Privacy Policy

This Policy explains how AISAC handles personal data across all of its sites and services. It is a single document for the whole ecosystem, kept in the Legal Center. It was written to be read by people, not only by lawyers — so it says what we actually do, including where one service differs from another.

1. Who we are and how to reach us

The controller of personal data processed on AISAC sites and services is the company below, which is responsible for the AISAC brand:

If a service's specific notice names another company as responsible for that service, the notice applies.

We act as controller when we decide why and how data is processed — for example in account administration, billing, security and on our own sites. When you store information about other people in an AISAC service (in a memory, a page or a contact list, for example), you decide what goes in and for what; in that case we process that content to provide the service you signed up for, and you are responsible for the legal basis of that use.

2. Which sites and services this Policy covers

This Policy applies to all AISAC sites and services, including their subdomains:

• AISAC Global (aisac.global) — institutional site of the ecosystem;
• AISAC.cloud (aisac.cloud) — products, technology and systems site;
• AI Brain (ai-brain.aisac.cloud, mcp.ai-brain.aisac.cloud) — persistent memory for AI tools (subscription);
• AISAC Publisher (aisac.cloud/publisher) — tikTok video publishing and metrics from your AI tool;
• AISAC Academy (aisac.academy) — courses and training platform;
• AISAC Agency (aisac.agency) — aI-operated marketing and acquisition platform (closed beta);
• AISAC Community (aisac.community) — community, cohorts and verifiable credentials.

Some services publish a service-specific notice detailing that service's data, providers and retention periods. A service-specific notice supplements this Policy and prevails on what is specific to that service. The current list of service-specific notices is kept in the Legal Center.

This Policy does not apply to third-party sites and services — including those you connect to an AISAC service, such as your AI tool, your ad account or the platform where you made a purchase. Each of them has its own policy.

3. What data we process

It depends on what you do. By situation:

• When you visit a site: technical records produced by any web server — time, IP address, browser, requested page — and, only where stated under Cookies and browser storage, audience metrics.
• When you write to us: your email address, your name if you provide it and the content of your message.
• When you create and use an account: email address, name, account identifier, access codes, sessions, authentication events and, if you sign in with a Google account, the basic profile data Google shares (name, email address and picture).
• Content you create or submit: memories, notes, pages, courses, posts, comments, files and anything else you put into a service, plus dates and edit history.
• Integrations you connect: identifiers and access tokens for the third-party accounts you authorize (for example Google, Meta, LinkedIn or TikTok), the permissions granted and the data those accounts return when you request an action.
• Purchases and subscriptions: product, plan, amount, payment status, transaction identifiers and billing details. Card numbers are entered directly with the payment platform — we do not receive them.
• Public profile and credentials: when a service offers a profile or a verifiable credential and you choose to make it public, your name, picture and the information you chose to display.
• Support and optional surveys: what you tell us in a support request and the answers you choose to give in optional surveys.

We do not ask for sensitive data (health, religion, racial origin, biometrics and the like). Avoid putting it into a service, as well as passwords, API keys or third-party data you are not authorized to use.

4. Why we use data and on which legal basis

Each use has a purpose and a legal basis under Brazil's LGPD (Law 13,709/2018). For people in the European Economic Area or the United Kingdom, we also state the corresponding GDPR basis.

• Providing the service you asked for — creating and keeping your account, storing and processing your content, running the integrations you authorized and answering support: performance of a contract or of pre-contractual steps at your request (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Billing, issuing tax documents and keeping commercial records: legal obligation and performance of a contract (LGPD art. 7, II and V; GDPR art. 6(1)(c) and (b)).
• Keeping sites and services available and secure — technical records, fraud and abuse prevention, incident investigation: legitimate interests (LGPD art. 7, IX; GDPR art. 6(1)(f)) and, for application access records, legal obligation (Brazilian Internet Civil Framework, art. 15).
• Replying when you write to us: pre-contractual steps at your request or our legitimate interest in answering whoever contacts us.
• Sending service communications — access, security, billing, relevant changes: performance of a contract.
• Sending news and offers: consent or, for existing customers and where the law allows, legitimate interests — always with an unsubscribe link in every message.
• Measuring audience with tools that require consent and handling answers to optional surveys: consent (LGPD art. 7, I; GDPR art. 6(1)(a)), which you can withdraw at any time.
• Defending rights in judicial, administrative or arbitration proceedings: regular exercise of rights (LGPD art. 7, VI; GDPR art. 6(1)(f)).

When we rely on legitimate interests, we first weigh whether they are overridden by your rights and use only what is necessary. You can object to that use through the privacy channel.

5. Your content, artificial intelligence and integrations

Several AISAC services use artificial intelligence models to work — for example, to create numerical representations (embeddings) that enable search by meaning, or to generate text and pages at your request. To do so, excerpts of the content involved are sent to AI model providers, such as OpenAI, only when the feature is used.

• AISAC does not use your content to train AI models.
• We use these providers through their APIs, which, under their current terms, do not use submitted data to train models by default. They may keep data for a short period to monitor abuse, according to each provider's policies.
• When you connect your own AI tool (Claude, ChatGPT or another) to an AISAC service, whatever the service returns to it is also processed by that tool's provider, under the terms you accepted with them.

Integrations with third-party accounts. When you authorize an AISAC service to access one of your accounts (Google, Meta, LinkedIn and others), we store the access token securely and use it only for the actions you requested or configured. You can revoke access in the service itself or in the third-party account's security settings; revoking prevents future access but does not delete what the third party has already received.

Use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data obtained from Google APIs is not used for advertising or to train AI models.

6. AISAC Publisher and TikTok

AISAC Publisher publishes to your TikTok profile, or sends to your TikTok inbox as drafts, the videos you ask your AI tool (such as Claude) to post, with that tool connected over MCP to our server at mcp-tiktok.vercel.app, and, when you ask, reads the numbers of your account and of your public videos. It uses three TikTok products — Login Kit, so you can authorize access, the Display API, to read the profile and the numbers, and the Content Posting API (direct post and drafts) — and asks for only six permissions: user.info.basic, to identify your account; user.info.profile, user.info.stats and video.list, to read, when you ask, your profile, your account totals and your public videos; video.publish, to publish the videos you confirm; and video.upload, to send to your TikTok inbox, as drafts, the videos you confirm — you finish and post them in the TikTok app. On TikTok's consent screen you can untick the three read permissions; publishing still works without them.

What we receive and store:

• From your account, when you connect: the identifiers TikTok assigns to your account for our app (open_id and union_id), your display name and the permissions you granted.
• Access and refresh tokens issued by TikTok, encrypted with AES-256-GCM before they are stored. They are never shown to you or to your AI tool.
• Before each post, we ask TikTok for your profile's nickname and username, the privacy options available to your account, the maximum video length and whether comments, duet and stitch are allowed — to build the preview you review. Of these, we keep only the username, with the post's record.
• A record of each post or draft: request identifier, dates, status, chosen privacy level (a draft has none: you choose it in TikTok), identifiers returned by TikTok (for the publish request and the post), the video's temporary address and error codes. The caption is not stored: we keep only a fingerprint (SHA-256 hash) of the request, so the same post is not published twice.
• The video file you upload is stored temporarily on Cloudflare R2, at a random, unlisted address on tiktok-media.aisac.cloud, only so TikTok can fetch it. It is deleted automatically after about 2 days — the cleanup runs once a day, so it can take up to 3 days.

What we read without storing:

• When you ask for your profile or your metrics, we ask TikTok for your profile (username, bio, profile link and verified badge), your account totals (followers, accounts you follow, likes received and number of public videos) and, for each public video, its identifier, title, description, duration, cover, link, publish date, views, likes, comments and shares. TikTok only returns public videos.
• This data goes straight to your AI tool, in the reply to that request. We do not store it in our database, in a cache or in the server logs, and we only fetch it when you ask — we do not monitor your account in the background.

What we do not do:

• We do not read comments, messages, the list of who follows you or whom you follow, or your private videos — the app has no permission to.
• We publish nothing until you review the preview and confirm that post.
• A draft is only published if you post it in the TikTok app.
• We do not use data received from TikTok for advertising or to train AI models, we do not sell it and we do not pass it to other AISAC services or to third parties beyond the processors below.

Purpose and legal basis: identifying your account, publishing what you asked for with the settings you chose, showing the status of each post and, when you ask, bringing you your profile and the numbers of your account and of your public videos — performance of a contract (LGPD art. 7, V; GDPR art. 6(1)(b)).

Who sees it: TikTok receives each post's video, caption and settings (for a draft, only the video), because it is where the post goes, and processes them under its own Terms of Service and Privacy Policy. Vercel (server execution), Supabase (database), Cloudflare (temporary video storage) and Upstash (encrypted cache and the queue that tracks each post's status) act on our behalf. The AI tool you use sees what you write and what the service replies, including the profile and the numbers you ask for, as explained in Your content, artificial intelligence and integrations. If you attach the video in your AI tool, that tool receives the file and uploads it to us, under its own terms.

How long:

• identifiers, tokens and post records: while your account is connected and until you ask for deletion;
• video files: about 2 days, 3 at most;
• profile and performance numbers: not stored — they are fetched again on each request;
• server technical logs, which contain no tokens, names, captions, videos, profile data or performance numbers: for the periods in How long we keep data.

How to disconnect: in the TikTok app, tap Profile → ☰ menu → Settings and privacy → Security & permissions → Apps and services permissions → AISAC Publisher → Remove access. From then on we can no longer access your account, read your profile and numbers or post to it. The data above stays stored — the tokens encrypted and no longer valid — until you ask for deletion.

How to request deletion: write to dpo@aisac.global with your TikTok @ handle. We delete the identifiers, tokens and post records within 15 days and confirm by email. Posts already published stay on TikTok: to remove them, delete them in the TikTok app.

AISAC is not affiliated with, sponsored by or endorsed by TikTok. TikTok is a trademark of ByteDance Ltd.

7. Cookies and browser storage

Institutional sites (aisac.global and aisac.cloud):

• They write nothing to your browser — no cookie, no localStorage, no sessionStorage. If they ever ask for consent, nothing will be written before you choose.
• On aisac.global, Cloudflare collects aggregated performance and visit metrics (Cloudflare Web Analytics). The tool uses no cookies or local storage and does not identify individual visitors. That page's typefaces are loaded from Google Fonts servers, which receive your IP address to deliver them.
• On aisac.cloud there is no audience measurement and fonts are served by the site itself.
• No measurement tool that requires consent (such as Google Analytics) is active today. Before enabling one, we will update this section with the tool and its retention period and start asking for your consent, with a permanent control to review your choice at any time.

Product, event and community pages (such as ai-brain.aisac.cloud, aisac.community and imersao.aisac.community):

• They may measure campaigns with Google Analytics and Meta Pixel, which load only after you accept in the consent notice. Declining does not prevent you from using the page. Your choice is stored in your browser so we do not ask again.
• Nothing is stored in your browser before you choose. When you arrive through a campaign link, the URL's campaign parameters (utm_*) are used only while the page is open, to be passed on to checkout. They describe the ad or link you came from, not you.

Services with an account:

• They use a strictly necessary session cookie to keep you signed in. It does not depend on consent, because the service cannot work without it.
• They may store interface preferences in your browser (for example, theme or view).
• They may use Cloudflare Turnstile to tell people from bots at sign-in and sign-up.
• Embedded videos (such as YouTube's) may collect data when you play them, under the provider's policy.

You can delete cookies and site data in your browser settings. Deleting the session cookie signs you out.

8. Who we share data with

We do not sell personal data. We share only what each purpose requires, with providers that process data on our behalf (processors), depending on the service you use:

• Cloudflare — DNS, CDN, site hosting, attack protection, Turnstile and aggregated metrics;
• Vercel — application hosting and execution;
• Supabase — database and authentication;
• Google — corporate email (Google Workspace), Sign in with Google, typefaces (Google Fonts), cloud infrastructure (Google Cloud) and, with consent, audience measurement;
• Meta — campaign measurement (Meta Pixel) on product and event pages, only with consent;
• Resend — transactional email delivery, such as access codes;
• Upstash — caching and processing queues;
• OpenAI and other AI model providers — content processing when you use an AI feature;
• Hotmart and other payment platforms — purchase and subscription processing. In those purchases the platform also processes your data under its own policy.

When you ask an AISAC service to act on one of your third-party accounts — for example, to publish a video to TikTok through AISAC Publisher — we send that platform what the action requires. It is not our processor: it handles the data as a controller, under its own policy.

Each service-specific notice states which of these providers that service uses. We may also share data to comply with the law or an order from a competent authority, to exercise rights in proceedings, or in a corporate reorganization (merger, acquisition), in which case the successor remains bound by this Policy.

9. International transfers

Several of the providers above operate outside Brazil, mainly in the United States, and may process data in different countries. The location of a database does not mean that all processing happens in that same country.

These transfers follow article 33 of the LGPD — in particular the standard contractual clauses set out in ANPD Resolution CD/ANPD No. 19/2024, where applicable — and, for data of people in the European Economic Area or the United Kingdom, Chapter V of the GDPR, through adequacy decisions or standard contractual clauses. You can ask the privacy channel which mechanism is used with each provider.

10. How long we keep data

• Account and content: while the account is active. When you ask for deletion, we remove the data from the live database; backups expire on the provider's technical cycle and are never restored to bring back what was deleted.
• Application access records: 6 months, as required by article 15 of the Brazilian Internet Civil Framework, or longer under a court order.
• Purchase records and tax documents: for the period required by tax and commercial law — as a rule, 5 years.
• Contact and support messages: for as long as needed to resolve the matter and, where there is a consumer relationship, for the legal period in which a claim can still be made.
• Integration tokens: until you revoke the integration, close the account or the token expires. For AISAC Publisher, until you ask for deletion (see AISAC Publisher and TikTok).
• Videos uploaded to AISAC Publisher: about 2 days, 3 at most, only until TikTok fetches them.
• Optional survey answers: until you delete them or close the account.
• Hosting and CDN technical records: for each provider's operational and security periods.

Cancelling a subscription is not the same as deleting the account: data is kept until you ask for deletion, so you can come back without losing anything.

11. Your rights and how to exercise them

Under the LGPD (art. 18), you can ask for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of data that is unnecessary, excessive or processed unlawfully;
• portability of your data to another provider;
• deletion of data processed on the basis of your consent;
• information about whom we share your data with;
• information about the possibility of not consenting and its consequences;
• withdrawal of consent, without affecting what was done before it;
• objection to processing based on another legal basis, if it does not comply with the law;
• review of decisions made solely on the basis of automated processing (art. 20).

Under the GDPR (arts. 15 to 22), people in the European Economic Area or the United Kingdom have the rights of access, rectification, erasure, restriction of processing, portability, objection (including, without exception, to direct marketing) and not to be subject to a decision based solely on automated processing that produces legal or similarly significant effects.

How to ask: write to dpo@aisac.global — even if you no longer have access to your account. We may ask for proportionate information to confirm it is you, so that nobody can request your data in your name. We reply within the legal deadlines: full confirmation and access within 15 days (LGPD, art. 19) and, for requests under the GDPR, within one month, extendable by two further months for complex requests, with notice (GDPR, art. 12).

You can also lodge a complaint with Brazil's National Data Protection Authority (ANPD) and, if you are in the European Economic Area or the United Kingdom, with the data protection authority of the country where you live, work or where the alleged infringement took place.

12. Automated decisions

We do not currently make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. Technical limits applied automatically to protect the infrastructure (such as request rate limits) do not evaluate personal aspects. If a service starts making that kind of decision, its service-specific notice will state the criteria used and how to ask for review by a person.

13. Security

We use HTTPS on all sites and services; on the institutional sites, also HSTS and a restrictive content security policy. In services with an account, we use per-account access control with separation of each account's data, credentials stored hashed or encrypted, and internal access restricted to what is strictly necessary.

No system is immune to incidents. If a security incident may cause relevant risk or harm, we will notify the affected data subjects and the ANPD — and, where applicable, the competent European authority — in the manner and within the deadlines set by law. Please also protect your devices, codes and tokens, and tell us at dpo@aisac.global if you suspect misuse.

14. Children and adolescents

AISAC sites and services are intended for people aged 18 or over and are not directed at children or adolescents. We do not knowingly collect data from minors. If you become aware of such a case, write to dpo@aisac.global and we will remove the data.

15. Changes to this Policy

We may update this Policy to reflect changes in our services, providers or the law. The version and effective date are at the top of the page, and the version history is in the Legal Center. When a change is relevant, we will tell account holders by email or in the service itself and, if it depends on consent, ask for it again.

This Policy is published in Portuguese and English with the same content. For users in Brazil, the Portuguese version prevails.

16. Contact

Privacy and data protection, including exercising your rights: dpo@aisac.global. General matters: contact@aisac.global. Postal address: AISAC TECNOLOGIA, SISTEMAS E CERTIFICAACOES LTDA, Av. Cristóvão Colombo, 2144, Sala 408, 3º andar — Floresta, Porto Alegre/RS, postal code 90560-001, Brazil.

See also the Terms of Use.