Privacy Policy

The controller of your personal data is Plutocrata, which runs this site and app.

As a small-scale processing agent, Plutocrata is not required to appoint a data protection officer (encarregado) (art. 11 of ANPD Resolution CD/ANPD nº 2/2022). For anything about your personal data, write to ola@plutocrata.com.br; the company's management answers.

• Account: name, e-mail, profile picture (if you upload or generate one), password and creation and update dates. Your password is held by our authentication provider in hashed form; we never see it.
• Chat conversations: the questions you ask, the AI's answers, the model used for each answer and any files you attach.
• What you build in the Terminal: simulated portfolios, watchlists, price alerts, bookmarks, baskets, agents, workflows and conversations you share by link.
• Preferences: language, theme and interface settings.
• Terminal usage: which assets and research tabs you opened and when, to show your recent items and build your feed.
• Subscription: if you subscribe to Pro, we store your Asaas customer ID, your plan, the payment method (Pix, credit card, debit card or boleto), the subscription status and the billing history (amount, due date, status and invoice link). The CPF or CNPJ you enter is sent to Asaas when you subscribe, and Asaas keeps it for billing and the tax invoice; we don't store it. Card details are entered on Asaas's secure page; we never receive or store your card number.
• Technical data: IP address, browser, access date and time and error logs, created when you use the site.
• Investor profile: if you ask the chat for a portfolio for your own money and confirm, we keep your answers (goal, horizon, reaction to losses, emergency reserve, income, amount to invest, income needed from investments, current holdings, experience, knowledge and, if you give it, age) and the resulting profile.
• Usage events: pages viewed, buttons clicked, newsletter sign-up, questions asked in the chat (the count and the model only, not the text), alerts created, checkout started and payments confirmed, with the date, device type, language and where the visit came from. These events don't store your IP address.

We never ask for or store bank or brokerage passwords, or details of your investment accounts. We don't intentionally process sensitive data (LGPD art. 5, II); please don't write that kind of information in conversations.

• Creating and running your account, answering in the chat, keeping your simulated portfolios and alerts, and providing the service you asked for: performance of a contract (art. 7, V).
• Charging for the Pro plan, issuing the tax invoice and meeting tax and accounting obligations: performance of a contract and compliance with a legal obligation (art. 7, II and V).
• Keeping application access logs for 6 months, as required by Brazil's Internet Civil Framework (Law 12,965/2014, art. 15): compliance with a legal obligation (art. 7, II).
• Protecting accounts, preventing fraud and abuse, fixing errors and measuring site performance: legitimate interest (art. 7, IX), using the minimum data needed.
• Personalising the Terminal (recent items, feed and suggestions) based on what you use: performance of a contract and legitimate interest.
• Keeping your investor profile and using it in the portfolios the chat suggests: consent (art. 7, I), given when you confirm saving it. You can see and delete it in Settings > Account at any time.
• Understanding where readers and subscribers come from and which pages and campaigns work, using usage events and the two measurement cookies: legitimate interest (art. 7, IX). You can object by writing to ola@plutocrata.com.br or by turning on Global Privacy Control in your browser.

We do not sell your data or use your conversations to train AI models. Measurement with Google Analytics and Meta depends on your choice in the privacy controls.

• Measure visits and conversions with Google Analytics and Meta: consent, chosen separately for analytics and ad measurement. Declining does not prevent use of the service.

When you use the chat, the conversation text and attachments are sent to the provider of the AI model that writes the answer. Today the chat's models come from OpenAI, Anthropic and Google. When the chat searches the web, the search term goes to Exa. If you connect an external tool (an MCP server), the data that tool asks for goes to it.

Answers are generated automatically, can contain mistakes and are AI opinion, not advice from a licensed professional. We make no automated decisions that have legal effects on you. You can ask for a review of any automated processing (LGPD art. 20).

The Arena teams are run by AI models on public market data. They receive no personal data about users.

We use providers that process data on our behalf (processors), under contract and only to deliver the service:

• Supabase: database and authentication (sign-in, sessions and password-reset e-mails).
• Vercel: site hosting and technical access logs.
• Cloudflare (R2): storage for files you attach or generate.
• OpenAI, Anthropic and Google: the chat's AI models and profile picture generation.
• Exa: web search run by the chat (it only receives the search term).
• Asaas: billing for the Pro subscription (Pix, card and boleto), issuing the tax invoice (NFS-e) and keeping billing data such as name, e-mail and CPF or CNPJ.
• Stripe: only for subscriptions started before the move to Asaas, until they end.

Market data sources (such as brapi, Banco Central, CVM, B3, Tesouro Transparente and Financial Modeling Prep) supply quotes and public information and never receive your account data. Company logos may load directly from brapi and Financial Modeling Prep servers, which then see your browser's IP address, as with any image on the web.

We also share data when the law or a court order requires it, or to defend rights in legal proceedings.

With your permission, Google Analytics receives public-page events and actions such as registration, newsletter signup and Pro subscriptions, with random browser and session identifiers. Meta receives public visits and conversions through Meta Pixel and Conversions API, with browser and ad-click identifiers and browser technical information. With your permission for ads, when you subscribe to the newsletter or create an account, the Conversions API also sends Meta your email as a SHA-256 hash (a code Meta can only compare with the emails of its own accounts, not read back), an internal identifier also hashed, and the connection's IP address, so Meta can tell which ad brought the signup. A purchase records the price of a Pro subscription, not investment values. We do not send plain-text email, taxpayer IDs, chat text, searches, investor profiles or portfolio holdings to these services. Browser connections also expose the IP address to the service, as with any internet connection. See the privacy policies of Google and Meta.

Newsletter: when you subscribe to Plutocrata, your email is sent to beehiiv to manage your subscription and deliver the newsletter. Your optional name stays in our database. beehiiv may process this data outside Brazil. Use the unsubscribe link in each email to stop receiving it; deletion requests can be sent to ola@plutocrata.com.br. Newsletter signup is independent of your optional-cookie choices. See the beehiiv policy. With your analytics or advertising permission, we link the first observed open and click within seven days to the measurement identifiers saved at signup. Opens may be automated and do not prove a human read. Withdrawing consent stops new optional sharing.

Our providers store and process data outside Brazil, mainly in the United States: database and authentication (Supabase), hosting (Vercel), AI models (OpenAI, Anthropic and Google), search (Exa) and payments for older subscriptions (Stripe). File storage (Cloudflare) may use servers in several countries. Asaas, which processes current payments, is a Brazilian company.

These transfers are needed to perform our contract with you (LGPD art. 33, IX) and follow the data protection clauses in our contract with each provider.

Optional measurement with Google Analytics and Meta can involve processing outside Brazil, according to those providers’ policies and the permission given in the privacy controls.

We use necessary cookies, the first-party measurement cookies described below and, only after your choice, optional analytics and advertising cookies. You can accept, decline or customize the two purposes separately.

• Sign-in session (sb-…-auth-token cookies, from Supabase): keep you signed in while the session is active.
• i18n:locale: remembers your language (Portuguese or English) for up to 1 year.
• sidebar:state: remembers whether the Terminal sidebar is open, for 7 days.
• Browser local storage: keeps your theme and interface preferences on your device.
• plt_aid: a random code that identifies your browser in our usage measurement, for up to 1 year. It contains no data about you.
• plt_attr: where your visit came from (for example the post, ad or newsletter, from the link's utm parameters or the referring site), for up to 90 days.

First-party usage events stay in our database. Google Analytics and Meta load only after you allow the corresponding purpose. Global Privacy Control disables optional measurement and first-party browser events. Privacy choices lets you change your selections. Withdrawal stops new submissions and optional events still queued; it does not undo data already received by providers. To request deletion of that data, contact ola@plutocrata.com.br.

• plt_consent and plt_marketing: record your choices and link the server consent record for up to 180 days. Consent is requested again after that period.
• plt_marketing_ids, _ga and _ga_*: browser and session identifiers for analytics when permitted. Our identifiers last up to 90 days and Google cookies up to 180 days.
• _fbp and _fbc: Meta browser and ad-click identifiers, lasting up to 90 days, only when you allow ad measurement.

• Account data and what you created: for as long as the account exists. You can delete conversations, portfolios and alerts at any time.
• When you delete your account, we remove your profile and everything linked to it from the database: conversations, simulated portfolios, watchlists, alerts, preferences, bookmarks and shared links. Backups are overwritten automatically within 7 days.
• Files you attached to the chat stay in file storage and are deleted when you ask at ola@plutocrata.com.br.
• Application access logs: 6 months (Internet Civil Framework, art. 15).
• Billing history and tax invoices: kept by Asaas and by us for the period required by tax law.
• Investor profile: until you delete it, in Settings > Account, or delete your account. We ask for a review every 24 months.
• Usage events: up to 13 months. When you delete your account, the events linked to it are deleted with it.
• Optional measurement: Google Analytics user and event data for up to 14 months, without resetting retention on each activity. Conversion-queue identifiers are cleared after delivery and 7 days; undelivered events stop retrying after 72 hours. Consent records expire after 180 days and are removed within another 7 days. Data already sent to Meta is governed by that service’s policy and controls.

Under the LGPD (art. 18), you can ask at any time for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of data that is unnecessary, excessive or processed against the LGPD;
• portability of your data to another provider;
• deletion of data processed with your consent;
• information about who we share your data with;
• information about your option not to consent, and what happens if you don't;
• withdrawal of consent;
• review of decisions made solely by automated processing (art. 20);
• objection to processing carried out against the law.

How to ask: in Account settings you can download a copy of your data and delete your account yourself. For anything else, write to ola@plutocrata.com.br from your account's e-mail address. We reply within 15 days.

You can also complain to Brazil's National Data Protection Authority (ANPD) at gov.br/anpd.

We use encrypted connections (HTTPS) across the whole site, passwords hashed by our authentication provider, per-user access control in the database, and service keys kept only on our servers.

No system is 100% secure. If a security incident could cause you significant risk or harm, we will tell you and the ANPD, as LGPD art. 48 requires.

Plutocrata is for people aged 18 and over. We don't knowingly collect data from children or teenagers. If you know of an account held by a minor, tell us at ola@plutocrata.com.br.

We may update this policy. The version date is at the top of the page, and we will announce significant changes on the site before they take effect.

Questions about privacy or this policy: ola@plutocrata.com.br.