Privacy Policy
Last updated: September 9, 2026
This is a courtesy translation. The Brazilian Portuguese version is the official one and prevails in case of conflict.
This policy explains which personal data DreamSteps processes, why, who we share it with and how you exercise your rights.
Protection of your personal data, including in digital media, is a fundamental right under article 5, LXXIX of the Brazilian Constitution, and the processing described here follows the Brazilian General Data Protection Law (LGPD, Law 13.709/2018).
1. Controller and contact
The controller of your data is LUMINUS SOLUÇÕES EM INTELIGÊNCIA ARTIFICIAL LTDA, registered under Brazilian company number (CNPJ) 61.843.859/0001-57, with offices at Rua Raimundo Correia, 4, Monte Castelo, São Luís, MA, 65031-510, Brazil.
For anything related to privacy, including exercising your rights, use the in-app support channel or write to [email protected].
2. Data we process
Account data. When you sign in with your Google Account, Google gives us your name, email address and profile picture. We never receive or store your password.
Content you create. Interview answers, your business data, generated and edited reports, visualizations, and messages exchanged with the AI advisors.
Subscription data. Your plan, subscription status, credit balance and usage. Payment details are handled directly by Stripe. DreamSteps never receives or stores card numbers.
Support. The subject, messages and attachments of tickets you open, plus our replies.
Technical usage data. Records of operations performed on the platform, such as report generation and advisor messages, with date, time and technical identifiers. We use these to operate the Service, measure credit consumption, investigate errors and protect the platform from abuse. We also record views of the public home page, language, and random browser and session identifiers to measure audience and registration conversion. This telemetry does not store an IP address, full URL, or content viewed or entered by the visitor.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and maintaining your account and enabling sign-in | Performance of a contract |
| Running interviews and generating reports, visualizations and advisor replies | Performance of a contract |
| Managing credits, plans and billing | Performance of a contract and legal obligation |
| Answering your support tickets | Performance of a contract |
| Sending transactional email, such as welcome and service notices | Performance of a contract |
| Sending the newsletter and marketing messages | Legitimate interest, with opt-out at any time |
| Measuring audience, usage and conversion on the home page | Legitimate interest |
| Preventing fraud and abuse, and protecting platform security | Legitimate interest |
| Meeting tax and legal obligations | Legal obligation |
4. Artificial intelligence and international transfer
To generate reports, visualizations and advisor replies, the content you provide is sent to artificial intelligence providers contracted by DreamSteps. Depending on your plan and the current configuration, the provider may be OpenAI, DeepSeek or OpenRouter.
These providers, like the other services listed in the next section, operate outside Brazil. That constitutes an international transfer of data, carried out under article 33 of the LGPD, to perform the contract you enter into with us by using the Service.
DreamSteps does not use your content to train its own artificial intelligence models, and contracts providers on the same basis. Even so, avoid entering sensitive personal data, third party trade secrets or confidential information that the analysis does not require.
5. Who we share data with
We share data only with providers that make the Service work, always limited to the contracted purpose. Hiring third parties does not transfer our responsibility: DreamSteps remains answerable to you for the processing of your data, and Brazilian law voids any clause transferring responsibility to third parties and holds everyone involved jointly liable (articles 7, sole paragraph, 25, §1, and 51, III of the Consumer Protection Code).
- Google: account authentication;
- Supabase: database and session management;
- Amazon Web Services: application hosting;
- Cloudflare: network protection and administrative access control;
- OpenAI, DeepSeek and OpenRouter: artificial intelligence processing;
- Stripe: subscriptions and payments;
- Resend: email delivery.
We may also share data to comply with a court order, a request from a competent authority or a legal obligation.
We do not sell your personal data.
6. Cookies
We use only the cookie strictly necessary to keep your session signed in. It is essential for login to work.
To measure the audience of the home page, we store our own random identifier in the browser's local storage, without a name, email address or content. It is collected automatically, expires after 13 months, and lets us recognize the same browser and attribute a registration completed within 30 days. We do not use this identifier for advertising or to track you across other sites.
We do not use advertising cookies, cross-site tracking or third party analytics tools. That is why we show no cookie consent banner.
7. Content you choose to make public
You can generate public links to visualizations. While a link is active, anyone holding it can view the shared content without an account. Share only what you want to be publicly reachable.
8. How long we keep data
We keep your data while your account exists. After account deletion we remove or anonymize it within 30 days, except records we must retain to meet legal or tax obligations or to exercise our rights, which are kept for the periods the law sets.
Anonymous home-page views and the corresponding local identifier are retained for up to 13 months. An attribution associated with a registration follows the retention period applicable to that account's data.
9. Security
We apply technical and organizational safeguards, including encryption in transit, per-user isolation in the database, administrative access control with additional authentication, and redaction of sensitive values in technical logs.
No system is completely immune. If a security incident poses a relevant risk to your rights, we will notify you and the Brazilian data protection authority as the law requires.
10. Your rights
The LGPD gives you the right to confirm that processing exists, access your data, correct incomplete or outdated data, request anonymization, blocking or deletion of unnecessary data, request portability, withdraw consent, object to processing based on legitimate interest, and learn who we share your data with.
As a user of the Service you also have the right to access the data we hold about you and, if you find any inaccuracy, to require its correction, which we make within 5 business days (article 43 and §3 of the Consumer Protection Code).
To exercise any of these rights, use the in-app support channel or write to [email protected]. We reply within 15 days.
Account deletion is handled through a support request. There is no self-service button for it on the platform yet.
You can also change your language and opt out of the newsletter directly in settings.
11. Children and teenagers
The Service is intended for people 18 or older. We do not knowingly collect data from children or teenagers. If we identify such an account, it will be removed.
12. Changes to this policy
We may update this policy. The "Last updated" date at the top identifies the current version, and significant changes will be announced through the Service or by email.
13. Contact
In-app support channel or [email protected].