1. Controller and scope
This policy covers the iCreatorsLab website and the subscriber area. We are the controller of the data described here and we follow Brazil's LGPD along with the equivalent principles of the GDPR and the CCPA for customers abroad.
Data protection contact: privacy@roteiro.app.
2. Data we collect
Account: name, email and hashed password — or a Google identifier when you use social sign-in. We never see your Google password.
Subscription: customer and subscription identifiers, plan, currency, status, period dates and invoice history held by Stripe. We never receive or store card numbers.
Product usage: scripts you favorited, edits and version history, personal notes, checklist items, language preference, YouTube transcription jobs and credit movements.
Technical: IP address and country headers (used to pick language and currency), browser details and server error logs.
3. Why we process it
Contract performance: creating your account, unlocking the dashboard, saving your edits, processing billing and providing support.
Legal obligation: retaining tax and access records for the required periods.
Legitimate interest: fraud and abuse prevention, platform security and aggregate usage metrics. You may object through the contact channel.
Consent: marketing communications and non-essential cookies, revocable at any time.
4. Sharing
We do not sell personal data and we do not use it to train our own models. We share only with processors needed to deliver the service — payments, hosting, database, AI and transcription — listed on the Subprocessors page.
We may also disclose data under a court order or regulatory requirement, and in a corporate reorganization, keeping the same obligations set out here.
5. International transfers
Our processors may handle data outside your country, mainly in the United States and the European Union. In those cases we require standard contractual clauses and technical safeguards equivalent to the ones required by the LGPD.
6. Retention
Account data and private content are kept while the account exists. After deletion we erase or anonymize within 30 days, except for tax and access records the law requires us to keep longer.
The daily editorial collection and blog articles are public product content and remain published regardless of individual accounts.
7. Your rights
You may request confirmation of processing, access, correction, anonymization, portability, information about sharing, consent withdrawal and account deletion. We reply within 15 days.
To exercise any of them, email privacy@roteiro.app from your registered address.
8. Security and minors
We use encryption in transit, row-level isolation in the database, secrets kept out of client code and restricted admin access. Details on the Security page.
The service is not intended for people under 18 and we do not knowingly collect their data.