Privacy Policy
This Privacy Policy describes how Desejo IA processes personal data, in compliance with Brazil's General Data Protection Law (LGPD, Law 13.709/18). Protecting the privacy of data subjects is central to how the platform operates.
1.The Controller
The Controller of personal data, pursuant to art. 5, VI, of the LGPD, is Alfa Engenharia de Software Ltda., a Brazilian limited liability company registered under CNPJ no. 47.250.542/0001-86, with its registered office at R. Sete de Abril, 264, 4th floor, suite 410, Centro, São Paulo/SP, ZIP code 01.044-904, Brazil ("Desejo IA" or "Controller"), operator of the platform.
Data Protection Officer (DPO): an officer appointed by the Controller. Contact: dpo@desejoia.com.
2.Personal data processed
Registration and account data: email address, password (stored as a hash from a modern key derivation function (KDF) that resists brute force, following OWASP best practices, never in plain text), optional name, the date the User accepted the 18+ terms, and profile photo, when provided.
Usage data: messages exchanged with the characters, prompts used to generate images and videos, the traits of characters the User creates, media received, Hearts balance and transaction records.
Technical data: IP address (stored as a salted hash, which is not reversible in practice), browser, operating system, device identifier and access logs (kept for at least 6 months, as required by the Brazilian Internet Act).
Payment data: name, CPF (required to process Pix payments and issue the tax invoice) and billing address, where applicable. Credit card data is not stored by the Controller and is held only by the payment gateway, which is regulated by the Central Bank of Brazil.
Sensitive data: the platform is an adult companion service. The characters the User picks, the messages they send and their preferences can reveal details about their sex life. This data is treated with the utmost confidentiality, on the legal basis of express consent (art. 11, II, 'a', of the LGPD), given by the User when creating an account and using the service.
3.Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Operation of the service (authentication, generation of responses, storage of conversations, payment processing) | Performance of a contract (art. 7, V) |
| Fraud and abuse prevention (lockout, anti-CSAM, bot detection) | Legitimate interest (art. 7, IX) |
| Product improvement and aggregate statistics | Legitimate interest (art. 7, IX), with impact assessment |
| Marketing and communications about the platform | Consent (art. 7, I), revocable at any time |
| Compliance with legal obligations (tax, regulatory and court orders) | Compliance with a legal obligation (art. 7, II) |
| Processing of sensitive data (intimate preferences and adult content) | Express consent (art. 11, II, 'a') |
4.Data sharing
The Controller shares strictly necessary data with the following categories of third parties:
- Artificial intelligence providers specialized in language models and media generation, under a contract with data protection clauses. Only the content necessary for generation is transmitted to each provider.
- Payment gateway regulated by the Central Bank of Brazil, to process payments.
- Infrastructure providers (hosting, media storage and transactional email), which act as processors under a contract with data protection clauses.
- Competent authorities, upon a court order or valid legal request.
The Controller does not sell personal data and does not share message content with advertisers or third parties for marketing purposes.
5.International data transfer
Some of the providers listed above are based outside Brazil (notably in the United States and Europe). International transfers rely on adequate protection safeguards, standard contractual clauses and, where applicable, the informed consent the data subject gives by using the service.
6.Rights of the data subject
The LGPD (art. 18) grants the data subject the rights below, which can be exercised by sending a request to dpo@desejoia.com:
- Confirmation of the existence of processing and access to the data.
- Correction of incomplete, inaccurate or outdated data.
- Anonymization, blocking or deletion of data that is unnecessary or processed in breach of the LGPD.
- Portability of the data to another provider.
- Deletion of data processed on the basis of consent, subject to legal retention obligations.
- Information about the entities with which the Controller shares the data.
- Revocation of consent at any time.
- Objection to processing based on legitimate interest.
Requests will be answered within a maximum period of 15 (fifteen) days. In the event of improper processing, the data subject may file a complaint with the National Data Protection Authority (ANPD).
7.Data retention
- Registration data: for as long as the account is open and for 5 (five) years after it is closed, for tax and fraud-prevention purposes.
- Access logs: minimum period of 6 (six) months (Internet Civil Framework), which may be extended to 1 (one) year.
- Conversations and media: during the term of the account. Early deletion may be requested through the DPO channel.
- Financial transactions: 5 (five) years after the taxable event (Decree 9.580/18, the Brazilian Income Tax Regulation).
- After the periods elapse, the data is anonymized or deleted.
8.Information security
The Controller adopts the following technical and administrative measures:
- Passwords stored using a modern key derivation function (KDF), resistant to brute force, in accordance with OWASP best practices.
- TLS 1.2+ on all connections.
- Cookies marked as HttpOnly, Secure and SameSite.
- The IP address is salted and hashed before it is logged (art. 12 of the LGPD, anonymization).
- Automatic lockout after multiple authentication attempts.
- Principle of least privilege on internal access, with audit logging.
- Encrypted backups stored in a segregated location.
In the event of a security incident involving risk to data subjects, the Controller will act with reasonable diligence to contain, investigate and notify the data subjects and the ANPD, in accordance with applicable legal requirements.
9.Cookies and similar technologies
The platform uses essential cookies (session and preferences) and analytical cookies, as described below:
- Essential: indispensable to the operation of the service. They cannot be disabled.
- Functional: store the User's preferences (theme, language).
- Analytical: measure aggregate use of the platform to improve the product. They are set up with the minimum retention and sampling needed, and are never cross-referenced with sensitive chat or media-generation data.
10.Minors
Minors under 18 are not allowed to use the platform. The Controller does not intentionally collect data from minors, and deletes it immediately if any is found. Legal guardians who discover that a minor in their care is using the platform should report it right away to dpo@desejoia.com.
11.Changes to this Policy
Material changes will be announced at least 30 (thirty) days in advance, by email and/or a notice on the platform.
12.Contact
To exercise data subject rights, ask a privacy question or file a complaint:
- DPO: dpo@desejoia.com
- General support: contato@desejoia.com
- ANPD (Brazil's National Data Protection Authority): gov.br/anpd