1. Who we are (Data Controller)
GIULIA AI is the company responsible for processing your personal data on this website and on all subdomains (giulia-ai.com, academy.giulia-ai.com, auditflow.giulia-ai.com).
- Registered name: GIULIA AI (MEI / Empresa Individual)
- Headquarters: Vitória, Espírito Santo, Brazil
- DPO email: privacidade@giulia-ai.com
- WhatsApp: (27) 99657-4575
2. What data we collect and why
| Data | Purpose | Legal basis (LGPD) | Retention period |
|---|---|---|---|
| Name and WhatsApp number | Getting back to you for the free assessment | Art. 7º, V — performance of pre-contractual contact | 12 months, or until a deletion request |
| Email address | Communication about the proposal and the services requested | Art. 7º, V — performance of pre-contractual contact | 12 months, or until a deletion request |
| CPF — Brazilian taxpayer ID (Academy and AuditFlow) | Issuing charges through the Asaas platform | Art. 7º, V — performance of a contract | 5 years (tax obligation) |
| Payment data (card, PIX) | Processing of charges | Art. 7º, V — performance of a contract | Not stored — processed by Asaas (PCI DSS) |
| Message content / briefing | Understanding the problem and preparing a proposal | Art. 7º, V — performance of a contract | For the duration of the project + 12 months |
| Browsing data (analytics cookies) | Site improvement — only with consent | Art. 7º, I — consent | 26 months (GA4 default) |
3. Cookies and tracking
We use three categories of cookies:
Strictly necessary cookies
These do not require consent. They ensure the basic operation of the site: session security, language preferences, and the working of the contact form. Always active.
Analytics cookies (Google Analytics 4)
These require your consent. They help us understand how the site is used — most visited pages, traffic sources, session duration. GA4 is configured with IP anonymization and consent mode v2: no data is collected before your authorization.
Preference cookies
These store your cookie choice so that we do not have to ask on every visit. They expire in 12 months.
4. Who we share your data with
We share personal data only with the following processors, strictly for the purpose indicated:
- Asaas Pagamentos S.A. — processing of charges (CPF, email, phone number). PCI DSS certified. Asaas privacy policy.
- Google LLC (Google Analytics 4) — only with consent, with anonymized IP and no identifiable data.
- Meta Platforms (WhatsApp Business) — communication initiated by you via WhatsApp.
We never sell, rent, or transfer your data to third parties for commercial purposes.
5. Data security
We adopt the following technical protection measures:
- Transmission exclusively over HTTPS/TLS 1.2+
- CPF masked in system logs (never stored in plain text in logs)
- Third-party API keys stored only on the backend server, never exposed on the frontend
- HTTP security headers: HSTS, X-Frame-Options DENY, Content-Security-Policy, X-Content-Type-Options nosniff
- Rate limiting on the APIs to prevent abuse and data scraping
- Financial data processed entirely by Asaas — it does not pass through our server
6. Your rights as a data subject (Art. 18, LGPD)
You have the following rights, which you may exercise at any time by writing to privacidade@giulia-ai.com:
- Confirmation: to know whether we process your personal data
- Access: to receive a copy of the data we hold about you
- Correction: to correct incomplete, inaccurate, or outdated data
- Anonymization or blocking: of unnecessary data or data processed in breach of the law
- Portability: to receive your data in a structured format
- Deletion: to delete data processed on the basis of your consent
- Withdrawal of consent: to withdraw, at any time, the consent given for analytics cookies or marketing communications
- Objection: to object to the processing in the event of non-compliance with the LGPD
We will respond to your request within 15 business days, in line with the legal deadline.
7. International data transfers
Google Analytics 4 may transfer browsing data to servers in the United States. This transfer is carried out on the basis of the standard contractual clauses approved by the European Commission and equivalent mechanisms, in compliance with Art. 33 of the LGPD. To reiterate: GA4 is activated only after your consent.
8. Data retention and deletion
We keep your data for as long as necessary for the purpose that motivated its collection. Tax data (CPF, charges) is kept for 5 years as required by law. After that period, the data is anonymized or securely deleted.
9. Data Protection Officer (DPO)
Contact channel for the DPO
To exercise your rights or ask questions about this policy:
📧 privacidade@giulia-ai.com
💬 (27) 99657-4575 — Giulia, our assistant
📍 Vitória, Espírito Santo, Brazil
Response time: up to 15 business days.
10. Changes to this policy
This policy may be updated periodically. The "last updated" date at the top of this page will always reflect the version in force. In the event of material changes, we will notify registered users by email.
11. Applicable law
This policy is governed by the LGPD — Brazil's General Data Protection Law (Lei nº 13.709/2018) and by the other rules of the Brazilian National Data Protection Authority (ANPD). The forum elected to settle disputes is that of the judicial district of Vitória, Espírito Santo.