Privacy Policy

Mentora Digital is an AI platform for social media content creation, operated in Brazil and available at querofaturaronline.com.br, mentoradigital.com.br and ezmoneymentor.com. This Policy was drafted to comply with the Brazilian General Data Protection Law (LGPD — Law No. 13,709/2018), the EU General Data Protection Regulation (GDPR — Reg. (EU) 2016/679) and the California Consumer Privacy Act (CCPA). By using the service, you accept this Policy and our Terms of Use.

We collect only what is needed to deliver the service:

• Account: name, email and avatar from your login provider (Google or email/password).
• Usage: prompts, conversations, generated content, consultancy history, language and preferences.
• Technical: IP address, browser, operating system, access time and session identifiers.
• Billing: billing data (name, tax ID and address) stored encrypted. Card numbers are processed exclusively by the payment gateway — we never store them.
• Analytics/advertising cookies: only with your explicit consent via the cookie banner.

Your data is used for: authentication and access control; delivery and improvement of AI tools; payment processing and credit (⚡) management; fraud and abuse prevention; transactional communications; continuous product improvement; and compliance with legal obligations.

We process your data based on: (1) contract performance — to deliver the service; (2) legal obligation — to comply with tax and regulatory law; (3) legitimate interest — for security and product improvement; (4) consent — for optional cookies, revocable at any time.

The platform's AI tools generate suggestions and content from the prompts you submit; they support your creation and do not make decisions with legal or similarly significant effects on a solely automated basis. You may request information about the general criteria of automated processing and ask for human review, as provided by Art. 20 of the LGPD.

We do not sell your data. We share the minimum required with technical processors:

• Stripe — PCI-DSS certified payment gateway (charge processing and subscription management).
• AI model providers (Google, Anthropic and similar) — only to execute the prompts you submit.

We do not sell your personal data and we do not use your content to train third-party AI models.

We use the following sub-processors to operate the service:

• Stripe, Inc. (USA) — payment processing. Policy: stripe.com/privacy.
• AI image and video generation infrastructure (USA) — processing of the visual prompts you submit.
• Google LLC (USA) — AI models (Gemini), OAuth authentication and infrastructure. Policy: policies.google.com/privacy.
• Meta Platforms, Inc. (USA) — OAuth authentication (Facebook/Instagram). Policy: facebook.com/privacy.
• Transactional email delivery provider (global infrastructure) — delivery of account, verification and notification emails.
• Anthropic, PBC and other LLM providers (USA) — AI conversation execution.

This list may be updated when we add or replace sub-processors. Material changes will be communicated in this policy.

Our sub-processors operate primarily in the USA. By using the service, your data may be transferred outside Brazil or the EU. We ensure these transfers occur under appropriate mechanisms: Standard Contractual Clauses (SCCs) approved by the European Commission and equivalent mechanisms required by Art. 33 of the LGPD.

We apply technical and organizational measures to protect your data, including encryption in transit (TLS) and encryption of sensitive data at rest, role-based access controls, logical data isolation between users, and audit logging of critical operations. No system is completely immune to risk, but we work continuously to reduce the likelihood and impact of incidents.

We retain your data for as long as necessary for the purposes described:

• Active account: data retained while your account exists.
• Chat attachments: files sent in conversations are kept for a short period after processing.
• Support records: retained for the time needed for resolution and quality control.
• Generated content (images, videos): 30 days from creation, unless marked as favourite.
• Financial records: for the period required by Brazilian tax law.
• Account deletion: profile anonymised, conversations and content deleted. Financial records retained as legally required.

We use essential cookies (required for service operation) and, with your consent, analytics and advertising cookies. Advertising cookies (e.g. Google Ads) are only activated after your explicit acceptance via the cookie banner. Without your consent, no non-essential cookies are activated.

Mentora Digital is intended solely for users aged 18 or over. We do not knowingly collect data from minors. If we become aware that we have collected data from a minor without appropriate parental consent, we will delete that information as quickly as possible. Guardians who identify such a situation may contact us at suporte@querofaturaronline.com.br.

Whether you are in Brazil, the EU, California or anywhere else, you may at any time:

• Access your personal data and obtain a copy.
• Correct incomplete, inaccurate or outdated data.
• Request account deletion directly from the panel.
• Request portability of your data in a structured format.
• Withdraw consent for optional cookies at any time.
• Object to processing or request restriction when data is processed on the basis of legitimate interest.
• Opt out of having your personal data sold — we want to be clear that we do not do this.
• Lodge a complaint with the ANPD (gov.br/anpd) or the competent authority in your country.

In the event of a security incident posing a relevant risk to data subjects, we will notify the ANPD and affected individuals within the timeframes set out in Art. 48 of the LGPD and, where applicable, within 72 hours as required by the GDPR.

Europe/United Kingdom (GDPR/UK GDPR): we apply Standard Contractual Clauses for data transfers. We have not yet designated an EU Representative under Art. 27 of the GDPR — this will be arranged when the volume of European users warrants the formal appointment.

California (CCPA/CPRA): you have the right to know, access, correct and delete your data, and to opt out of having it sold. We do not sell or share personal data of California residents for advertising without consent.

To exercise your rights, ask questions or report privacy incidents: suporte@querofaturaronline.com.br. We aim to respond within 15 business days.

When we update this policy, we will notify you within the service and update the date. Material changes affecting your rights will be communicated in advance and, where required, will request new consent.