Privacy Policy of TempoRevenue AI

Version: 1.9

Effective date: October 9, 2026

This document supplements the Terms of Use, which refer to it in Section 23, and should be read together with them. It explains how TempoRevenue handles personal data in the TempoRevenue AI product, in line with Brazil's General Data Protection Law (Law 13,709/2018, the LGPD) and, where applicable, the privacy laws of the United States and Canada (Sections 15 and 18).

1. WHO PROCESSES THE DATA

TempoRevenue is the controller of the personal data processed by this product, under the LGPD. Every decision about what the data is for and how it is used comes from Jefferson Prado Barros, registered under CNPJ 68.470.838/0001-82, acting as an Individual Microentrepreneur (MEI) under the name TempoRevenue. Contact: contact@temporevenue.com.

2. WHAT DATA IS COLLECTED

• Account data: name and email, provided at sign-up or obtained from Google sign-in, when you choose that sign-in. Profile preferences (language, currency, business details you fill in).
• Content you submit: audio, text, and images, the raw material from which each proposal is generated, and the proposal itself, with its transcript, generated text, and edits. This content may contain personal data of the user's client, a person who normally has no TempoRevenue account and who is also a data subject under the LGPD.
• Attachments: the audio and image files attached to generate the proposal (kept only during processing, Section 7) and the logo or profile photo, if you upload one.
• Third-party signing data: when the user's client (a signer who is not a TempoRevenue user) accepts a proposal, we store the signing record described in Section 16: typed name and email, IP address, browser information, date and time, language, and the document hash.
• Bookkeeping: the income, expenses, categories, dates, amounts, and tax regime you record in the Bookkeeping feature.
• API keys: we store only the hash of the key, never the key itself, together with the name you gave it and the dates it was created and last used.
• OAuth tokens: when you connect an AI app (Section 17), we store only the hash of the tokens, and a security record of the connection (which app, which permissions, dates of approval, use, and revocation).
• Push subscription: if you turn on notifications, we store the delivery address provided by your browser, the encryption keys of that subscription, and the language (Section 19).
• Usage data: information about how the account uses the product, such as the number of proposals generated, credit balance, and access dates.
• Payment data: billing information processed by Stripe. TempoRevenue does not store card numbers; it keeps the Stripe identifiers of your account and subscription and a card identifier (fingerprint) to prevent abuse of the free trial (Section 4).
• Technical logs and rate-limit identifiers: for security and usage control (rate limiting), the IP address is processed transiently, in memory and in counters that expire within minutes. TempoRevenue stores the IP only in signing records (Section 16). The authentication service (Supabase Auth) also records the IP of login sessions while the session exists, and that record is deleted with the account. We also keep pseudonymous identifiers derived from the IP and browser by a one-way cryptographic function (hash): the `viewer_hash` of view analytics and the anti-fraud hashes of Section 4. TempoRevenue treats these hashes as personal data, with the periods in Section 7.
• Proposal visitor cookie: when someone opens the public link of a proposal, a cookie with a random identifier (Section 10) lets us notify the proposal owner once per visitor.
• Sign-up origin: we store where you came from when you signed up: a proposal link or another user's invite (for example, "proposal_link") and the originating proposal; the UTM parameters of the first page you opened (utm_source, utm_medium, utm_campaign, utm_content) or, when there is no UTM, only the domain of the site you came from (no path or search); and, if the sign-up started when connecting an AI app, the name of that app (for example, "mcp_claude"). We use this only to learn which channels work, in internal counts; it is not shared or used for advertising.
• Optional answer about how you heard of us: while you set up your profile you may answer "Where did you hear about us?" in free text (up to 200 characters). It is optional; we use it only in internal counts of which channels work, and it is not shared or used for advertising.
• Social layer data: when the public profile and connections feature is on, TempoRevenue also collects: the fields you choose to show on the public profile (name, photo, headline, profession); the state of your connections with other Users; and the pseudonymous identifier (`viewer_hash`) derived from the IP address and browser of whoever views a public proposal or profile, through a one-way cryptographic function (HMAC-SHA256). We also record the date and browser of each view of a public proposal or profile, for analytics and for your profile's public metrics, and your preference on whether to receive notification emails (Section 3).

The IP address is processed transiently for security and request control and is stored only in electronic signing records (Section 16), in addition to the authentication service's session record described above. The hashes (`viewer_hash` and anti-fraud) are pseudonymous, but they are still personal data and are treated as such.

3. WHAT EACH PIECE OF DATA IS USED FOR

• Name and email: create and maintain the account, authenticate access, and send communications about the service, including billing and changes to this policy.
• Audio, text, and images submitted: generating the commercial proposal, the core function of the product. TempoRevenue uses generative artificial intelligence to process this content and generate the proposal. That is the only use of this content.
• Usage data: keep the product working, apply the limits of the plan purchased, and identify fraudulent use of the platform.
• Payment data: process subscription billing and keep the accounting and tax records required by law.
• Bookkeeping: show you your ledger, summaries, and estimates. It is not used for any other purpose.
• API keys and OAuth tokens: authenticate API and connected-app access to your account and allow revocation.
• Push subscription: send the notifications you turned on.
• Social layer data: show your public profile to those you chose to make it visible to; operate the connections feature (request, accept, decline, block); tell apart, for analytics and your profile's public metrics, a view of a proposal or profile by someone else from a view by you, and avoid counting the same person twice; and send (or not send, depending on your preference) emails saying a proposal of yours was opened or accepted.

4. LEGAL BASIS FOR EACH PROCESSING

Performance of a contract (Art. 7, item V, of the LGPD) is the main legal basis: TempoRevenue processes name, email, submitted content, and usage data because that processing is necessary to provide the contracted service.

Where the law requires a specific record to be kept, such as tax and accounting data tied to payment, the legal basis becomes compliance with a legal or regulatory obligation by the controller (Art. 7, item II, of the LGPD).

The pseudonymous identifier (`viewer_hash`) described in Section 2 is processed on the basis of TempoRevenue's legitimate interest (Art. 7, item IX, of the LGPD), to prevent fraud in the product's public metrics: for example, to stop someone from artificially inflating the view count of a proposal, or the owner of a proposal from appearing as a client who opened or accepted it. The public profile and connections are processed on the basis of consent (Art. 7, item I, of the LGPD): neither is turned on by default, and each exists only after an explicit action by you.

Preventing fraud and abuse of the free trial. To prevent fraud and abuse of free trials, we process a card identifier supplied by our payment processor, Stripe (a fingerprint that does not reveal your card number), together with the date of the trial, and a one-way hash of the IP address and browser used to access the service. We do this on the basis of our legitimate interest in protecting the service. Card identifiers are kept for up to 24 months, including after an account is deleted, unlinked from any account. Access hashes are kept for 90 days.

5. WHO THE DATA IS SHARED WITH

TempoRevenue shares data with the recipients below, each receiving only the data needed for the function it performs:

• Anthropic: receives the text and transcripts of the submitted content to extract the proposal information, write it, and run AI Polish.
• OpenAI: receives the audio and image files submitted, to transcribe the audio and read the text in images.
• Supabase (hosted on AWS, us-east-1): database, authentication, and file storage; holds the account, usage, proposal, signing record, and other data described in Section 2.
• Vercel: application hosting; processes the requests that make the product work and keeps the hosting logs.
• Stripe: processes payments and subscriptions; receives the data needed to charge.
• Resend: sends the service emails (access links, proposal notices, billing, copy of the electronic signing); receives the recipient's email address and the content of the message.
• Upstash: keeps the request rate-limit counters; receives the IP address transiently, for that function.
• Google: authenticates Google sign-in, when you choose it; and runs the support mailbox (Google Workspace), which receives whatever you write to us.
• YouTube (Google): some pages of our website may embed a video. It loads only when you click to play it; before the click, nothing is requested from YouTube. After the click, the video is served by YouTube (through youtube-nocookie.com) and what Google collects is governed by Google's own privacy policy.
• Browser push notification services (Google, Apple, Mozilla, or another, depending on your browser): receive the text of the notification to deliver it to your device, if you turned on push.
• Connected AI apps: if you connect an AI app, it is a recipient you chose; what it can access is in Section 17.

Each recipient uses this data only to perform the function it performs for TempoRevenue, never for a separate purpose of its own. TempoRevenue does not sell personal data.

6. INTERNATIONAL TRANSFER

Part of the processing described in Section 5 involves international data transfer. The recipients in Section 5 are based in the United States. Data is stored in the Supabase database, in the AWS us-east-1 region (Northern Virginia, United States), and the application runs on Vercel, in the iad1 region (Washington, D.C., United States). The artificial intelligence and payment providers process data in the United States. The transfer relies on mechanisms recognized by the LGPD, such as the standard contractual clauses adopted by those providers.

7. HOW LONG EACH PIECE OF DATA IS KEPT

The general rule is to keep each piece of data for as long as its purpose requires, and no longer. Deletion of an account is completed within 30 days of the request.

One technical feature of the product matters here: the table where proposals are recorded never deletes a row once created, as an anti-fraud safeguard, and the same applies to the referral record of the Invite/Friends feature. For that reason, "deleting a proposal" or "deleting the account" erases all of the proposal's content (text, transcript, generated document, client names and emails, edits, and view identifiers) and, when the account is deleted, also removes the link to it. The row keeps only identifier, number, dates, status, and anti-fraud flags, with no personal data; when only the proposal is deleted, that empty row stays linked to your account so the proposal number is never reused. The other social feature data, such as connections, view records, and the identifiers used in View analytics, is deleted normally when the account is deleted. See more in Section 8, under the right to anonymization.

8. DATA SUBJECT RIGHTS UNDER THE LGPD

As a data subject, you have the right to:

• Confirmation that TempoRevenue processes your data, and access to the data processed.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of the law. When the request involves a specific proposal, or deletion of the account, TempoRevenue erases the content of the proposal and removes the link to your personal data, for the technical reason explained in Section 7: the proposals table is built never to delete a row, as an anti-fraud safeguard of the product. You can also delete a proposal yourself in the app (Manage proposal, Delete): the content is erased right away and the public link stops working. Accepted proposals can't be deleted, because the signing record is kept for the period in Section 16; they can be archived, which only removes them from the main list. Requests made by email are completed within 30 days.
• Portability of the data to another service provider, on express request.
• Information about sharing: who TempoRevenue shares your data with, answered by Section 5 of this document and, on request, in more detail.
• Withdrawal of consent, for processing where consent is the applicable legal basis.

To exercise any of these rights, write to the Data Protection Officer at the contact in Section 13. TempoRevenue responds within the period the LGPD sets.

9. SECURITY

TempoRevenue adopts technical and organizational measures to protect the data it processes:

• API keys and OAuth tokens are stored only as hashes, never in readable text;
• data travels over an encrypted connection between your browser and the product, and between the product and the recipients in Section 5;
• in the database, each account is isolated from the others by row-level access rules, so an account can only reach its own data;
• administrative access is restricted to those who need the data to perform their function; and
• we choose recipients (Section 5) with security practices established in the market.

No system is infallible, and TempoRevenue works to continually reduce the risk of an incident.

10. COOKIES AND TRACKING TECHNOLOGIES

TempoRevenue uses only first-party cookies. We do not use third-party cookies or advertising cookies. Neither the app nor the website uses third-party analytics tools. The analytics shown to you about your proposals come from TempoRevenue's own events (Section 2).

Besides cookies, the app keeps in your browser, in local or session storage, only interface markers, such as "install prompt dismissed" and "opening animation already shown". They do not leave your device.

The pseudonymous identifier (`viewer_hash`) described in Section 2 is not a cookie: it is not stored in your browser, cannot be read by third parties, and is calculated again on each view. It is never kept as a persistent tracking identifier across sites.

11. MINORS

The TempoRevenue AI service is intended for people over eighteen. TempoRevenue does not direct the product to minors and does not knowingly collect data from minors.

12. CHANGES TO THIS POLICY

This policy may change as the product evolves and as the law requires. Any significant change is communicated by email or notice in the product itself, with the date of the new version shown at the top of this document. In particular, the business name given in Section 1 will be updated if TempoRevenue stops operating as an MEI and moves to another corporate form.

13. CONTACT AND DATA PROTECTION OFFICER (DPO)

TempoRevenue's Data Protection Officer (DPO) is Jefferson Prado Barros, at contact@temporevenue.com. Any question, request, or complaint about the processing of personal data reaches us first through this channel.

14. COMPLAINT CHANNEL TO THE ANPD

If TempoRevenue's reply does not resolve your question or request, you may also file a complaint directly with Brazil's National Data Protection Authority (ANPD), through its official channel at gov.br/anpd.

15. PRIVACY RIGHTS IN THE UNITED STATES

This section applies to residents of U.S. states whose law gives them privacy rights, such as the CCPA in California.

Categories of personal data we collect (in the last 12 months): identifiers (name, email, account identifiers, IP and browser hashes); commercial information (subscription, credits, and purchase history); network activity (proposal views and product usage events); and approximate geolocation data, inferred from the IP address and used only transiently for security and request control. The content you send us (audio, text, images) may also contain personal data.

We do not sell or share personal data for advertising. We do not use cross-context behavioral advertising.

Your rights, under applicable law: to know which categories of data we collect, use, and disclose; to access the data; to delete the data, subject to legal exceptions; to correct inaccurate data; and not to be discriminated against for exercising these rights.

How to exercise them. Write to contact@temporevenue.com. For your protection, we will verify your identity before acting on the request, by matching the information in the request with the account's, and we may ask for additional information. An authorized agent may make the request on your behalf, with proof of the authorization.

Response time. We respond within 45 days of receiving the request. If we need more time, we will tell you why.

16. ELECTRONIC SIGNING RECORDS

When a proposal is accepted through TempoRevenue's electronic signature, the platform stores a signing record with: the signer's name and email, IP address, user agent (browser and device information), date and time, language, the document's hash (SHA-256), the versions of the consent text, the disclosure, the Terms, and the Privacy Policy that were shown, and a copy of the accepted document.

Purpose. To preserve evidence of an electronic acceptance and support compliance with applicable electronic transactions laws. The IP address and device information are collected solely as security and transaction evidence, in electronic signing records.

Legal basis (LGPD). Performance of a contract, legitimate interest, and regular exercise of rights in judicial, administrative, or arbitration proceedings (Art. 7, V, VI, and IX).

Retention. Records are kept for 6 years from the signature, with restricted access, and then deleted. Where necessary to establish, exercise, or defend legal claims in progress, a record may be kept beyond that period until the matter is concluded.

Deletion. Deletion requests may be limited where retention is necessary to complete a transaction, comply with legal obligations, or establish, exercise, or defend legal claims.

Access. Only the proposal's sender (the User) and the signer have access to the record and the signed PDF. The public verification page shows only the abbreviated name, the date, the partial hash, and the partially masked email; never the IP.

17. CONNECTED AI APPS

You can connect to your TempoRevenue account an AI app that uses the Model Context Protocol (for example, Claude or ChatGPT). This section only applies if you do so. Connecting is always your choice, approved on a consent screen that shows the app and the permissions it asks for. The connected app is a recipient you chose.

What the connected AI app can access, tool by tool.

• Create proposal ("proposals:write" permission): receives what the AI app sends, such as a short description of the client's request, the client's name, and the language, and returns the title and the link to the new proposal. It uses one proposal or one credit from your account.
• List proposals ("proposals:read" permission): returns the id, title, status, and editor link of up to 20 of your proposals.
• Check proposal status ("proposals:read" permission): returns the status of a proposal and, if they have happened, the date the client first opened it and the acceptance date.
• Check credit balance ("credits:read" permission): returns how many proposals you can still create.

The connected app does not receive the full text of your proposals, your payment data, your bookkeeping, or your contacts, and it only reaches your own account.

Access tokens. When you approve a connection, TempoRevenue issues an access token and a refresh token to the app. We store only a hash (SHA-256) of each token, never the token itself. The access token is valid for 1 hour and the refresh token for 30 days, and each token is bound to the TempoRevenue server it was issued for. You can revoke a connection whenever you want in Connectors, under "Connected apps", with "Disconnect": the app loses access immediately. We keep a security record of connections (which app, which permissions, when it was approved, used, and revoked) for up to 365 days after revocation, with no token.

Deletion of connector records. You can ask for your connection records to be deleted by writing to contact@temporevenue.com. Security records (which app, which permissions, and dates) are kept on the basis of legitimate interest for 365 days after revocation, and are then deleted.

What the AI provider does with the content. What you tell the AI app, and what it shows you from TempoRevenue, is handled by that app's provider under its own terms and privacy policy, which TempoRevenue does not control. Read them before connecting.

No sale and no training. TempoRevenue does not sell the data accessed by connected AI apps and does not use it to train AI models.

18. CANADA

For residents of Canada, TempoRevenue processes personal data in line with PIPEDA and equivalent provincial laws, where applicable.

Your rights. You can ask for access to the personal data we hold about you and for correction of inaccurate or incomplete data. You can also withdraw consent for processing that depends on it, subject to legal and contractual restrictions.

How to exercise them. Write to our data protection officer (DPO), Jefferson Prado Barros, at contact@temporevenue.com. We will respond within the periods set by applicable law.

Complaints. If you are not satisfied with the response, you can file a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or the competent provincial authority.

Data is processed and stored in the United States (Section 6).

19. PUSH NOTIFICATIONS

What we store. If you turn on notifications, we store the subscription supplied by your browser: the delivery address (endpoint), the encryption keys of that subscription, and the language. We do not store the content of notifications after they are sent.

Purpose. To send you service alerts you asked for, such as "a client opened or accepted your proposal" and connection requests.

Who receives it. Your browser's notification service (Section 5), which delivers the message to your device.

How to turn it off. Switch off "Push notifications" in your profile in the app, or block notifications in your browser or device settings. The subscription is also deleted if the browser stops accepting it or if the account is deleted.

20. LANGUAGE

This Privacy Policy is available in Portuguese, English, Spanish, and German. If the versions differ, the Portuguese version prevails for users in Brazil and the English version prevails for all other users.

End of the Privacy Policy