LEGAL

Privacy Policy

Last updated: August 16, 2026

1. Who we are

This Policy explains how César (usecesar.com, chat.usecesar.com and the César app for iOS — the "Service") processes your personal data, in accordance with Brazil's General Data Protection Law (Law 13.709/2018, "LGPD"). The data controller is César; the data protection officer can be reached at [email protected].

It complements the Terms of Use.

2. What data we process

  • Account — name, email, profile picture (when it comes from Google), language, time zone, password (stored only as a hash) and the identifiers of your Google or Apple account when you sign in with them. With Sign in with Apple you may hide your email; we only receive Apple's relay address.
  • Conversations — the messages you send, César's answers, attachments and audio you send (audio is transcribed to text), and the actions carried out on your behalf.
  • Integrations you connect — when you connect your Google Account, César accesses, within the permissions you grant, data from Gmail, Google Calendar, Google Contacts, Google Drive and Google Tasks solely to fulfil the requests you make. We store the access tokens (encrypted) and the minimum needed to operate (for example, identifiers and metadata of items you asked about). Content from those services is not bulk-copied nor used for any other purpose.
  • Data you record in César — notes, tasks, contacts, events, transactions and budgets you ask César to keep.
  • Location — if you allow it, your current location (from the browser or device) or an estimate from your IP address, used to answer questions that depend on where you are. We keep a short history of captures.
  • Payments — when you buy credits on the website, payment is processed by Mercado Pago; we only receive the confirmation, the amount and a transaction identifier — never your card details. In the iOS app, purchases are processed by Apple.
  • Device and notifications — in the iOS app, the push notification token, app version and device language, to send alerts (for example, when one of your automations fires).
  • Usage and billing — how much processing each request consumed, to charge credits and show your usage.
  • Technical data — IP address, browser/device, pages visited and error logs, for security and operations. On the website we use Microsoft Clarity (session recording and heatmaps) to understand product usage.

3. Why we use it

  • To provide the Service: interpret your requests, act on connected services, keep your history and answer (performance of a contract).
  • Proactive automations you configure: periodically check the conditions you defined and act or notify (performance of a contract).
  • To charge credits, process purchases and prevent fraud (contract and legitimate interest).
  • Security, abuse prevention and compliance with legal obligations.
  • To improve the product with aggregated usage metrics (legitimate interest). We do not use your conversations or your integrations' data to train artificial-intelligence models.

4. Who we share it with

We do not sell your data. We share it only with processors needed for the Service, under contract and only for the stated purpose:

  • Language-model and transcription providers (DeepSeek and OpenAI) — receive the text of your request and the context needed to answer it, and audio for transcription. We use these providers' APIs, which under their API terms do not use submitted data to train their models.
  • Google — when you connect your Google Account, César calls Google APIs on your behalf.
  • Search and information (Tavily, SearchApi, Google Maps, Travelpayouts, Central Bank of Brazil) — receive only the query needed (for example, the search term or the place), without your identity.
  • Payments — Mercado Pago (website) and Apple (iOS app).
  • Infrastructure — DigitalOcean (servers), Supabase (database) and Cloudflare (network and protection). Our servers and database are located in the United States: your data is transferred internationally with the safeguards provided for by the LGPD.
  • Notifications — Apple Push Notification service, for the iOS app.
  • Usage analytics — Microsoft Clarity, on the website.

We may also share data when required by law or by order of a competent authority.

Google data. César's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements: this data is used only to provide the features you request, is not used for advertising and is not transferred to third parties except to provide the feature, for security, or as required by law.

5. How long we keep it

For as long as your account exists. When you delete your account, your personal data is anonymized immediately (name, email, password, picture, Google/Apple identifiers and location), integration tokens are discarded, devices are unregistered and access ends. Billing and security records may be kept for the legally required period, anonymized or with restricted access. Backups are overwritten in the normal cycle.

6. Your rights

Under article 18 of the LGPD (and equivalent laws where applicable) you may confirm the existence of processing, access, correct, port, anonymize or delete your data, withdraw consent and object to processing. In your profile you can edit your data, disconnect integrations and delete your account. For other requests, write to [email protected] from the email registered on the account. You may also lodge a complaint with the Brazilian National Data Protection Authority (ANPD).

7. Security

We use encryption in transit (HTTPS), integration tokens encrypted at rest, strongly hashed passwords, per-account access control and explicit confirmation before sensitive actions. No system is infallible; if we identify an incident affecting your data, we will notify you and the authorities as required by law.

8. Cookies

We use strictly necessary cookies to keep you signed in (chat) and to remember your language and theme preferences. On the marketing website, Microsoft Clarity uses analytics cookies; you can block them in your browser without affecting the Service.

9. Children

The Service is not intended for people under 18 and we do not knowingly collect data from children. If you believe this has happened, write to us and we will remove the data.

10. Changes and contact

This Policy may be updated; significant changes will be communicated in the Service or by email. Questions and requests: [email protected].