This is a courtesy translation. The Portuguese version is the legally binding one.
1. Who we are
Latvs is an editorial platform for academic research. For the purposes of this policy, the controller of personal data collected at latvs.app and app.latvs.app is Miguel Octacilio Plaza, a natural person domiciled in Florianópolis/SC, Brazil, under Law No. 13,709/2018 (LGPD).
Data Protection Officer: Miguel Octacilio Plaza — support@latvs.app.
2. What data we collect
2.1. Data you provide to us
- Account: name, email, password (stored hashed), declared institution.
- Research content: PDFs, annotations, references, translations, assistant prompts and responses, manuscripts.
- Payment: processed by Stripe — we do not store card numbers. We receive only the subscription identifier and the last 4 digits for display.
- Communication: messages sent to support or via forms.
2.2. Data collected automatically
- Operation: technical logs (timestamps, request identifier, status code), necessary for security and diagnostics.
- Usage (optional, with consent): aggregate statistics via self-hosted Umami at
umami.latvs.app. No cross-site tracking cookies, no fingerprinting, IPs discarded after session hashing. - Attribution (optional, with consent):
latvs_refcookie with a referral code, valid for 60 days.
3. What we use your data for
- Provide the contracted service (run reviews, generate syntheses, translate, synthesize with AI).
- Authenticate access and protect your account.
- Bill for the contracted plan.
- Respond to support and send essential operational communications.
- Detect abuse, fraud, and violations of the Terms.
- Comply with legal and regulatory obligations.
- Improve the product from aggregate and anonymous metrics (only with consent).
We do not train AI models with your material. Content sent to OpenRouter travels under a zero-retention policy.
4. Legal basis (art. 7º, LGPD)
| Purpose | Legal basis |
|---|---|
| Performance of the contract (create account, operate tools, bill) | Performance of contract — art. 7º, V |
| Security and anti-fraud logs | Legitimate interest — art. 7º, IX |
| Optional cookies (analytics, attribution) | Consent — art. 7º, I |
| Support service | Performance of contract — art. 7º, V |
| Tax and regulatory obligations | Legal obligation — art. 7º, II |
5. Who we share with
The subprocessors below receive only data strictly necessary to deliver the service. All have a data processing agreement and technical measures equivalent to ours.
| Provider | Function | Location |
|---|---|---|
| Google Cloud (Cloud Run) | API hosting | United States |
| Supabase | Database and authentication | United States |
| Cloudflare R2 + Pages | File storage and landing/SPA delivery | Global (CDN) |
| OpenRouter | LLM call routing (zero-retention) | United States |
| Stripe | Payment processing | United States / Brazil |
| Umami (self-hosted) | Aggregate usage statistics | United States |
We do not sell your data. We do not provide your data to third parties for marketing. Sharing with authorities only occurs upon a Brazilian court order or applicable formal request.
6. International transfer
As described above, part of the infrastructure runs in the United States and on a global CDN network. The transfer is grounded in contractual clauses with each subprocessor and in technical measures (encryption in transit via TLS 1.2+, encryption at rest with AES-256, per-workspace segregation).
7. Retention
- Research content and account data remain for as long as the account exists, including after subscription cancellation — researchers often resume projects months later, and preserving the material is part of the service. At any time you may request permanent deletion in the Privacy tab of your account, or in writing to the Officer. The account enters a 30-day grace period (during which login shows a notice and allows reverting) and, once the period expires, is permanently removed — except for data retained by legal obligation.
- Billing data is retained for 5 years to comply with tax obligations (Decree No. 9,580/2018).
- Technical logs are retained for 90 days.
- Optional cookies expire in 60 days (attribution) or as configured by Umami (aggregate statistics, no personal identification).
7.1. Portability of your data
Each platform tool offers export in an open format suited to your content:
- References and screenings: CSV, RIS, and BibTeX.
- Manuscripts: Markdown and DOCX.
- Glossary and translations: CSV.
- PDFs and attachments: direct download of originals, individually or by project.
There is no (and we do not intend to have a) single "download everything" button — real portability of academic work requires a format specific to each content type. If you need any data in another format to fulfill the portability right of art. 18 V of the LGPD, write to the Officer and we will comply.
8. Security
We apply technical and organizational controls proportionate to the risk, including: encryption at rest and in transit, per-workspace separation via Row Level Security in the database, OAuth/JWT authentication, least-privilege principle for administrative access, auditable logs, and dependency review with automatic alerting for CVEs. No system is fully immune: incidents involving personal data will be communicated to affected data subjects and to the ANPD within the LGPD deadlines.
9. Cookies and similar technologies
See the details at /lgpd. You may review your choice at any time by clicking "Cookies" in the footer.
10. Your rights as a data subject
You may exercise, at any time, the rights set out in art. 18 of the LGPD: confirmation, access, correction, anonymization, portability, deletion, withdrawal of consent, and information about sharing. See how at /lgpd.
11. Children and adolescents
The service is not intended for minors under 18. We do not knowingly collect data from minors. If you identify use by a minor, write to the Officer for removal.
12. Changes to this policy
We may update this document. Material changes will be communicated by email and/or product notice at least 15 days in advance. The date at the top of this page indicates the last revision.