Version 1.2 — September 23, 2026
Notice: This is a translation provided for convenience only. The original version in Brazilian Portuguese is the legally binding one and, in the event of any discrepancy, it shall prevail.
1. Who we are (data controller)
This Policy describes how Alasphera collects, uses, stores and protects the personal data of those who use the platform.
Data controller (Art. 5, VI of the LGPD — Lei Geral de Proteção de Dados, Brazil's General Data Protection Law): [MEI legal business name to be filled in], CNPJ (Brazil's National Registry of Legal Entities) [to be filled in], hereinafter "Alasphera", "we".
As an Individual Microentrepreneur (MEI — Microempreendedor Individual, a simplified Brazilian business registration), we are not legally required to appoint a formal Data Protection Officer (DPO) — even so, we maintain a contact channel dedicated to privacy (Section 11).
2. What data we collect and why
2.1. Data provided at registration
| Data | Purpose | Category (LGPD) |
|---|---|---|
| First and last name | Account identification, personalization of the service | Ordinary personal data |
| Login, communication, registration confirmation, billing | Ordinary personal data | |
| Phone number | Contact, account recovery, support | Ordinary personal data |
| Date of birth | Verification of the minimum age (18 years) | Ordinary personal data |
| Password | Authentication (encrypted, never in plain text) | Ordinary personal data |
| Relationship with the Doctrine | Personalizing how Alasphera conducts the conversation | 🔴 Sensitive data — religious belief (Art. 5, II) |
| "What brings you here today" | Personalizing the tone of the initial welcome | 🔴 Sensitive data — may reveal emotional state/mental health (Art. 5, II) |
⚠️ The processing of the two sensitive fields above depends on your specific and highlighted consent (Art. 11 of the LGPD), collected separately from the general acceptance of these Terms on the registration screen.
2.2. Payment data
We do not collect or store credit card data directly. All processing is carried out by Stripe; we only receive the subscription status.
2.3. Usage and technical data
IP address, device and browser type, pages visited and time of use, for security, diagnostics and product improvement.
3. Data from conversations with Alasphera
3.1. Storage: the content of conversations is stored on Supabase, so that you can access your history.
3.2. Retention period: for as long as your account is active. After deletion, the procedure in Section 7 applies.
3.3. Model training: Alasphera does not use the content of your conversations to train third-party models. Messages are sent to Groq via API solely to generate the response for that conversation.
3.4. Internally, we may analyze conversations in an aggregated and de-identified manner (e.g., most searched topics), without identifying individual users.
4. Sharing with third parties (data processors)
| Third party | Role | Data shared |
|---|---|---|
| Supabase | Database, authentication, storage | Registration data, password (encrypted), conversation history |
| Groq | AI engine that generates Alasphera's responses | Content of the messages sent during the conversation |
| Stripe | Payment processing | Payment data and subscription status |
| Google Analytics | Site access and usage metrics | Browsing data |
We do not sell, rent or share your data with third parties for third-party advertising purposes.
5. Legal basis for processing
| Purpose | Legal basis (LGPD) |
|---|---|
| Relationship with the Doctrine / reason for use (sensitive data) | Specific and highlighted consent (Art. 11, I) |
| Account creation/maintenance, billing, provision of the service | Performance of a contract (Art. 7, V) |
| Security, fraud prevention, legal obligation | Compliance with a legal obligation (Art. 7, II) / legitimate interest (Art. 7, IX) |
| Analytics cookies (Google Analytics) | Consent (Art. 7, I) |
6. Your rights as a data subject (Art. 18 of the LGPD)
- ✅ Confirmation and access — to know whether we process your data and to obtain a copy;
- ✅ Correction — to correct incomplete, inaccurate or outdated data (available under Profile);
- ✅ Deletion — to request the erasure of your data (available under Profile → Delete account);
- ✅ Portability — to receive your data in a structured format (available under Profile → Export my data);
- ✅ Withdrawal of consent — at any time, for sensitive data and analytics cookies;
- ✅ Information about sharing — to know with whom your data is shared;
- ✅ Objection — to object to processing carried out on a basis other than consent, where applicable.
To exercise any right, use the channel in Section 11.
7. Data retention and deletion
| Situation | Retention period |
|---|---|
| Active account | For as long as the account is active |
| Cancellation of the paid subscription | Data remains (now on the Free plan) until a deletion request |
| Account deletion, at the data subject's request | Deleted within 30 calendar days, except data required by legal obligation (e.g., tax records) |
| Billing data at Stripe | In accordance with Stripe's own policy and the applicable legal obligations |
8. Cookies and analytics tools
We use Google Analytics (GA4) to understand how the site is used. You can manage cookies through the banner displayed on your first visit, or review/withdraw your choice in your browser settings.
9. Minors
Alasphera is intended for persons 18 years of age or older. We do not knowingly collect data from minors. If we identify an account belonging to a minor, it may be suspended and the data deleted.
10. Information security
| Measure | Description |
|---|---|
| Encryption in transit | All communication is encrypted (HTTPS/TLS) |
| Encryption at rest | Data in the database (Supabase) encrypted at rest |
| Row Level Security (RLS) | Each user can only access their own data, enforced at the database layer |
| Secure authentication | Passwords never stored in plain text, managed by Supabase Auth |
| Internal access control | Team access restricted to the minimum necessary |
| Monitoring | Error and availability tracking in production |
No system is 100% immune to incidents. In the event of a relevant incident, we will notify those affected and the ANPD (Autoridade Nacional de Proteção de Dados, Brazil's National Data Protection Authority), in accordance with Art. 48 of the LGPD.
11. Contact channel
Questions, exercise of rights or concerns about your data: contato@alasphera.com.
12. Changes to this Policy
This Policy may be updated from time to time. Material changes — especially regarding sensitive data or the list of third parties — will be communicated by email or by a notice on the platform at least 15 days in advance.