Privacy Policy
This Privacy Policy describes the processing of personal data carried out by Desejo IA, in compliance with the General Data Protection Law (LGPD — Lei 13.709/18). Protecting the privacy of data subjects is a central element of the platform's operation.
1.The Controller
The Controller of personal data, pursuant to art. 5, VI, of the LGPD, is Alfa Engenharia de Software Ltda., sociedade empresária limitada inscrita no CNPJ sob o nº 47.250.542/0001-86, com sede na R. Sete de Abril, 264, andar 4, sala 410, Centro, São Paulo/SP, CEP 01.044-904 ("Desejo IA" or "Controller"), operator of the platform.
Data Protection Officer (DPO): Officer designated by the Controller — contact: dpo@desejoweb.online.
2.Personal data processed
Registration and account data: email address, password (stored as a hash generated by a modern key derivation function (KDF), resistant to brute force, in accordance with OWASP best practices — never in plain text), optional name, date of acceptance of the terms relating to legal age, and profile photo, when provided.
Usage data: messages exchanged with the characters, prompts used in the generation of images and videos, traits of created characters, media received, Hearts balance and transaction records.
Technical data: IP address (stored in salted-hashed form — not reversible in practice), browser, operating system, device identifier and access logs (minimum period of 6 months, pursuant to the Internet Civil Framework).
Payment data: name, CPF (required for processing Pix and issuing an invoice) and billing address, where applicable. Credit card data is not stored by the Controller, being kept exclusively by the payment gateway regulated by the Central Bank of Brazil.
Sensitive data: the platform is intended as an adult companion. The User's character choices, messages and preferences may reveal aspects of their intimacy. Such data is treated with the utmost confidentiality, on the legal basis of express consent (art. 11, II, 'a', of the LGPD), given by the User when creating an account and using the service.
3.Purposes and legal bases for processing
| Purpose | Legal basis |
|---|---|
| Operation of the service (authentication, generation of responses, storage of conversations, payment processing) | Performance of a contract (art. 7, V) |
| Fraud and abuse prevention (lockout, anti-CSAM, bot detection) | Legitimate interest (art. 7, IX) |
| Product improvement and preparation of aggregate statistics | Legitimate interest (art. 7, IX), with impact assessment |
| Marketing and communications about the platform | Consent (art. 7, I), revocable at any time |
| Compliance with legal obligations (tax, regulatory and court orders) | Compliance with a legal obligation (art. 7, II) |
| Processing of sensitive data (intimate preferences and adult content) | Express consent (art. 11, II, 'a') |
4.Data sharing
The Controller shares strictly necessary data with the following categories of third parties:
- Artificial intelligence providers specialized in language models and media generation, under a contract with data protection clauses. Only the content necessary for generation is transmitted to each provider.
- Payment gateway regulated by the Central Bank of Brazil, for processing the charge.
- Infrastructure providers (hosting, media storage and transactional email), which act as processors under a contract with data protection clauses.
- Competent authorities, upon a court order or valid legal request.
The Controller does not sell personal data and does not share message content with advertisers or third parties for marketing purposes.
5.International data transfer
Some of the providers referred to above are based outside the national territory (notably the United States and Europe). The international transfer of data takes place on the basis of adequate protection guarantees, standard contractual clauses and, where applicable, the informed consent given by the data subject when using the service.
6.Rights of the data subject
The LGPD (art. 18) grants the data subject the rights below, exercisable by request sent to dpo@desejoweb.online:
- Confirmation of the existence of processing and access to the data.
- Correction of incomplete, inaccurate or outdated data.
- Anonymization, blocking or deletion of unnecessary data or data processed in noncompliance.
- Portability of the data to another provider.
- Deletion of data processed on the basis of consent, subject to legal retention obligations.
- Information about the entities with which the Controller shares the data.
- Revocation of consent at any time.
- Objection to processing based on legitimate interest.
Requests will be answered within a maximum period of 15 (fifteen) days. In the event of improper processing, the data subject may file a complaint with the National Data Protection Authority (ANPD).
7.Data retention
- Registration data: during the term of the account and for 5 (five) years after its closure, due to tax requirements and fraud prevention.
- Access logs: minimum period of 6 (six) months (Internet Civil Framework), which may be extended to 1 (one) year.
- Conversations and media: during the term of the account. Early deletion may be requested through the DPO channel.
- Financial transactions: 5 (five) years after the taxable event (Decreto 9.580/18 — Income Tax Regulation).
- After the periods elapse, the data is anonymized or deleted.
8.Information security
The Controller adopts the following technical and administrative measures:
- Passwords stored using a modern key derivation function (KDF), resistant to brute force, in accordance with OWASP best practices.
- TLS 1.2+ on all connections.
- Cookies marked as HttpOnly, Secure and SameSite.
- Salted hashing of the IP prior to logging (art. 12 of the LGPD — anonymization).
- Automatic lockout after multiple authentication attempts.
- Principle of least privilege on internal access, with audit logging.
- Encrypted backups stored in a segregated location.
In the event of a security incident involving risk to data subjects, the Controller will act with reasonable diligence to contain, investigate and notify the data subjects and the ANPD, in accordance with applicable legal requirements.
9.Cookies and similar technologies
The platform uses essential cookies (session and preferences) and analytical cookies, as described below:
- Essential: indispensable to the operation of the service. They cannot be disabled.
- Functional: store the User's preferences (theme, language).
- Analytical: measure the aggregate use of the platform for the purpose of improving the product. They are configured with the minimum necessary retention and sampling and do not cross-reference with sensitive conversation data or media generation.
10.Minors
Use of the platform is prohibited for minors under 18. The Controller does not intentionally collect data from minors. In the event of identifying the collection of a minor's data, the Controller will proceed with immediate deletion. Legal guardians who identify the use of the platform by a minor under their care should immediately report the fact to the channel dpo@desejoweb.online.
11.Changes to this Policy
Material changes will be communicated with a minimum notice of 30 (thirty) days, by email and/or notice on the platform.
12.Contact
To exercise rights, clarify questions relating to privacy, or submit complaints:
- DPO: dpo@desejoweb.online
- General support: contato@desejoweb.online
- ANPD (National Data Protection Authority): gov.br/anpd