Privacy Policy

1. Who processes the data

The controller of the personal data processed in offmem is ARQORIA LTDA, CNPJ 68.055.055/0001-32.

Data subject channel: contato@offmem.app.

2. Conversation content

offmem does not store the content you send or the responses, in the chat or in the API. The content passes through our servers in memory, only to reach the model and come back, and it is not written to a database or a log.

Exception: a chat response in progress is stored encrypted for up to 15 minutes, and is deleted when it reaches your browser. This lets the response continue if you leave the page.

Chat history, projects and generated files are stored only in your browser. You can export or delete everything in the settings. If you clear your browser data, the history is lost. In the settings you can encrypt the history stored in your browser with a password, which stays only on your device and which we cannot recover.

Files such as spreadsheets, documents and images created by the AI are generated in your own browser and do not pass through our servers.

We do not use your content to train models.

Messages go through an automated safety check, run with the same inference provider that generates the response, without the content being stored.

3. Data we keep

Account: email, name and profile photo (if provided) and login data, processed by the authentication provider.

Usage: for each request, the model, number of tokens, cost, status, duration and the API key used. Never the content.

Financial: plan, payments, top-ups, consumption, bonuses, referrals and refunds. Name, CPF or CNPJ and postal code provided at payment go to the payment processor and to the invoice; they are not kept in our database. When the 7-day guarantee is used, we keep only a code derived from the CPF or CNPJ (not reversible without our key), so the guarantee applies once per document.

Notification request: if you ask to be notified when another payment method is available, we keep the account email and language until we notify you or until you ask for deletion.

Site and chat measurement: on the website, the documentation, sign-in and the payment screen, offmem's own code records the pages opened, the buttons and links clicked (with their position on the screen), how far the page was scrolled, the sections seen, time on the page, the form fields touched (only the field name, never what you type) and loading performance. On all offmem pages, including the chat, we measure where the visit came from: the link or campaign that brought you (a short link or the utm parameters in the address) or the site you came from. It is kept in two offmem cookies (first contact, for up to 400 days, and last contact, for 30 days) and copied to your account when it is created. In the chat we record only usage steps, never the content of your messages: visit, start of typing (without the text), sign-up window opened, account created, acceptance of the terms, first message, number of messages, notice that the free messages ran out, plans viewed and chosen, charge created, payment, cancellation and refund. These records are tied to a random identifier stored in an offmem cookie for 180 days and, when you create or sign in to an account, to your account, together with country, device type, browser and language. This measurement does not record IP addresses, the text of conversations, attachments or replies. Page and click records are deleted after 180 days and chat steps after 400 days. With the browser's Global Privacy Control signal on, the identifier only lasts until the tab is closed and chat visits are not tied to it. We do not use third-party analytics tools.

Communications: emails we send (type and date) and your preference about news emails.

Access logs: IP address and date and time of use, kept confidential for 6 months, as required by art. 15 of the Marco Civil da Internet (Brazilian Internet Civil Framework, Law 12,965/2014), and automatically deleted afterwards.

Acceptance of these documents: version, date, time, IP and browser.

4. What we use it for

To provide the service, measure usage, bill, apply limits, prevent fraud and abuse, maintain security, comply with legal and regulatory obligations and exercise rights in legal proceedings. The legal bases are performance of the contract, compliance with a legal obligation, regular exercise of rights and legitimate interest (LGPD, Brazilian General Data Protection Law, Law 13,709/2018, art. 7).

5. Who we share it with

With service providers necessary for offmem to work, each only with the data its function requires: hosting and database, in Brazil; authentication and sign-in with Google; payment processing; invoice issuance, which includes sending the invoice data to the city government; sending and receiving emails; and the cloud infrastructure that runs the AI, which receives the message content only to generate the response. Our database (usage, balance, payments and access logs) is in Brazil. Login data stays with the authentication provider, and name, CPF or CNPJ and postal code stay with the payment processor and the invoice issuer. Some providers are outside Brazil, such as login, email delivery and the infrastructure that runs the AI, which constitutes an international transfer under art. 33 of the LGPD.

The hosting and database providers keep their own technical logs (address accessed, time and IP), without the content of conversations, for the periods they define.

With authorities, under a court order or legal request. We do not sell personal data.

6. For how long

Account and usage data: as long as the account exists. Access logs: 6 months, including after the account is deleted. Acceptance of these documents: up to 5 years after the account ends, to prove acceptance. Financial data: for the period required by tax law.

When an account with no payments is deleted, we delete email, keys, balance and usage history. If there were payments, we delete email and keys and keep, without direct identification, payments, balance movements and usage history (numbers only, never content). The conversation history stored in the browser is deleted when you delete the account through the browser.

7. Your rights

You may request confirmation of processing, access, correction, anonymization, portability, deletion, information about sharing and review of automated decisions (LGPD, art. 18), by email at contato@offmem.app. You may also file a complaint with the Brazilian National Data Protection Authority (ANPD).

8. Security

Encrypted connection, API keys stored only as a hash, database accessible only by the server, immutable financial records. The browser only sends data to offmem, to the login service and to the anti-bot check; conversation content goes only to offmem. No system is invulnerable; in case of a relevant incident, we will notify those affected and the ANPD.

9. Limits of this policy

This policy does not promise anonymity: using the service requires an account, and access logs are mandatory by law. The models do not run on your device.

We may update this policy. Relevant changes will be announced in the service.