Privacy Policy

1.Who controls your data

Exceeders Aprendizagem e Ação Ltda., Brazilian company number (CNPJ) 72.905.987/0001-02, with registered offices at Avenida Brigadeiro Luís Antônio, 3875, Jardim Paulista, CEP 01401-001, São Paulo, SP, Brasil, is the controller of the personal data processed in Retouch Tutor, under Brazilian Law 13,709/2018 (LGPD, the Brazilian data protection act).

This Policy applies to the retouchtutor.com website and the app.retouchtutor.com application.

2.What data we process

• Account. Name, email and language preference. The password is managed by our authentication provider and stored encrypted — we have no access to it in plain text.
• Content you upload. Images, briefings, context, markups, Studio Chat conversations and the way you organise your projects.
• Usage. Assessments generated, quota consumed and run history.
• Billing. Plan, subscription status and your Stripe customer identifier. Card data is collected directly by Stripe and never passes through our servers.
• Technical. IP address, browser, date and time of access, logged automatically by the infrastructure for security and fault diagnosis.
• Support. The messages and attachments you send when opening a ticket.
• Visit origin. If you arrived through an ad or a campaign, the identifier carried in the website address. It is stored only with your consent and, should you subscribe, it is recorded alongside the subscription.

3.Why we process it, and on what legal basis

• Performance of the contract (LGPD art. 7, V): creating and maintaining your account, generating assessments, storing your work, charging the subscription and providing support.
• Compliance with a legal obligation (art. 7, II): retention of tax and accounting records.
• Legitimate interests (art. 7, IX): platform security, fraud and abuse prevention, and product improvement based on aggregate metrics that do not identify you.
• Consent (art. 7, I): audience and advertising cookies, advertising campaign measurement, and communications that are not necessary to the service. You may withdraw it at any time, and declining limits nothing in the service.

4.Who we share it with

We do not sell personal data. We share it only with the processors below, to the extent necessary for the service to work:

We may also share data upon a court order or a request from a competent authority, and we will inform you whenever the law allows.

5.International transfers

The processors listed above keep servers outside Brazil, mainly in the United States and the European Union. This means your data is transferred internationally, under article 33 of the LGPD, supported by the contractual clauses and protection commitments those providers undertake.

6.What we do not do with your images

This is the point that matters most to anyone working with client material under confidentiality, so it is explicit:

• We do not sell, transfer or license your files to third parties.
• We do not publish them, do not use them in marketing and do not show them to other users.
• We do not use them to train our own models or to build reference material.
• Transmission to artificial intelligence providers happens through their business interfaces, whose commercial terms do not permit that content to be used to train their models.

Access to your content is restricted to your account. Our team only accesses your material with your express authorisation, or when strictly necessary to investigate a fault or a security incident.

7.How long we keep it

While your subscription is active, your content stays available in the account: assessments, comparisons, projects and the images attached to them. You can delete whatever you want, at any time, from within the application.

If you cancel, we keep everything for a further 90 calendar days from the end of the last paid cycle. The window exists for a practical reason: if you subscribe again within it, you find your work exactly where you left it. After 90 days, the content is permanently deleted, and that deletion cannot be undone.

If you would rather not wait, you can request account closure and immediate deletion at any time, through our privacy contact.

Other retention periods:

• Account and subscription data: while the account exists, and afterwards for as long as needed to defend against potential claims.
• Support ticket attachments: deleted automatically 30 days after the ticket is solved or closed.
• Tax and accounting records: for the period required by law.
• Access logs: for the period set by article 15 of the Brazilian Internet Civil Framework.
• Visit origin: in your browser, for the lifetime of each platform's cookie, and deleted as soon as you withdraw consent; alongside the subscription, for as long as the subscription exists.

8.Security

We apply technical measures appropriate to the nature of the data: end-to-end encrypted traffic, per-user data isolation in the database (each account reaches only its own rows), signed file links with limited validity, and passwords stored only in encrypted form.

No system is immune. If a security incident occurs that is capable of creating relevant risk to you, we will notify you and the Brazilian data protection authority (ANPD), as the law requires.

9.Cookies and local storage

Audience measurement, without cookies. On the retouchtutor.com website we use measurement that stores no cookie and no device identifier: it records in aggregate the page visited, where the visit came from, the country, the type of device, and interactions such as opening a FAQ question or clicking a plan. None of it identifies you or allows you to be recognised on a later visit, which is why it does not depend on your consent.

Cookie-based measurement, only if you accept. We also use Google Analytics, which stores a cookie and an identifier to recognise repeat visits and show where traffic comes from. It is loaded only after you accept; before that, no request is made to Google for this purpose.

Advertising cookies, only if you accept. To know which ads bring subscribers, we use cookies from Meta and Google Ads. They are loaded only if you accept in the notice shown on your first visit — before that, none of them is stored and no request is made to those providers. Declining limits nothing on the site. You can change your mind at any time under Cookie preferences, in the footer; when you withdraw consent, we delete the advertising cookies present in your browser.

In the application (app.retouchtutor.com): we use only the strictly functional — the session cookie that keeps you signed in, a cookie holding your chosen language, and browser local-storage keys with interface preferences and drafts of your work. None of it serves advertising or profiling.

10.Advertising and campaign measurement

We promote Retouch Tutor through paid advertising. To know which campaigns bring subscribers — and to stop spending on the ones that do not — we measure the path between the ad and the subscription. Everything this section describes depends on your consent, and none of it happens before you give it.

• Campaign identifier. When you reach the website through an ad, the address carries an identifier. It is stored in your browser and, if you subscribe, it is recorded alongside your subscription — that is what lets us say that a given campaign brought a subscriber.
• Conversion signal. When a subscription completes, we tell the advertising platforms that the conversion happened, using that identifier. We do not send your name or your email address, neither in clear text nor hashed.
• Advertising audiences. The platforms may use your visit to show you our ads again, or to show them to people with a similar profile. These audiences are built from your visit to the website, never from your content.
• Audience measurement. We record pages viewed, traffic source, country and device type, to understand where the page loses the reader.

What never leaves here. No image, no brief and no assessment is ever sent to an advertising platform, under any circumstances. Measurement reaches your browsing on the website and the fact that a subscription occurred — never your work.

Nor do we make automated decisions about you from this data: it does not set prices, does not govern access, and does not influence the outcome of your assessments.

You can withdraw consent at any time under Cookie preferences, in the website footer. When you do, we delete the advertising cookies from your browser along with the campaign identifier, which stops travelling with you to the subscription. On the platforms themselves, the controls are Google My Ad Center and Meta ad preferences.

11.Your rights

The LGPD grants you, at any time and free of charge, the right to obtain confirmation that we process your data, to access it, to correct it, to request anonymisation, blocking or deletion of unnecessary or excessive data, to request portability, to know with whom we share it, and to withdraw consent.

To exercise any of them, write to privacy@retouchtutor.com. We will reply as soon as possible and, as a rule, within 15 days. We may ask for information confirming your identity before acting — that is a protection for you, not an obstacle.

12.Children and adolescents

Retouch Tutor is a professional service and is not intended for people under 18. We do not knowingly collect data from children or adolescents. If we identify an account in that condition, it will be closed and the data deleted.

13.Changes to this Policy

We may update this Policy, particularly if a processor joins or leaves our operation. When a change is relevant, we will give notice by email or within the application. The effective date at the top always indicates the version in force.

14.Contact

For any privacy and data protection matter, including exercising the rights in section 10: privacy@retouchtutor.com.

This Policy should be read together with the Terms of Use.