Privacy Policy

Last updated: September 19, 2026 — version 1.2

1. Who processes your data

AVIORA is operated by 68.452.656 VIVIANE AMARAL SILVA SANTOS, a Brazilian legal entity registered under CNPJ No. 68.452.656/0001-89, headquartered at R. Micheline Pires, 293, Centro, Barra da Estiva/BA, Brazil, CEP 46.650-000, for the purposes of this Privacy Policy and Brazil's General Data Protection Law (Law No. 13,709/2018 — "LGPD"), as data controller of personal data processed through the AVIORA platform (website and application, collectively the "Platform").

Official contact channel for any matter related to this Policy: privacidade@useaviora.com.br.

Under Art. 41 of the LGPD, the Data Protection Officer (DPO) responsible for this Policy is Viviane Amaral Silva Santos, who can be reached through the same channel above.

2. What data we collect

2.1 Data you provide directly

• Account/access data: name, email, and selected profile (individual user, group/ministry leader, or organization contact).
• Subscription and payment data: your plan, billing status and price, and identifiers created by our payment processor (such as customer, checkout, and subscription IDs). If you pay by card, your card number is entered on a page hosted by Stripe and is never received or stored by AVIORA.
• Content sent to the AI assistants: chat messages, information about the study, message, or lesson you're preparing, and — only if you choose to include it — information about other people (for example, to prepare individualized pastoral or educational support).
• Content submitted to the AI features for real-time processing. Text generated by AVIORA is not kept in a content library on the platform.

2.2 Data collected automatically

• Technical usage data: number of messages sent, date and time of use, and technical identifiers necessary for authentication, security, abuse prevention, and enforcement of plan limits.
• When you authorize the use of Google Analytics, browsing and interaction data may be processed, such as pages visited, approximate visit source, device/browser type, and scrolls/clicks measured by the tool. AVIORA does not configure this integration for personalized advertising and does not send Google Analytics the content typed into the AI areas, personal names, chat messages, or generated documents.

2.3 Cookies, local storage, and Google Analytics

The Platform may use local storage and similar technologies strictly necessary to maintain your session, preferences, security, usage limits, and overall experience. Separately, AVIORA uses Google Analytics 4 (Google LLC) to measure site audience and usage only after visitor authorization. If Analytics is declined, the measurement tag is not loaded by AVIORA.

Your Analytics choice is stored in your own browser and can be changed later. The current integration is intended for metrics and product improvement; AVIORA does not configure it for personalized advertising. Google Analytics should not receive information that directly identifies a person, nor content entered into the Platform's assistants.

2.4 Data about minors

The Platform is intended for use by adults (18 years of age or older) acting on their own behalf or on behalf of their church, ministry, school, or organization. When a user enters information about a minor (for example, to prepare age-appropriate content for a children's or youth ministry), that data is treated with heightened care, consistent with the protections for children and adolescents under Brazilian law (Law No. 8,069/1990 and Law No. 15,211/2025):

• The person entering the information is responsible for having the appropriate legal basis, from their church, organization, or the family, to do so.
• We strongly recommend not including unnecessary sensitive data (e.g., detailed health information) beyond what is strictly necessary for the intended purpose.
• This data is not used to train third-party AI models (see Section 4) nor for any advertising or behavioral-profiling purpose.

3. What we use your data for

• Provide the Platform's features (generating study guides, outlines, devotionals, adapted materials, and other supporting content).
• Authenticate your access and enforce your plan's limits.
• Process payments, manage your subscription (renewals, cancellations, refunds), and keep the financial and tax records required by law.
• Protect the Platform against abuse, spam, and attempts to manipulate the AI assistants (cross-cutting safety moderation).
• Measure, when authorized, audience, visit source, and page interaction to evaluate and improve the experience, the product, and the effectiveness of our communications.
• Comply with legal obligations and respond to requests from authorities, when required by law.

We do not use your data for targeted advertising and we do not build behavioral profiles of minors for any commercial purpose, consistent with Art. 26 of Law No. 15,211/2025 (Brazil's Digital Child and Adolescent Statute).

4. Who we share data with

For the Platform to work, some data passes through service providers ("processors," under the LGPD):

• Anthropic PBC (provider of the "Claude" AI technology, via API) — receives the content of messages sent to the assistants in order to generate responses. Under Anthropic's commercial API policy, this content is not used to train Anthropic's AI models by default.
• OpenAI, L.L.C. — receives the description of requested illustrations to generate supporting images, when that feature is used.
• Stripe, Inc. (and its affiliates) — payment processor for card subscriptions to AVIORA Word in US dollars. It receives your email address, an internal account identifier, and the payment details you enter on its secure page, in order to charge you and manage your subscription (renewals, cancellation, refunds, invoices). AVIORA receives only the payment status and technical identifiers, never your full card number.
• Vercel Inc. — hosts the application and processes the site's technical requests.
• Supabase Inc. — stores account data, plan/message controls, and technical usage records.
• Upstash Inc. — processes technical queues and request limits (abuse protection), without storing content.
• Google LLC — provides Google Analytics 4, used, with visitor authorization, for audience and interaction metrics. AVIORA's integration is not configured for personalized advertising and should not receive content typed into the assistants, personal names, chat messages, or generated documents.

We do not sell, rent, or share your personal data with third parties for marketing purposes.

4.1 International data transfer

The providers listed above are headquartered, and process some or all data, outside Brazil (in the United States). This international transfer takes place under contractual clauses intended to ensure an adequate level of protection for personal data, as required by Art. 33 of the LGPD.

5. Where data is stored

Text generated by AVIORA is not kept in a content library on the platform. Your browser may locally store functional data, such as session, preferences, first-use indicators, local limits, and your Analytics consent choice.

Account data, plan controls, usage counts, feedback, and technical logs may be stored on servers through the providers described in this Policy. Chat conversation content is not kept as a permanent library of outputs, beyond the processing needed to generate the AI's response.

When an illustration is generated, AVIORA may keep a technical copy in a private cache in Supabase Storage, linked to a technical representation of the description and keywords, to allow similar illustrations to be reused and to reduce new generations and costs. This cache is not presented as a personal library to the user.

6. Your rights as a data subject

Under Arts. 17 through 22 of the LGPD, you may at any time request:

• Confirmation that we process your data;
• Access to the data we hold about you;
• Correction of incomplete, inaccurate, or outdated data;
• Anonymization, blocking, or deletion of unnecessary data or data processed in violation of the law;
• Portability of your data to another service provider;
• Deletion of data processed with your consent;
• Information about who we share your data with;
• Withdrawal of consent, where applicable.

To exercise any of these rights, contact us through the channel listed in Section 1. We will respond within a reasonable time, observing applicable legal deadlines.

7. Information security

We adopt technical measures to protect your data, including:

• Blocking attempts to manipulate the AI assistants (prompt injection);
• Protection against malicious code being inserted into content saved on the Platform (XSS);
• Request limiting to prevent automated abuse (rate limiting);
• Always-encrypted data transmission (HTTPS).

No system is 100% free of risk. In the event of a security incident that could pose a meaningful risk to data subjects, AVIORA commits to: (1) contain the incident immediately; (2) assess the scope of the impact; (3) notify Brazil's National Data Protection Authority (ANPD) and affected individuals within a reasonable time, as required by Art. 48 of the LGPD.

8. Data retention and deletion

We retain data for as long as necessary to fulfill the purposes of this Policy, meet legal obligations, ensure security, prevent fraud, and defend legal rights. Analytics data also follows the retention controls and periods configured in the Google Analytics property. When retention is no longer necessary, data is deleted or anonymized, as applicable.

9. Changes to this Policy

This Policy may be updated to reflect changes to the Platform or applicable law. The "last updated" date at the top of this page always indicates the version in effect. Material changes will be communicated visibly on the Platform.

10. Governing law

This Policy is governed by the laws of the Federative Republic of Brazil, particularly Law No. 13,709/2018 (LGPD), Law No. 8,069/1990 (Statute of the Child and Adolescent), and Law No. 15,211/2025 (Digital Statute of the Child and Adolescent).

11. Questions

Any questions about this Policy can be sent to privacidade@useaviora.com.br.