Privacy Policy
Last updated: October 11, 2026. Versão em português
This policy explains which data CoAutor processes, what each is used for, who it is shared with and which rights you have, under the Brazilian General Data Protection Law (LGPD, Law 13,709/2018).
1. Who we are
CoAutor (coautor.com.br) is a service that helps authors write and prepare books for publication on Amazon KDP. The controller of the personal data is José Vagner Pitinga Pinto, an individual, CPF (Brazilian taxpayer number) 205.415.238-21, Blumenau/SC, Brazil. Data protection officer (encarregado): José Vagner Pitinga Pinto, privacidade@coautor.com.br.
2. What data we process
Account. Name, email and password. The password is never stored: we keep only an irreversible code (hash). If you sign in with Google, we receive your name and email from Google.
Content you create. Topic, audience, text, chapters, bio and personal data you include in the bio, material you attach (files, notes, website addresses), author photo, reference images, covers, PDFs, banners and generated videos.
Use of the service. A record of actions in the system (which screen or function, date and result), generations in progress or with errors, and artificial intelligence consumption (provider, model, amount of text processed).
Technical data. IP address and access data in the web server logs, used for security and to limit excessive sign-in and sign-up attempts.
Cookies and local storage. One session cookie, to keep you signed in (valid for 30 days), and one temporary cookie (10 minutes) for Google sign-in. In the browser we store only the chosen language and whether the menu is collapsed. We do not use advertising cookies or third-party trackers.
3. What we use it for, and on what legal basis (LGPD, art. 7)
| Purpose | Legal basis |
|---|---|
| Create and maintain your account, generate and store your books, export files | Performance of contract |
| Security, prevention of abuse and fraud, attempt limits, server logs | Legitimate interest |
| Measure AI consumption and how the service is working, fix errors | Legitimate interest |
| Send service emails (account confirmation, password reset, essential notices) | Performance of contract |
| Comply with legal and tax obligations (including keeping access logs) | Legal obligation |
| News or marketing emails, if we ever send any | Consent (which you can withdraw). We do not send any today. |
4. Who we share it with
We do not sell your data. To provide the service, we depend on these suppliers, which process data on our behalf:
- Anthropic (United States): all the text and material of your book go only through it, for writing the chapters, review, fact checking, summarizing attached material, bio, description, KDP listing and suggestions. According to Anthropic's commercial terms, content sent through the API is not used to train models and is deleted from its servers within 30 days. The exception is content its safety systems flag for violating the usage policy: in that case Anthropic may keep the text for up to 2 years and the result of the check for up to 7 years.
- Groq and Google (Gemini): receive only the search terms you look up (to translate the search between Portuguese and English). They never receive your text, your material or your personal data.
- OpenRouter and TypeSafe AI (the "Jev" classifier): answer quick yes-or-no questions and receive only search terms; the text of public Amazon reviews you paste to analyze a competitor; the word list and the scene descriptions our AI generates for word searches, coloring and the cover; and the book's title, subtitle, audience and sales copy, to suggest the KDP category. They never receive the manuscript, the material you attach or your writing samples.
- Image generation (Pollinations, Cloudflare, Google and OpenAI): receive the description of the image for the cover or the coloring page and, at Google, the reference images you upload. They do not receive the text of the book.
- Stripe: processes the payment of the packages. It receives your email and the payment details you type on its page; CoAutor does not receive or store the card number.
- Resend: sends the service emails (from nao-responda@coautor.com.br).
- Google: optional sign-in.
- HostGator (Newfold Digital): hosts the server, the books and the backups. The server is in Brazil.
We also read public pages whose addresses you paste, and Amazon's search suggestions for the terms you look up. The Chrome extension reads the Amazon page you open and keeps the result only in your browser; it sends nothing to any server on its own. The data only reaches CoAutor when you open CoAutor and bring it into the form.
5. International transfer
Located in the United States: Anthropic, Groq, Google, OpenRouter, Cloudflare, OpenAI, Stripe and Resend. TypeSafe AI is reached through OpenRouter. Pollinations and the other image providers may process data in other countries. HostGator hosts the server in Brazil.
The transfer out of Brazil happens because it is necessary to perform the contract with you, that is, to provide the service you asked for (LGPD, art. 33, IX, together with art. 7, V).
6. How long we keep it
- Account and books: for as long as your account exists.
- When you delete the account ("Delete my account" button): the account loses access immediately and, for 30 days, everything is kept in case you change your mind: just sign in again and cancel the deletion. After that period, we erase your books, files and the account for good. Backups expire within 14 days after that.
- Sign-up without confirmation: an account that does not confirm the email within 7 days is erased.
- Technical history (AI consumption, generations, actions in the system): kept with no link to you (on deletion, we remove the account identifier and the name of the book) for 5 years, for accounting and security.
- Server access logs (IP): 6 months, as required by the Brazilian Internet Civil Framework (art. 15), and then erased.
- Confirmation and password reset links: expire in 24 hours. Sessions: 30 days.
7. Your rights (LGPD, art. 18)
You can ask for: confirmation that we process your data; access; correction; anonymization, blocking or erasure; portability; information about who we share it with; withdrawal of consent; and objection to processing based on legitimate interest.
No red tape: in the CoAutor menu, "Download my data" delivers everything we hold in one file, and "Delete my account" erases everything, after 30 days to change your mind. For any other request, write to privacidade@coautor.com.br; we answer within 15 days. You can also complain to the Brazilian National Data Protection Authority (ANPD).
8. Security
Encrypted connection (HTTPS), passwords stored only as a hash, protected cookies (HttpOnly, SameSite, Secure), restricted access to the server, sign-in attempt limits and daily backups. No system is 100% secure. In the event of an incident with relevant risk, we will notify you and the ANPD under art. 48 of the LGPD.
9. Children
CoAutor is intended for people aged 18 or over. We do not knowingly collect data from minors; if we learn of a case, we erase it.
10. Changes
We may update this policy. Relevant changes will be announced in the service or by email, and the date at the top will be updated.
11. Contact
José Vagner Pitinga Pinto (controller and data protection officer), CPF 205.415.238-21, privacidade@coautor.com.br, Blumenau/SC, Brazil.
This is a translation of the Portuguese version, which is the one that governs if the two ever differ. Written in good faith from what CoAutor actually does, and checked against Brazilian law on October 11, 2026. It has not been reviewed by a lawyer.