Privacy Policy
Last updated: October 8, 2026
Who processes your data
GLTech (57.070.688 Gabriel Garcia Lorencetti, CNPJ 57.070.688/0001-01, Santa Rita do Passa Quatro, SP), the company that builds and runs Amevoli, is the controller of the data processed in this application. For anything about privacy, including access or deletion requests: hello@amevoli.app.
What we collect
The photos you upload and the versions generated from them; the names, dates, occasion and answers you type; the language you choose; your email, if you ask for a link back or make a purchase; minimal technical data needed to run and protect the service (IP address, used to limit abuse and, for memorial candles, kept only as an irreversible code); and usage events without content (for example: "a story was created"), never photos, names or story text. Card details are handled directly by the payment provider and never reach our servers.
Why we process it, and on what legal basis
To compose and deliver your keepsake, complete the purchase and support you: performance of a contract (GDPR art. 6(1)(b); LGPD art. 7, V). For the photos and the answers you write, and for publishing a memorial: your consent, which you can withdraw at any time by deleting the project or turning sharing off (art. 6(1)(a); art. 7, I). To prevent fraud and abuse and keep the service running: legitimate interest (art. 6(1)(f); art. 7, IX). We never use your photos, answers or stories for advertising, public examples or training AI models.
Who we share it with
Only the processors the service needs, each limited to what it requires: Vercel (hosting and execution, functions in Brazil), Neon (database, São Paulo), Cloudflare (private storage for photos and artwork, currently in North America), fal.ai or OpenAI (paint the portrait from the photos you chose; one at a time, the other as a backup), Anthropic, DeepSeek or OpenAI (write the story text and organise the timeline from your answers; one at a time, the others as backups; they receive text, never photos), Stripe (payment), Resend and Amazon SES (email delivery; the emails we send you may carry the preview of your story's painted portrait), Deepgram (transcribes audio when you tell the story by voice, straight from your browser; we keep only the transcript), ElevenLabs (narration, if you buy the add-on), PostHog (usage metrics without content) and Meta and TikTok (ad measurement: when a preview is ready or a purchase happens, our server reports the event, the ad click id if there is one, the IP and browser of visitors who came from an ad, and your email as an irreversible hash if you gave it; never photos, names or text). We do not sell personal data and do not share it with advertisers.
International transfers
Some of those processors are outside your country: photo storage is currently in North America, and the text, image, voice, payment, email and analytics providers operate in the United States, Europe or Asia (the text providers, Anthropic and OpenAI in the United States and DeepSeek in China, receive only the sentences you wrote, never your photos). These transfers rely on the contracts we hold with each processor, which bind them to process data only on our instructions and to keep it secure. If you would rather not use a specific feature, it is optional: voice narration and transcription only happen if you ask for them.
How long we keep it
Projects that were never unlocked are deleted automatically after 365 days, together with photos, generated files and answers. Unlocked stories and their shared link are kept for as long as the service exists, so you can come back and download them. You can delete everything at any time from the story's own page; deletion removes photos, files and answers immediately. Payment records are kept for the period the law requires, even after a project is deleted.
Your rights
You can confirm whether we process your data, access it, correct it, anonymise, block or erase it, request portability, learn who we share it with, withdraw consent and object to a processing activity. The fastest route is the story's own page, where you can download everything and delete everything in one tap. For anything else, write to hello@amevoli.app: we answer within 15 days. If you are not satisfied, you can complain to Brazil's data protection authority (ANPD) or, in Europe, to your national supervisory authority.
Cookies
Only what is necessary: one essential cookie that remembers which stories are yours (without it you cannot get back to your project) and one that remembers the language you chose. If you arrived from an ad on Instagram, Facebook or TikTok, a third cookie of ours keeps that click's id for up to 7 days, so we can tell whether the ad worked. No third-party trackers in the browser.
Security
Photos live in private storage, never at a public address: every view uses a short-lived signed link, and your project pages are not indexed by search engines. Traffic is encrypted. The film is rendered on your own device, not on our servers. No system is perfect; if an incident happens that could put you at risk, we will tell you and the authority.
Children
The service is for adults over 18. If the photos include children, you must be their guardian or have the guardian's permission. We do not build profiles of people and do not use facial recognition: photos are used only to compose your keepsake.
Changes to this policy
If something changes materially, we update this page and the date at the top, and email anyone with an unlocked story.