Privacy Policy

1. Who looks after your data

This policy explains what data incrivel.ai collects, what it uses it for and what your rights are, under Brazil’s General Data Protection Law (Lei Geral de Proteção de Dados, LGPD, Law 13,709/2018).

incrivel.ai is the controller of your data. Our data protection officer can be reached at rafael@incrivel.ai.

2. Data we collect

• Account: name, email and profile picture when you sign in with Google or Apple, or just your email when you sign in with a code. Guests get an anonymous identifier.
• What you upload: photos, videos, audio and text used in generations.
• Face and voice: when you create an avatar of yourself, the photos of your face and the recording of your voice.
• What you create: influencers, voices, images, videos and the requests that produced each one.
• Payments: pack, amount, status and payment identifier. Card details stay with Mercado Pago.
• Technical usage: IP address, date and time of access, device and error logs.
• Contact: what you write to us by email.
• Reports: what the person reporting sends us, including their contact.

3. What we use it for and on what legal basis

• Providing the Service (generating what you ask for, keeping your library, maintaining your account and credits): performance of a contract (art. 7, V).
• Creating your avatar from your face and your voice: your specific consent (art. 11, I).
• Sending sign-in codes and account notices: performance of a contract.
• Preventing fraud and abuse and keeping the Service secure: legitimate interest (art. 7, IX).
• Keeping tax and access records: compliance with a legal obligation (art. 7, II), such as Brazil’s Internet Civil Framework (Marco Civil da Internet).
• Responding to complaints and legal proceedings: regular exercise of rights (art. 7, VI).

4. Your face and your voice

Face photos and voice recordings may be biometric data, which the LGPD treats as sensitive data. That’s why we use this material only with your consent and only to create your avatar and the generations you ask for.

• We don’t use your face or your voice to identify you or anyone else.
• We don’t sell this material and don’t use it to train AI models.
• You can delete the avatar and the material you uploaded at any time, and withdraw your consent by writing to rafael@incrivel.ai.

5. AI and training

We don’t use what you upload or what you create to train AI models. Each generation is sent to an AI provider, which receives only what it needs to make it: the request and the reference files.

6. Who we share it with

We don’t sell your data. We share only what’s necessary with the providers that make the Service work:

• Cloudflare: hosting, database and file storage.
• BytePlus (ByteDance), kie.ai, OpenAI and OpenRouter: image, video and text generation.
• ElevenLabs: voice creation.
• Mercado Pago: payments.
• Google and Apple: sign-in, when you choose to sign in with them.
• Resend: sending emails.

We may also share data when the law or an authority requires it, to defend ourselves in legal proceedings, or in a possible sale or merger of the company, which will remain bound by this policy.

7. International transfers

Some providers process data outside Brazil. These transfers follow art. 33 of the LGPD and the rules of the ANPD (Brazil’s National Data Protection Authority), with contractual clauses and other appropriate safeguards.

8. How long we keep it

• Account, files and creations: for as long as your account exists. When you delete it, everything is erased within 30 days, except the records below.
• Files sent to AI providers: only for the duration of the generation, through temporary links. The exception is faces kept in BytePlus’s library so a character looks the same across videos; every face leaves it when you delete the file or the account.
• Real-face authorizations signed in the app before October 21, 2026 (name, CPF, e-mail, phone, date, IP and browser): while your account exists and up to 5 years after, to answer complaints and authorities. We no longer collect this data.
• Access records: 6 months, as required by Brazil’s Internet Civil Framework (Marco Civil da Internet).
• Payment records: for the period required by tax law, usually 5 years, also after the account is deleted, without your e-mail.
• Reports: as long as they are needed to answer complaints and authorities, also after the account is deleted.

9. Your rights

Under the LGPD, you can at any time:

• confirm whether we process your data and access it;
• correct incomplete or inaccurate data;
• ask for unnecessary data to be anonymized, blocked or deleted;
• receive a copy of your data (portability);
• find out who we share your data with;
• withdraw your consent and learn what happens if you don’t consent.

To do so, write to rafael@incrivel.ai. We reply within 15 days. You can also file a complaint with Brazil’s National Data Protection Authority (Autoridade Nacional de Proteção de Dados, ANPD).

10. Minors

The Service is not for anyone under 18. If we learn that we collected data from a minor, we delete the account and the data. If you know of such a case, let us know at rafael@incrivel.ai.

11. Security

Your files are kept in private storage, accessible only through your account or through temporary links sent to the generation providers. Connections are encrypted and internal access is restricted. No system is infallible: if an incident could put you at risk, we notify you and the ANPD, as the law requires.

12. Cookies

We use only the cookies and local storage needed to keep you signed in and remember your preferences. We don’t use advertising or tracking cookies. The home page shows videos in the TikTok player, which may set its own cookies, under TikTok’s privacy policy.

13. Changes to this policy

We may update this policy. We’ll announce important changes by email or in the Service before they take effect.

14. Contact

Requests about your data, questions and reports: rafael@incrivel.ai.