LGPD — Frequently asked questions

The LGPD (Lei Geral de Proteção de Dados, Lei nº 13.709/2018 — Brazil's General Data Protection Law) is the Brazilian legislation that regulates the processing of personal data. It applies to any company that processes the data of people in Brazil — including Prolytiq. In broad terms: you own your data, and we are its temporary custodians while you use the platform.

We collect only what is necessary to provide the service:

• Registration: full name, email, ORCID (optional), institution, specialty.
• Platform content: systematic review projects you create, PDF articles you upload, inclusion/exclusion criteria you define, annotations.
• Usage: pages visited, AI requests, login timestamps, IP address (anonymized to /24 after 30 days).
• Billing: handled by Stripe — we receive only the subscription status, never card data.

We do not actively collect sensitive data (under the LGPD: racial origin, political opinion, health, and similar). Our ToS prohibits submitting identifiable PHI (Protected Health Information) to the platform.

The LGPD guarantees you a set of rights. The most commonly used:

• Access: see everything we store about you.
• Correction: correct incomplete, inaccurate or outdated data.
• Anonymization / blocking / deletion: request that unnecessary data, or data processed in non-compliance with the law, be removed.
• Portability: receive your data in a structured format (JSON).
• Deletion after the end of processing: delete your account and the associated data.
• Information about sharing: a list of the third parties we share data with (sub-processors).
• Consent revocation: disable analytics/marketing cookies at any time.

Almost all of them are self-service, inside your own account:

• Download data / revoke consent / delete account: /settings/privacy
• Audit logins, exports and changes: /settings/activity
• Correct name / institution / specialty: /settings (profile)

Special cases (no account access, disputes, bulk requests): write to contact@prolytiq.ai. Response within 15 days.

Joao Pedro de Britto. Full details at /legal/dpo. Email: contact@prolytiq.ai.

When you click Delete account, two things happen:

1. Immediately: your personal data is masked (your name becomes "Deleted Account", your email becomes anonymous, avatar/links are cleared). You are logged out and the account can no longer sign in.
2. 30 days later: an automated job permanently erases the remaining data fields. Only anonymous IDs and audit logs remain (forensic requirement + fraud-control obligation).

During the 30-day window, you can write to the DPO to reverse the deletion — after that, it is irreversible.

Retention policy (summary):

• Active account: for as long as you use it.
• After deletion: 30 days masked, then anonymous IDs forever (audit).
• Audit logs with IP/userAgent: 30 days with raw data, then anonymized (/24 + browser family).
• Account inactive > 24 months: future policy — we will notify you by email before taking any action.
• Billing data: retained by Stripe under Brazilian tax obligations (5 years). We only see the status.

Yes, with the technical sub-processors required to operate the service, all audited and listed at /legal/subprocessors. We do not sell data, do not license it to third parties and do not share it with advertisers.

If we identify a security incident that could expose your personal data:

1. We notify you directly by email within 72 hours.
2. We notify the ANPD (Brazil's data-protection authority).
3. We publish technical details at /legal.

To report a vulnerability you found: write to contact@prolytiq.ai. Details in our security.txt.

No. We use the Anthropic API (Claude) for article screening. Under Anthropic's current policy for commercial use, inputs and outputs are not used to train models. Our DPA with Anthropic and the public PIA (Privacy Impact Assessment) document this commitment.