Privacy Policy

This Policy describes how Orça Voz collects, uses, stores, shares, and protects personal data, in accordance with Brazil's General Data Protection Law (LGPD — Law No. 13,709/2018) and, where applicable, other data protection laws in the regions where our users are located.

Data Controller: Bruno Vinicius Rosa Cristiano - BVRC E-Sport, Brazilian Tax ID (CNPJ) 36.876.158/0001-77, Rua Toronto, 218, Jardim Canadá, Maringá - PR, Brazil, ZIP 87080-570. Privacy contact: speakestimate@gmail.com.

1. Principles we follow

We process data observing purpose limitation, adequacy, necessity (we collect only the minimum required), transparency, security, and accountability — the principles set out in Article 6 of the LGPD.

2. What data we collect, why, and on what legal basis

Name, email, phone, company name, and tax ID (optional) at sign-up — legal basis: performance of a contract. Audio (transcribed and then discarded), transcribed text, and quote data you create — performance of a contract. Logo you upload — performance of a contract. Billing data, processed directly by Stripe — performance of a contract. Email/phone for marketing, only if you check the box (unchecked by default) — consent. Analytics/advertising cookies, only if you accept them in the banner — consent. IP address and technical logs — legitimate interest, for security and abuse prevention.

We do not collect national ID numbers, full residential addresses, identity documents, or sensitive data (health, biometrics, orientation, etc.), except for anything you may mention on your own in the audio — which we recommend avoiding, since it is not necessary.

3. The audio you record

The raw audio is sent directly to the transcription provider and is never stored by Orça Voz — it is discarded as soon as the transcript is generated. Only the transcribed text is saved. Avoid recording conversations or the voices of third parties without an adequate legal basis.

4. How Artificial Intelligence is used (data minimization)

We send the AI model only the text necessary to build the quote — never your account's institutional data (phone, tax ID, email, login, billing), which is filled in by the system itself afterward. The result goes through technical validation before it is shown to you for review. We do not use users' audio, transcripts, or quotes to train AI models — ours or third parties'.

5. Data of the clients you enter

In that relationship, you (the service provider) act as the data controller for your client's data, and Orça Voz acts as the processor, handling it only to make the quote possible at your request — detailed in `legal/dpa.md`.

6. Cookies

Essential cookies are always active; analytics/advertising cookies run only with your consent, collected through a banner. See our Cookie Policy for details and how to manage them.

7. Sharing with service providers

We use Supabase, OpenAI, Stripe, Resend, Vercel, and, with your consent, Meta Platforms, to operate the Service. We do not sell, rent, or share your data for third-party marketing.

8. International transfers

Some of these providers process data outside Brazil. We seek to ensure adequate protection mechanisms for these transfers — details and pending confirmations in `docs/privacy/international-transfers.md`.

9. Retention and deletion

Raw audio is not retained. Other data remains while your account is active and is cascade-deleted when you delete your account, subject to legal retention obligations (e.g., tax records).

10. Security

We isolate each user's data in the database, require authentication, encrypt communications in transit, and rate-limit requests to prevent abuse. Technical details in `SECURITY_AUDIT.md`. In the event of a relevant incident, we follow a response plan that may include notifying you and Brazil's data protection authority (ANPD).

11. Your rights (Article 18 of the LGPD)

You may, at any time:

• confirm whether we process your data and access it;
• download your data (Privacy and data → Download my data);
• correct incomplete or outdated data;
• request anonymization, blocking, or deletion of unnecessary data;
• request portability of your data;
• delete your account and your data (Privacy and data → Delete my account);
• withdraw marketing or cookie consent at any time;
• request a review of decisions made solely by AI that affect you.

Exercise these rights through the Service's dashboard or by email at speakestimate@gmail.com.

12. Data Protection Officer

Until another officer is formally designated, the contact for data protection matters is speakestimate@gmail.com.

13. Children and teenagers

The Service is not intended for individuals under 18 and does not knowingly target this audience for data collection.

14. Changes

The current version and its effective date are always shown at the top of this page.