Controller and contact
The controller is VINICIUS LOJHAN MARTINEZ HERNANDES CONSULTORIA EM TECNOLOGIA DA INFORMACAO LTDA - ME, CNPJ 61.003.057/0001-39. Vinicius Lojhan Martinez Hernandes is the privacy lead. Contact privacy@angelim.app or contato@angelim.app.
Data we process
- Identity and authentication: email, name, avatar, Clerk identifiers, sessions, and API-key metadata.
- Financial models: scenarios, assets, debts, income, expenses, taxes, plans, assumptions, events, revisions, and simulation results.
- Billing: plan, subscription status, and Stripe identifiers. Angelim does not store full card numbers.
- Preferences, legal and consent receipts, privacy requests, and minimized technical records.
Purposes and legal bases
We process data to create and secure accounts, provide simulations, synchronize models, process billing, support users, and meet legal duties. Legal bases include contract performance, legal obligation, and documented legitimate interests in security and reliability. Optional product analytics relies on consent and may be refused or withdrawn at any time.
Providers and transfers
We use Clerk (identity), Stripe (payments), Neon (database), Vercel and Vercel Blob (hosting and private exports), and PostHog (consented anonymous analytics). These providers may process data outside Brazil. Before such transfers, we assess and adopt the contractual mechanisms and safeguards required by applicable law. Public market-data sources do not receive user personal data.
Analytics, cookies, and automated decisions
Essential cookies and storage support authentication, language, theme, and local Studio data. PostHog starts only after consent; events are not associated with a name, email, or account ID. We honor Global Privacy Control as a denial. We do not sell data, use targeted advertising, or make decisions with legal effects about users. rrweb and session replay are not used.
Retention and deletion
Models remain while an account is active or until earlier deletion. Exports expire after 7 days; anonymous analytics after up to 30 days; operational logs after up to 30 days; security logs after up to 90 days; acceptance and request evidence after up to 5 years; legally required tax or billing records after up to 7 years. Primary deletion targets 7 days and is capped at 30 days except for legal retention. Backups expire under the documented provider cycle, and deletions are replayed before a restored backup serves traffic.
Your rights
You may confirm processing, access, export, correct, restrict, object, withdraw consent, request deletion, and appeal. Use Account → Privacy or privacy@angelim.app. We provide full LGPD access within 15 days and handle other verified requests within 30 days. You may also complain to the ANPD or another competent authority.
Security and incidents
We use provider encryption in transit and at rest, access controls, MFA, environment separation, log minimization, and security testing. No system is infallible. We will report qualifying incidents within applicable legal deadlines.
United States resident rights
Where applicable state law grants these rights, United States residents may request knowledge and access, correction, deletion, portability, limits on sensitive-data processing, and an appeal. We do not sell or share personal data for cross-context behavioral advertising and honor Global Privacy Control. We do not discriminate against people who exercise privacy rights. An authorized agent may submit a request, subject to legally permitted verification.