Privacy Policy — Anna · imanna.ai
INFINITESUM LTDA respects your privacy. This Policy describes how we collect, use, share, store, and protect personal data within the Anna platform, applications, and tools (the "Service"), in compliance with Law No. 13.709/2018 (LGPD) and the Brazilian Internet Framework Act (Law No. 12.965/2014). It supplements and is incorporated into the Terms of Service.
1. Controller and Data Protection Officer (DPO)
INFINITESUM LTDA — CNPJ No. 65.498.658/0001-10
Avenida Conselheiro Aguiar, No. 4200, Loja 0007, Edifício Vitrine, Boa Viagem, Recife/PE, Brazil, ZIP 51.021-020
Data Protection Officer (DPO): Lucas Wanderley de Arruda
Channel: support@imanna.ai
The DPO is the point of contact between INFINITESUM, data subjects, and the Brazilian Data Protection Authority (ANPD). All personal-data requests should be sent to support@imanna.ai.
2. Definitions
Personal data, sensitive data, data subject, processing, controller, processor, and ANPD have the meaning given by the LGPD. The Service is not intended to collect sensitive data.
3. What we collect, and what we do not — it depends on the product
This is the most important section of this Policy, and it varies with the mode you use. We would rather state this precisely than make a promise that does not hold for every product.
3.1 Anna Desktop and Anna Plugins — we do not collect your project content
Anna Desktop and the Plugins process content locally, on your device. Your project files and folders are not uploaded to, stored on, or retained by our servers. Where snippets must be sent to an AI Model Provider to perform a task, this happens directly from your device to the provider's API, without storage by us.
3.2 Anna Web — we store your project files
In Anna Web, your project files are created and stored on our cloud infrastructure so you can continue from any device. Accordingly:
- files reside on our servers, encrypted in transit and at rest;
- authorized personnel can access them where strictly necessary to operate, support, or investigate an incident, under confidentiality, least privilege, and operation logging;
- we do not use your project content to train models without your specific consent;
- you may export (.zip) and delete at any time.
If your project content includes third parties' personal data, you are the controller of that data and we process it as processor, under the DPA.
4. Data we collect
a) Provided by you
- Account: first and last name, role, e-mail, access credentials.
- Billing: where applicable, tax ID (CPF/CNPJ), company name, address.
- Communications: the content of messages you send us.
- Project content (Anna Web): files and content you create or upload — see 3.2.
- Contacts (Scheduling Module): name, e-mail, and phone of people you save for scheduling.
b) Collected automatically
- Usage and billing: Token/Credit counts, request type and volume, session metadata.
- Access logs: IP, date and time, device identifiers, technical logs.
- Cookies and similar technologies on imanna.ai — see the Cookie Policy.
c) Collected from systems you connect
| integration | data we begin to process |
|---|---|
| Google account (sign-in) | identifier, e-mail, name, and profile picture |
| Scheduling (Google Calendar) | events, titles, times, and attendees; event creation and sending invitations to third parties on your behalf |
| Customer Assistant | conversation content with your End Customers and their contact details |
| Marketing | campaign and ad-account data for the account you connect |
| Your Site | content of the connected website's pages |
| 3D Models (Tripo) | prompt and image sent — on your own Tripo account (BYOK) |
The access scopes requested are always shown by the platform itself on the authorization screen,
before you grant access, and can be revoked at any time in your account settings on that platform
(for example, myaccount.google.com/permissions). We request only the scopes necessary for the feature
you enable.
d) Payment
Processed by third-party institutions and gateways. We do not store your full card details.
5. Categories of data subjects
| category | who | how the data reaches us |
|---|---|---|
| Users | those who contract and use the Service | registration and use |
| Representatives of corporate clients | people designated by the client | registration |
| End Customers | people who talk to the User's Customer Assistant | through the channel the User configured |
| Third parties designated by the User | scheduling contacts and meeting invitees | saved or designated by the User |
For the last two categories, the User is the controller and INFINITESUM is the processor, and the DPA applies. The User is responsible for having a legal basis and for informing those people.
6. Purposes and legal bases
| purpose | legal basis (LGPD) |
|---|---|
| Create and manage your account and provide the Service | Performance of contract — Art. 7, V |
| Store your project files (Anna Web) | Performance of contract — Art. 7, V |
| Process payments, billing, and tax invoicing | Contract and legal obligation — Art. 7, V and II |
| Comply with tax, accounting, and log-retention obligations | Legal obligation — Art. 7, II |
| Operate the Modules you activate (Scheduling, Assistant, Marketing, Auto Docs, Your Site) | Performance of contract — Art. 7, V |
| Security, fraud and abuse prevention, and Service improvement | Legitimate interest — Art. 7, IX |
| Marketing communications | Consent — Art. 7, I |
| Exercise of rights in proceedings | Art. 7, VI |
Where processing is based on consent, you may withdraw it at any time, without affecting prior lawful processing.
6.1 Internal use for product improvement
We use usage data, performance metrics, and marketing and campaign data for the internal purpose of analyzing and improving the Service — for example, understanding which features are used, where users struggle, how generated assets perform, and where the product needs to evolve. The legal basis is legitimate interest (Art. 7, IX, LGPD).
This use is subject to three limits, which we undertake as commitments:
- It is internal. We do not sell personal data and do not provide it to third parties for their own purposes.
- It is aggregated wherever possible. For product analysis we prefer aggregated or anonymized data; identifiable data only where the purpose requires it.
- It does not extend to data obtained from connected platforms. Information we receive from third-party APIs you connect — such as Google (including calendar) and Meta — is restricted to the feature you enabled and is not used for product analysis, for advertising, or to train AI models, in accordance with those platforms' policies and Annex I to the Terms of Service.
That last limit is not our choice: it is a condition imposed by the platforms to keep the integrations working, and it holds even where the data would be useful to us.
You may object to processing based on legitimate interest, under Article 18 of the LGPD, by writing to support@imanna.ai.
7. Sharing and sub-processors
We do not sell personal data. We share only what is necessary, with processors under confidentiality and security obligations:
| category | who | for what |
|---|---|---|
| AI Model Providers | Anthropic, OpenAI | executing requests |
| Authentication | Google account sign-in | |
| Calendar | reading and writing the calendar you connect | |
| Messaging and advertising | Meta | operating the Customer Assistant and Marketing Modules |
| 3D generation | Tripo | running on your own account (BYOK) |
| Infrastructure and cloud | hosting and storage providers | operating the Service and storing account, projects, and logs |
| Payment | payment institutions and gateways | processing transactions and billing |
| Support and communication | customer service tools | responding to your requests |
| Authorities | — | where required by law or court order |
| Third parties in a corporate reorganization | — | with notice and preservation of this Policy |
This list is kept up to date in this Policy. Material changes to the list of processors will be communicated with reasonable advance notice, and you may request the current named list at any time through the Data Protection Officer's channel.
8. International transfers
Some processors — in particular AI Model Providers, Google, and cloud providers — are located outside Brazil. In such cases we carry out international transfers under Article 33 of the LGPD, with appropriate safeguards such as specific contractual clauses.
9. Retention and deletion
| data | period |
|---|---|
| Access logs | minimum 6 months (Internet Framework Act, Art. 15) |
| Tax and accounting data | up to 5 years, or longer where required |
| Account data | while the account is active + the period needed to defend rights |
| Anna Web projects | while the account is active; deleted after termination 7-day grace period |
| Customer Assistant conversations | per the User's (controller's) instruction, under the DPA |
| Support tickets | term + 24 months |
Once purposes are fulfilled, data is deleted or anonymized, except under Article 16 of the LGPD.
10. Information security
We use encryption in transit and at rest, least-privilege access control, operation logging, backups, and internal policies (Articles 46–49 of the LGPD). Two-factor authentication is available for all accounts, and we strongly recommend enabling it under Settings → Account.
In the event of a security incident that may create relevant risk or harm, we will notify the ANPD and affected data subjects within a reasonable period.
11. Data-subject rights
Under Article 18 of the LGPD you may request: confirmation of processing; access; correction; anonymization, blocking, or deletion; portability; deletion of data processed with consent; information about sharing; information about withholding consent; and withdrawal of consent.
How to exercise: write to support@imanna.ai. We may request additional information to verify your identity. We respond immediately to simplified requests and within 15 (fifteen) days for the full declaration, free of charge.
Self-service already available in the product: project export as .zip and account deletion under Settings → Account, with a notice of what is lost.
12. Automated decisions
Certain operations are automated — including security mechanisms (Credit freeze and investigation hold) and the responses generated by Anna. Under Article 20 of the LGPD, you may request a review of decisions made solely on automated processing that affect your interests, and information about the criteria used, subject to trade and industrial secrets. Requests: support@imanna.ai.
13. Cookies
The website uses essential cookies only, which do not require consent (Art. 7, V and IX, LGPD). We do not use analytics, profiling, or advertising cookies, and therefore display no consent banner. Should this change, we will request prior consent and update the documents before any activation. Details in the Cookie Policy.
14. Children's data
The Service is not intended for anyone under 18 and we do not knowingly collect data from children or adolescents. If we identify such processing, we will take steps to delete it.
15. Changes and version history
We will post the revised version with a new date and, for material changes, make reasonable efforts to notify data subjects. We keep a version history available.
16. Complaints to the ANPD
Without prejudice to contacting us directly — which we recommend as the first route — you may petition or file a complaint with the Brazilian National Data Protection Authority (ANPD).
17. Contact
INFINITESUM LTDA · CNPJ 65.498.658/0001-10 · Data Protection Officer (DPO)
support@imanna.ai · imanna.ai
Avenida Conselheiro Aguiar, No. 4200, Loja 0007, Edifício Vitrine, Boa Viagem, Recife/PE, Brazil, ZIP 51.021-020