Data protection

Privacy policy

What personal data we process, why, on which legal basis, for how long, and how to exercise your rights. Plain language, no fine print.

Last updated: October 8, 2026. The Portuguese version prevails in case of doubt.

1. Who is responsible

The data controller is Osney A. de Souza, who runs Osney Souza · IA Aplicada and this website from Joinville, Brazil. Processing follows the Brazilian General Data Protection Law (LGPD, Law 13,709/2018). If you are in the European Union or the United Kingdom, your rights under the GDPR also apply, and you can exercise them through the same channel.

Privacy contact: juniorthesouza017@gmail.com.

2. What data we process

Email or WhatsApp conversations (this website has no form: the buttons open your email app or WhatsApp): your name, email address or phone number, and whatever you write in the conversation.
Business-to-business prospecting: public company data (legal name, company number, line of business, city) and business contact details that companies or professionals publish themselves.
AI assessment (Raio-X), requested through the website form: name, email, company and your answers about the business (section 12).
Browsing: the website sets no cookies, shows no ads and, by default, uses no analytics tool. The hosting provider logs visitors' IP addresses (section 3).

We don't ask for or process sensitive data (health, religion, biometrics and similar) through this website.

3. Hosting and access logs

This website is hosted on GitHub Pages, a service of GitHub, Inc., in the United States. When someone visits a page, GitHub logs the visitor's IP address for security purposes, whether or not the visitor has a GitHub account (provider's policy). These logs stay with the provider, for the period it sets; we have no access to them, and we don't use them to identify anyone.

Legal basis: legitimate interest in keeping the website secure and online (LGPD art. 7, IX; GDPR art. 6(1)(f)). Because the servers are outside Brazil, this is an international transfer, made under LGPD article 33.

4. Why we use it, and on what basis

Replying to your message, preparing proposals and contracts: your consent (LGPD art. 7, I; GDPR art. 6(1)(a)) and pre-contractual steps or contract performance (LGPD art. 7, V; GDPR art. 6(1)(b)).
Telling waitlist members about a launch: your consent, which you can withdraw at any time.
Website security: legitimate interest (see section 3).
B2B prospecting: legitimate interest (LGPD art. 7, IX and art. 10; GDPR art. 6(1)(f)), limited to the minimum data, related to the company's line of business, with an opt-out in every message.
Legal and tax obligations: compliance with legal obligations (LGPD art. 7, II; GDPR art. 6(1)(c)).

We don't sell or rent personal data. Service providers such as website hosting (GitHub, Inc.), email, WhatsApp (Meta) when you choose to talk there, and storage may process it only for the purposes above. Some of them may store data outside Brazil, in which case the transfer follows LGPD article 33. We may also share data when the law or an authority requires it.

6. How long we keep it

Hosting access logs: kept by the provider under its own policy; we keep no copy.
Contacts and proposals: while the conversation is active and up to 24 months after the last contact, unless it becomes a contract.
AI assessment (Raio-X): answers, report and consent record for up to 24 months after the last contact.
Waitlist: until the product launches or until you ask to leave.
B2B prospecting: up to 12 months without a reply, then contact details are deleted.
Contracts and tax records: for the periods required by law.
Opt-out list: only the email address (or domain) of people who asked not to be contacted, kept indefinitely so we never contact them again.

7. Your rights

You can ask at any time for confirmation and access, correction, anonymization, blocking or deletion, portability, information about sharing, withdrawal of consent, and you can object to processing based on legitimate interest (LGPD art. 18; GDPR arts. 15–21). You may also complain to Brazil's data protection authority, the ANPD, or to the supervisory authority where you live.

8. How to exercise your rights or opt out

Email juniorthesouza017@gmail.com with the subject “Privacy”. We reply within 15 days. To stop receiving messages, use the unsubscribe page or reply to any message with the word STOP.

While browsing, the website sets no cookies and doesn't measure traffic, so there is nothing to switch off.

9. Security

Encrypted connections (HTTPS), restricted access, credentials kept out of source code, and backups. If a security incident could cause relevant risk or harm, we will notify the people affected and the ANPD (LGPD art. 48).

Osney A. de Souza uses an in-house tool, operated only by him, to publish his own videos to his own YouTube, TikTok and Instagram accounts and to track how they perform. The tool uses the YouTube API Services, TikTok's Content Posting API and the Instagram API. Anyone who connects an account is also bound by the YouTube Terms of Service and the Google Privacy Policy, as well as the terms and privacy policies of TikTok and Instagram.

What the tool accesses: the ID and name of the connected channel or account, permission to upload videos, and metrics for the videos it publishes (views, retention, likes, comments and shares, as aggregate numbers).
Why: to publish each video at the chosen time and measure the result, to decide what to produce next. This data is not sold, not used for ads and not shared with anyone, internally or externally, beyond the platforms themselves.
Where it is kept: access tokens are stored encrypted on the controller's computer; metrics stay in the tool's local database.
Visitors to this website: no visitor data goes through these APIs, and the tool doesn't read data about other users of the platforms.
Revoking access: at any time, in each platform's settings. Google: security.google.com/settings/security/permissions; TikTok: Settings and privacy, in the list of apps and services with access; Instagram: Settings, Apps and websites.
Deletion: after access is revoked, or on request through the privacy contact (section 1), tokens and data obtained through the APIs are deleted within 30 days. API data that isn't refreshed is also deleted or refreshed within 30 days, as YouTube's policies require.

If you subscribe to the newsletter, we process your email, your name (if you give it), your language and the topics you ticked, plus the date, the page you signed up on and the version of the consent text. We use them only to send the issues on the topics you chose and to count how many people click the links (each link goes through a short address on the platform).

Legal basis: consent (LGPD art. 7, I; GDPR art. 6(1)(a)), given by ticking the box and confirmed through the link sent to your email. Without confirming, you receive nothing.
Change topics or leave: using the links at the end of every email, at any time, free of charge.
How long: while you are subscribed. When you leave, we keep only the record of your unsubscribe so we don't email you again; you can ask for full deletion through the privacy contact (section 1).
Who processes it: the email provider that delivers the messages, for that delivery only.

12. AI assessment (Raio-X)

The AI assessment form is offered in Portuguese, for Brazilian businesses. If you request it, we process your name, email and company name, plus your answers about the business: industry, team size, customer channels, systems used, monthly volumes, what takes the most time, hours spent, hourly cost, tool budget and whether the business handles sensitive customer data (a yes-or-no question about the business: we never ask for anyone's health data).

Purpose: to produce the report, email it to you and, as you authorize in the form, contact you about it. Your answers therefore become a lead in our sales pipeline, tagged "Raio-X".
Legal basis: consent (LGPD art. 7, I; GDPR art. 6(1)(a)), given by ticking the box. As proof of consent, we keep the date, the version of the text you accepted and the IP address it was given from.
How the report is made: the figures come from a fixed calculation on your answers. An AI model writes only the text, running on our own machine: your answers are not sent to third-party AI services. The report is an estimate and makes no decision about you.
How long: answers, report and consent record are kept for up to 24 months after the last contact, like other contacts (section 6), or until you ask for deletion through the privacy contact (section 1).
Who processes it: the email provider that delivers the report, each only for its part.

13. Cookies and analytics

This website sets no cookies, doesn't use your browser's local storage, has no ads or tracking pixels, and doesn't load third-party fonts or videos. That's why there is no cookie banner. By default there is also no third-party script and no analytics tool.

14. Changes

We may update this policy to reflect changes to the website or the law. The date of the last revision is shown at the top of the page.