Privacy Policy

This policy explains how Decalker collects, uses, stores and shares the personal data of the people who use our product. It is written to be read, without unnecessary legalese, but with legal force under the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).

By creating a Decalker account you agree to this policy. If you do not agree with something, do not use the product, or email us first.

1. Who we are

Decalkeris operated by Raphael Marques Salles, based in Sao Paulo, Brazil. For the purposes of this policy, we are the "Controller" of your personal data (LGPD Art. 5, VI).

Data Protection Officer (DPO) contact: hi@decalker.com.

2. What we collect

2.1 Data you provide directly

• Email and name when you create an account. You can sign in with email only, set an optional password, or use Sign in with Apple or Sign in with Google (in those cases the provider sends us only your email and name). When you set a password, we store only its hash (bcrypt), never the password in plain text.
• Images you upload to be processed by the 5 tools (Decalkar, Create with AI, Mix, Try on skin, Refine). Detailed handling in section 3.
• Free text you write in prompts and refinement requests.
• Payment data when you subscribe to Pro or Studio. We do not store card data, it is processed directly by Stripe (international cards) or by Mercado Pago (PIX, Boleto, Brazilian cards). In the iOS app, subscriptions are processed by Apple through In-App Purchase on the App Store. Apple does not share your card data with us.

2.2 Data collected automatically

• Technical cookies: decalker_session (sign-in, 30 days), decalker_anon (anonymous analytics, 1 year).
• Access logs: IP, user agent, pages visited, referrer, timestamp. Retained for 90 days.
• Usage events: CTA clicks, modal openings, AI generations triggered (successful or failed). Used to improve the product.

2.3 Third-party cookies (optional)

If you do not choose to block them, we may load:

• Vercel Analytics and Speed Insights: anonymous performance and Core Web Vitals metrics (no identifying cookies).
• Meta Pixel and Google Analytics 4: when active, they help measure ad conversion. You can opt out through your browser Do Not Track setting or through the consent banner (to be implemented).

3. How we handle the images you upload

Images are the heart of the product, so they get specific rules:

• Original images: sent by API to the corresponding AI provider. Main provider: Vercel AI Gateway (Anthropic Haiku, Google Flash 2 and Nano Banana 2 models), operating under Zero Data Retention. As a rare fallback for variation generation, Replicate (Flux Dev), which retains inputs for a limited time for debugging. Once the result is generated, the original photo is not stored by us. Items created before July 2026 may still hold the original photo alongside the item in the library; it is removed when you delete the item or the account.
• Generated stencils and designs: stored as image files on Vercel Blob (United States), under public unlisted URLs (whoever does not have the link cannot find it). They stay in your library until you delete the item or delete the account. Deletion also removes the image files from storage.
• No AI training on your work: we do not use uploaded images to train models. We do not resell them. We do not license them.
• No facial recognition: images from the "Try on skin" feature are processed to produce the tattoo preview and discarded by the provider after generation. The body photo is not stored by us after generation; only the generated preview goes to your library. We do not run biometric identification.

4. What we use your data for

Legal bases under the LGPD (Art. 7):

• Performance of a contract (Art. 7, V): processing images, generating stencils, keeping your library, processing payment.
• Legitimate interest (Art. 7, IX): security logs, aggregated analytics, product metrics.
• Consent (Art. 7, I): marketing emails (drip), retargeting pixels. You can withdraw it at any time.
• Compliance with a legal obligation (Art. 7, II): tax retention of payment data (Brazilian Tax Code).

5. Who we share it with

Sub-processors (all under data protection agreements or equivalent DPAs):

• Vercel (United States): application hosting, edge network, anonymous analytics.
• Neon (sa-east-1 region, Brazil): database.
• Vercel AI Gateway: proxy to Anthropic (Haiku, Sonnet) and Google (Flash 2, Nano Banana 2) models. Zero retention.
• Replicate (United States): rare fallback to run the Flux Dev model when the AI Gateway fails (variation generation in /create).
• Vercel Blob (United States): storage for your library images, under public unlisted URLs. Files are deleted when you delete the item or the account.
• Resend (United States): transactional and drip email delivery.
• Stripe (United States): subscription payment processing (international cards).
• Mercado Pago (Brazil): payment processing for PIX, Boleto and Brazilian cards.
• Apple (United States): Sign in with Apple and subscription processing through In-App Purchase in the iOS app (App Store).
• Google (United States): Sign in with Google.

We do not sell your data. We do not share it with data brokers or third-party advertisers without your explicit consent.

6. International transfer

Some sub-processors are located outside Brazil (mainly in the United States). Under LGPD Art. 33, we transfer data on the basis of (i) specific contractual safeguards; (ii) adequate security standards at those providers; (iii) performance of our contract with you.

7. How long we keep it

• Account and library: for as long as you keep an active account. If you do not use it for 12 months, we email you before archiving.
• Access logs: 90 days.
• Funnel and product events: 24 months (anonymized after 12 months).
• Payment: 5 years (tax obligation under the Brazilian Consumer Code and Tax Code).
• Library images (generated designs): until you delete the item or the account. Deletion also removes the image files from storage.
• Original images sent to the AI: not stored by us after generation. Items created before July 2026 may still hold the original photo, removed together with the item or the account. Providers may retain data under their own policies (links in section 5).

8. Your rights (LGPD Art. 18)

At any time and at no cost, you may exercise:

• Confirmation that processing exists.
• Access to your data (full export).
• Correction of incomplete, inaccurate or outdated data.
• Anonymization, blocking or deletion of unnecessary data.
• Portability to another provider.
• Deletion of data processed on the basis of your consent.
• Information about sharing with public or private entities.
• Withdrawal of consent, effective from the moment of withdrawal.

To exercise any right, email hi@decalker.comwith the subject "LGPD right". We answer within 15 days. You can also delete your account and all associated data inside the product itself, under /dashboard/settings.

9. Security

We apply reasonable technical measures: HTTPS on every connection, httpOnly and secure session cookies, encryption in transit and at rest (at our providers), and least privilege for internal access.

In case of a security incident affecting personal data, we notify the Brazilian data protection authority (ANPD) and you within the legal deadline.

10. Minors

Decalker is intended for professionals over 18 years of age. We do not intentionally collect data from minors. If we find any, we delete it immediately.

11. Changes to this policy

We may update this policy. Material changes are announced by email at least 15 days before they take effect. The previous version stays available on request.

12. Complaint to the authority

You may file a complaint with the Brazilian National Data Protection Authority (ANPD) at any time.

13. Contact

Email: hi@decalker.com
Website: decalker.com