Dearpage
en

Privacy Policy

This Policy explains which personal data Dearpage collects, why, with whom it is shared, how long it is kept, and what your rights are. It is written to be read without unnecessary technical terms. By using Dearpage, you agree to the processing described here.

1. Who is responsible for your data

Dearpage is operated by Pedro Henrique Iamondi (MEI, sole proprietor), registered under Brazilian tax ID (CNPJ) 33.535.787/0001-45, with address at Rua 22 Be 28, Estádio, Rio Claro/SP, Brazil, ZIP 13501-388. In this Policy, "Dearpage", "we" and "our" refer to this operation.

The data protection officer (DPO) is the controller named above. For any question about personal data, write to privacy@dearpage.app.

2. What data we collect

  • Sign-up: display name, e-mail, password (stored only in hashed form), date of birth, country, time zone, language, anonymity preference, and where the sign-up came from (campaign parameters such as UTM).
  • Sign-in with Google: name, e-mail, profile photo, Google account identifier and, only if you grant it, your birthday for age verification.
  • Content you create: texts, books, chapters, comments, likes, tags, messages, diary entries and, when you use voice recording, the audio sent for transcription.
  • Use of the platform: books on your shelves, reading progress, settings, interactions with other profiles and purchase history.
  • Payments and subscriptions: customer and subscription identifiers, amounts, billing status and history. Full card details are handled by Stripe; Dearpage does not store card numbers.
  • Kindle: the Kindle e-mail address you provide to receive files.
  • Age and authorisation: date of birth. For teens aged 13 to 17, also the guardian's e-mail provided and the date on which the guardian authorised the account.
  • Security and integrity: records of access attempts, quota use and e-mail sending. To detect plagiarism, we store fingerprints (derived values) of published texts, not the comparison text itself.
  • Analytics and performance: pages visited, clicks, time spent, site performance metrics and session and device identifiers. They are collected through Google Analytics, including from visitors without an account, and, for account holders, also through PostHog. Google Analytics is set up without advertising purposes.
  • E-mails: a record of transactional e-mails sent (recipient, type, delivery status), kept for 90 days.

3. What we use your data for, and the legal basis

  • Performing our contract with you: creating and keeping your account, delivering books and the diary, processing payments, sending files to Kindle and the e-mails the service needs. Legal basis: performance of a contract (Brazilian General Data Protection Law, LGPD, art. 7, V).
  • Complying with legal and regulatory duties: keeping access logs, tax records and data-subject requests. Legal basis: legal or regulatory obligation (LGPD, art. 7, II).
  • Protecting the platform and people: preventing fraud, abuse and plagiarism, enforcing the Terms and moderating content. Legal basis: legitimate interest, balanced against your rights (LGPD, art. 7, IX).
  • Improving the product: understanding how features are used and fixing faults, using aggregated data whenever possible. Legal basis: legitimate interest.
  • Analytics and non-essential cookies: only after your prior consent, which you can give, refuse or withdraw at any time (LGPD, art. 7, I). Without consent, we do not collect this data.

4. Who we share data with

We do not sell personal data. We share only what is needed with suppliers that help us run the service, under contract:

  • Convex: database and backend processing.
  • Cloudflare: hosting and delivery of the website.
  • Stripe: payment processing, subscriptions and payouts to creators.
  • OpenRouter: access to artificial intelligence models used for translation, synopses, covers and content checks.
  • Groq: audio transcription (speech to text).
  • PostHog: usage and performance analytics for accounts.
  • Google (Google Analytics): measurement of visits and site usage, for visitors and accounts, without advertising purposes.
  • Dearpage's own mail server: sending transactional e-mails, such as password reset and welcome messages.
  • Google: authentication, when you choose to sign in with your Google account.

We may also share data when the law requires it, on the order of a competent authority, or to defend rights in legal proceedings.

5. International transfers

Some of the suppliers above are outside Brazil, including services hosted in the United States (such as PostHog and Google Analytics) and AI model providers. These transfers follow the LGPD (art. 33), with contractual clauses and safeguards compatible with the law.

6. Artificial intelligence

When you use translation, synopsis generation, cover generation, voice transcription or content checks, we send the AI provider only the text or audio the task needs. We do not use your content to train our own models. AI-generated results can contain errors. Review them before publishing or making important decisions based on them.

7. Minors and Dearpage School

Dearpage is open to people aged 13 and over. We do not create accounts for children under 13.

People aged 13 to 17 can create an account, but it becomes fully active only after a guardian confirms the authorisation through a link sent to the e-mail given at sign-up (family link). Until then, the account can browse but cannot buy, publish or interact.

We process teens' data in their best interest (LGPD, art. 14) and follow Brazilian Law No. 15,211/2025 (ECA Digital). Sexually explicit content is available only to people aged 18 or over, and content classified for 16 and over is available from age 16.

In Dearpage School, the contracting school is the controller of students' data and Dearpage acts as processor, under the Data Processing Agreement (DPA) signed with the school, available at Data Processing Agreement.

8. Cookies and similar technologies

We use cookies that are strictly necessary to keep you signed in and to secure the account. These cookies do not require consent.

Cookies and analytics technologies, such as Google Analytics (_ga cookies) and PostHog, are used only after your consent, whether or not you have an account. If you withdraw consent, collection stops and the _ga cookies are deleted. You choose which categories you accept and can change that choice at any time.

9. How long we keep data

  • Active account: for as long as the account exists.
  • Deleted account: personal data is deleted or anonymised within 30 days, unless the law requires us to keep it.
  • Tax and financial records: for the applicable legal period, generally five years.
  • Internet access records: for the period set by the Brazilian Internet Civil Framework (Marco Civil, art. 15), six months.
  • E-mail sending records: 90 days.
  • Administrative audit records: for as long as needed for security and traceability of actions.

10. Your rights

Under the LGPD (art. 18), you can ask at any time for:

  • confirmation that we process your data, and access to it;
  • correction of incomplete, inaccurate or out-of-date data;
  • anonymisation, blocking or deletion of unnecessary data or data processed in breach of the law;
  • portability of your data to another supplier;
  • information about who we share your data with;
  • withdrawal of consent, where consent is the basis for processing;
  • objection to processing based on legitimate interest, where the law is not being complied with.

To exercise these rights, write to privacy@dearpage.app from the e-mail address on your account. We will reply within 15 days, which may be extended as the law allows, with notice to you. You can also request account deletion from the app itself, when that feature is available.

If you are in the European Union or the United Kingdom, the General Data Protection Regulation (GDPR) may also apply. In that case, in addition to the rights above, you may lodge a complaint with the data protection authority of your country. Where required, we will appoint a representative in the European Union and state their details in this Policy.

If you believe your rights were violated, you can contact the Brazilian data protection authority (Autoridade Nacional de Proteção de Dados, ANPD).

11. Security

We use encrypted connections (HTTPS), role-based access control, logs of administrative actions, and passwords stored only as hashes. No system is completely immune to failure. If an incident may cause significant risk or harm to you, we will notify the ANPD and you, as the LGPD requires (art. 48).

12. Changes to this Policy

We may update this Policy. For material changes, we will notify you in the app or by e-mail before they take effect. The effective date is shown at the top of the document.

13. Contact

Questions, requests and complaints about privacy: privacy@dearpage.app.

Effective from October 27, 2026.