This document explains, in a clear and transparent manner, what personal data we collect, why we collect it, how we use it, who we share it with, and what your rights are. The Brazilian General Data Protection Law (LGPD, Law 13,709/2018) and, where applicable, the European GDPR apply.
Xplore Dados is a SaaS platform for academic research and data analysis. We are the controllers responsible for processing your personal data.
We collect only what is necessary to operate the platform and improve your experience. Below, each data category with details:
| Category | Specific data | When we collect |
|---|---|---|
| Registration | First name, last name, e-mail, password (hashed), phone (optional), profession, field of study, educational institution | When you create your account |
| Authentication | E-mail, session tokens (httpOnly cookies) | At each login |
| Browsing | IP address (anonymized in GA4), pages visited, UTM parameters, referrer, browser language, device type | Automatically, while browsing |
| Tool usage | Technical events (tool used, duration, errors), credit consumption, aggregated performance metrics | When using any platform tool |
| Payment | Transaction data processed via Stripe (we do not store card numbers). We receive: transaction ID, purchased package, and status | When purchasing credits or a subscription |
| Newsletter / Leads | Name, e-mail, subscription source, interest tags | When subscribing to the newsletter or downloading free materials |
| Contact / Support | Name, e-mail, message sent | When submitting the contact form |
| Purpose | Description |
|---|---|
| Service provision | Operate the platform, provide access to AI tools, courses, and contracted resources. |
| Account management | Authenticate users, manage credit balance and subscription status. |
| Experience improvement | Analyze aggregated usage patterns to improve tools, performance, and interface. |
| Communications | Send newsletters, product updates, and educational materials (only with consent). |
| Security | Prevent fraud, abuse, unauthorized access, and ensure platform integrity. |
| Legal obligations | Comply with applicable tax, regulatory, or judicial requirements. |
All personal data processing at Xplore Dados is supported by a valid legal basis, in accordance with the LGPD (art. 7) and, where applicable, the GDPR (art. 6):
| Legal basis | Application | Example |
|---|---|---|
| Performance of contract | Necessary to provide the contracted service | Access to tools, courses, user area |
| Consent | Optional activities you can accept or refuse | Newsletter, analytics/advertising cookies, material downloads |
| Legitimate interest | Our legitimate interests without prejudice to your rights | Platform security, abuse prevention, UX improvements |
| Legal obligation | When the law requires processing | Tax data from transactions, responding to court orders |
We share data only with partners strictly necessary to operate the platform. We never sell your personal data.
| Partner | Role | Data shared | Legal basis |
|---|---|---|---|
| Supabase | Database and authentication | Account and session data | Performance of contract |
| Stripe | Payment processing and subscriptions | E-mail, transaction data | Performance of contract |
| Google (GA4 / GTM) | Traffic analysis and metrics | Anonymized browsing data | Consent |
| Meta (Pixel) | Advertising and remarketing | Anonymized browsing data | Consent |
| Brevo | E-mail delivery (newsletter) | Name, e-mail | Consent |
| Render | Application hosting | Access logs | Legitimate interest |
| OpenAI | AI processing in the tools | Content you submit (text, file excerpts and audio), with no identifying data | Performance of contract |
| Google (Gemini) | AI processing in SmartChat and the Article Shortener | Content you submit, with no identifying data | Performance of contract |
| Anthropic | AI processing in SmartChat and the Article Shortener | Content you submit, with no identifying data | Performance of contract |
| AssemblyAI | Audio transcription | The audio file you submit for transcription | Performance of contract |
| Tavily / Exa | Web search in SmartChat | Search terms derived from your question | Performance of contract |
Our tools rely on artificial intelligence models operated by third parties. This means that the content you submit (text, extracted passages from your PDFs, audio files, questions and references) is sent to these providers so the result can be generated. This section explains exactly what happens.
| Provider | Where it is used | What leaves the platform | Processing region |
|---|---|---|---|
| OpenAI | PaperLab AI, Academic Reviewer, Research Gap Detector, Formatter, Journal Finder, Bibliometric Analysis, AI analysis on merged bases, Search Strategy Builder, Reference Checker, SmartChat, Deep Research, Article Shortener, Audio Transcription (fallback provider), and the site assistants (Trick and support chat) | Text you submit, passages extracted from your files, and audio when it is the provider used for the transcription | United States |
| Google Gemini | SmartChat, Article Shortener | Your message and the conversation context, or the full text of the article you submitted to be shortened | United States |
| Anthropic Claude | SmartChat, Article Shortener | Your message and the conversation context, or the full text of the article you submitted to be shortened | United States |
| AssemblyAI | Audio Transcription (default provider) | The audio file you submit for transcription | United States |
| Tavily / Exa | SmartChat web search | Search terms derived from your question | United States |
We contract the paid API tiers of these providers. Under their published API policies, content sent through the API is not used to train models, and requests are retained only briefly for abuse monitoring before being discarded. These are the providers' own commitments, which we reproduce here for transparency:
Responsibility for the content you submit is yours, as set out in the Terms of Use. Read the Terms of Use.
Several of our technology partners have infrastructure outside Brazil, including Supabase, Render, Google, OpenAI, Anthropic, AssemblyAI, Tavily and Exa, all in the United States. In these cases:
Your data is stored on Supabase (Postgres database and file storage) and Render (application hosting and access logs), both with infrastructure in the United States. Files you upload are kept in access-restricted buckets and are never public.
| Data type | Where it is stored | Retention period |
|---|---|---|
| Account data | Supabase database | While the account exists. Removed as soon as you delete it |
| Files you upload (PDF, DOCX, bibliographic bases) | Supabase Storage, restricted buckets | Until you delete the corresponding project or job. Not removed automatically when the account is deleted (see 8.1) |
| Text excerpts and embeddings generated from your files | Supabase database | Deleted together with the corresponding project |
| Tool history and results | Supabase database | Until you delete each item, or until the account is deleted (with the exceptions listed in 8.1) |
| Transaction data | Supabase database and Stripe | In our database, until the account is deleted, except an active subscription record, which is kept unlinked from your account until the Stripe subscription ends (see 8.1). Issued invoices and the records held by Stripe: 5 years (tax obligation) |
| Browsing data (analytics) | Google Analytics 4 | 14 months |
| Newsletter / Leads | Supabase database and Brevo | Until consent is revoked |
| Access and security logs | Render | 90 days |
Deleting your account in My Account removes your profile and your access credentials right away, and with them the records the database ties to your account: your SmartChat conversations and saved contexts, your credit balance, your credit grants and your transaction records, and the history of the tools you used, including Bibliometric Analysis, Research Gap Detector, Journal Finder, Formatter, Article Shortener, Reference Checker, Merge Databases, PaperLab AI (projects, files and versions), Kanban, Audio Transcription and the Zotero connection. The records that survive deletion, and why, are listed below.
The LGPD (and the GDPR, if applicable) guarantee you the following rights over your personal data:
Know whether we process your data and obtain a copy of the data we hold about you.
Request the update or correction of incomplete, inaccurate, or outdated data.
Request the deletion of your personal data, subject to legal retention obligations.
Request the anonymization or blocking of unnecessary data or data processed in non-compliance.
Request the transfer of your data to another service provider in a structured format.
Object to processing based on legitimate interest, if you believe your rights prevail.
Withdraw your consent at any time, easily and free of charge.
Know which public and private entities your data has been shared with.
We adopt technical and organizational measures to protect your data:
No system is 100% secure. If you identify any vulnerability, please contact us at contato@xploredados.com.
We use cookies to operate the platform and, with your consent, for analytics and advertising purposes. See the summary below:
| Type | Examples | Requires consent? |
|---|---|---|
| Essential | Session (sb_access_token), cookie_consent, CSRF | No, required for operation |
| Analytical | Google Analytics (_ga, _gid) | Yes |
| Advertising | Meta Pixel (_fbp, _fbc), Google Ads | Yes |
You can manage your preferences at any time:
The Xplore Dados platform is not intended for anyone under 18 years of age. We do not intentionally collect data from minors. If we identify data from a minor without the guardian's consent, we will take steps to remove it immediately.
We may update this Privacy Policy periodically to reflect changes in our services or legislation. The current version will always be available on this page, with the date of the last update at the top.
In the event of significant changes, we will notify users by e-mail or a notice on the platform.
For questions, complaints, or exercising privacy-related rights:
If you are not satisfied with the response, you can contact the Brazilian National Data Protection Authority (ANPD): www.gov.br/anpd.
With your explicit and optional consent, we use metadata about how the platform is used to produce research, reports and content about academic research practices.