volume processed, access times, errors. It does not include the content of projects. Purpose: to operate, fix and improve the Platform. Legal basis: legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)), with minimal impact on you.

2.5. Technical data: IP address, browser, operating system, request logs. Purpose: security and diagnostics. Legal basis: legitimate interest.

2.6. Acceptance record: the version of the Terms and of this Policy that you accepted, with date, time and account. Purpose: to prove acceptance. Legal basis: compliance with a legal obligation and regular exercise of rights.

2.7. Consulting: when you buy a consulting package (Dossier, Reading or Edit Suite), we also process the answers to the project questionnaire and the material you send for the analysis. In that case Felipe Lacerda reads and analyzes the material personally, with the support of the Platform, under a confidentiality agreement. Purpose: to deliver the consulting you bought. Legal basis: performance of a contract. This is the only situation in which a person at ISAI reads the content, and only because you sent it for that purpose.

2.8. What we do not collect: GPS location, photos or videos from your device, contacts and advertising identifiers. We receive only the files you choose to send. We do not use third-party analytics tools (such as Google Analytics) or advertising pixels. The approximate location derived from your IP address (country or city) may appear in technical logs and is used only for security. Error logs (crash logs) stay on the server, contain the IP address, the address requested and the technical error message, and exist only for diagnostics.

We do not collect data for advertising, and we do not sell, rent or transfer data to anyone.

3. How we use AI with your data

User Material is sent automatically to language models from Anthropic (Claude) to produce the analyses you ask for, and to a model from OpenAI to build meaning-based search. No one at ISAI reads the content in this process. These providers' API terms prohibit using what we send to train their models, and ISAI does not train any model on your material either. The AI Transparency Policy has the details.

4. Who we share data with (processors and subprocessors)

We share data only with the services the Platform needs to work, each under its own terms and privacy policy:

Anthropic, Inc. (United States): language processing; receives the content sent for analysis.
Supabase, Inc. (United States): sign-in and search; stores account data and a copy of the text of your material, in passages, for meaning-based search.
Railway (United States): server hosting; stores projects, material, results, your plan status and technical logs.
Google LLC (United States): Google sign-in; receives the information that you signed in to the Platform.
Asaas (Brazil): payments; receives billing and card or PIX data directly from you.
OpenAI, L.L.C. (United States): receives the text of your material to build meaning-based search.
Resend, Inc. (United States): sends the Platform's e-mails, such as the sign-in link; receives your e-mail address.
Airtable (United States): receives what you enter in the contact forms and in the consulting questionnaire and, if you turn on automatic sending, the results you send to your own base.
Notion Labs, Inc. (United States), only if you connect your Notion account: receives the results you choose to export.

Beyond these, we may share data when the law or a court order requires it, and we will tell you when that is permitted.

5. International transfers

The providers above, except Asaas, are in the United States. Under the LGPD, the transfer rests on performance of the contract with you (art. 33, V) and on contractual clauses with the providers. For users in the European Economic Area, the transfer rests on the European Commission's Standard Contractual Clauses adopted by these providers and, where the provider is certified, on the EU-US Data Privacy Framework. If you want to know which mechanism applies to a specific provider, ask at flipcorreio@gmail.com.

6. How long we keep data

Account data: while the account exists; deleted or anonymized within 60 days after closure, except what tax law requires us to keep (payment records and tax invoices, 5 years).
User Material and results: while the account is active. After cancellation or closure, 30 days for export; then permanent deletion. After a suspension for non-payment, 30 days from the suspension. You can delete a project at any time on the Platform, and the deletion is immediate.
Usage data: up to 24 months after the last access, in a form that does not identify the content.
Technical logs: 12 months.
Acceptance record: for as long as the relationship lasts and for the legal limitation period after it.

Consulting material and questionnaire answers: deleted within 60 days after final delivery of the consulting, or sooner at your request, except what the law requires us to keep.

If backups exist, we delete each one in the normal rotation cycle, no later than 30 days after the main deletion.

7. Your rights

Under the LGPD (art. 18) you may request: confirmation that we process your data and access to it; correction; anonymization, blocking or deletion of unnecessary data; portability; information about who we share data with; withdrawal of consent where consent is the legal basis; objection to processing based on legitimate interest. Users in the European Economic Area have the equivalent GDPR rights (arts. 15 to 22) and may complain to the authority in their country. ISAI makes no automated decisions with legal effect on you; everything it generates is input for your decision.

To exercise any right, write to flipcorreio@gmail.com. We may ask you to confirm your identity. To delete a project, use the Platform itself. To close your account, write to the same e-mail. Unresolved complaints: the ANPD (gov.br/anpd), Brazil's data protection authority, or the authority in your country in Europe.

8. Security

Encrypted communication (HTTPS); Supabase stores the data encrypted at rest; isolated accounts, tested in production in August 2026 (one account cannot reach another's material); administrators with no read access to projects in normal operation; access logging. If a security incident affects your data, we will notify you and the ANPD within the legal deadlines, and the European authority where applicable.

9. Cookies

We use only necessary cookies: the authentication session and protection against forged requests. We do not use advertising or tracking cookies. The pages load typefaces from Google Fonts, which makes your browser connect to Google servers, and those servers receive your IP address. We use no other third-party tracking tools. If that changes, this Policy will be updated beforehand and you will be able to choose.

10. Minors

The Platform is for adult professionals. We do not knowingly collect data from people under 18; if we find out it happened, we delete it.

11. Changes to this Policy

Material changes are announced at least 30 days in advance by e-mail or on the Platform. Each version has a number and date.

12. California residents (CCPA/CPRA)

If you live in California, you have the right to know which categories of personal data we collect, where they come from, what we use them for and who we share them with (sections 2 to 4); to request access to a copy of your data, correction and deletion; and not to be discriminated against for exercising these rights. In the last 12 months we collected the following categories: identifiers (name, e-mail, IP address), commercial information (payment records), internet activity (usage and technical data) and the content you sent. ISAI does not sell personal data and does not share it for behavioral advertising; therefore there is no button to opt out of sale or sharing. We use and disclose data only for the purposes in section 2 and to the processors in section 4, and we use no sensitive personal information for anything beyond providing the service. To exercise your rights, write to flipcorreio@gmail.com; we may ask you to confirm your identity, and you may name an authorized agent. We reply within 45 days.

13. Contact

Aeroplano Filmes Produções Artísticas Ltda., which operates ISAI. Data protection officer: Felipe Lacerda, flipcorreio@gmail.com.