Privacy Policy
Version 1.1 — October 24, 2026
This policy explains what personal data InkOS processes, for what purposes, with which providers, where, for how long and how you can exercise your rights. It follows the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD") and, for users in the European Union, the General Data Protection Regulation ("GDPR", section 14). It complements the Terms of Use. This is a translation of the Portuguese version (Política de Privacidade).
1. Who is responsible for your data
The data controller is 43.035.086 CARLOS VINICIUS DE SOUSA MELO, registered with the CNPJ (Brazilian company registry) under no. 43.035.086/0001-09, with business address at Avenida Moinho Fabrini, nº 385, bairro Independência, São Bernardo do Campo - SP, CEP 09861-160, responsible for the InkOS platform.
Contact channel for any privacy matter, including exercising your rights: contato@inkos.studio. Support: contato@inkos.studio | WhatsApp: +55 (11) 95598-5013.
2. What data we process
| Category | Data | Source |
|---|---|---|
| Registration | Name, email, password (stored only in encrypted form by the authentication service), country and phone: in Brazil, CPF (Brazilian taxpayer number) and mobile number; outside Brazil, international phone number | You, when registering |
| Sign in with Google | Name, email and profile picture from your Google account | Google, with your authorization |
| Profile and preferences | Language, picture, bio, date of birth and social networks, when you provide them | You |
| Content | Images you upload, generated images and 3D models, texts and instructions (prompts), tool settings, conversations in the Create area, saved poses and Prompt Creator history. In voice dictation, the audio is sent for transcription and is not stored; only the text you use is kept | You and your use of the tools |
| Third-party data you register | Clients and appointments (name, phone, Instagram, email and notes), when you use these features | You |
| Usage and consumption | Plan, credit balance and consumption, tool, AI engine and cost of each operation, date and time, and interactions in Explore (viewing, saving, sharing and downloading images) | Generated by your use of the platform |
| Payments | Subscription plan, cycle, status and dates, payment method (Pix or card), amounts, currency and status of each payment, and the customer identifier at the payment provider. Card details are entered directly with the provider; InkOS does not receive them | You and the payment providers |
| Acceptance of the Terms | Accepted version, date and time, IP address and browser identification at the time of acceptance | Your browser |
| Last access | Date and time of your last authenticated access to the account | Generated by your use of the platform |
| Technical data | IP address and browser information recorded by the hosting servers | Your browser |
Client data you register is processed by you, as a professional; InkOS only stores it for you. Make sure you have a legal basis to record it.
3. What we use it for and on what legal basis
- Creating and maintaining your account, signing you in and providing the service (generating and editing images and 3D models, keeping your library, managing credits and plans): performance of a contract (LGPD art. 7, V).
- CPF and mobile number (Brazil) or phone number (abroad): ensuring one account per person and preventing fraud: legitimate interest and fraud prevention (LGPD art. 7, IX, and art. 11, II, "g", where applicable).
- Billing of subscriptions and one-off credits: performance of a contract and compliance with legal and tax obligations (LGPD art. 7, II and V).
- Recording acceptance of the Terms: proving the contract and defending rights (LGPD art. 7, V and VI).
- Last access and inactivity notices: applying the inactivity deletion rule of the Terms and warning you beforehand: performance of a contract.
- Support and communications about your account (registration confirmation, password changes, important notices): performance of a contract.
- Security, abuse prevention and service improvement, including monitoring costs and failures: legitimate interest.
- Compliance with legal obligations and defense in legal proceedings: LGPD art. 7, II and VI.
We do not sell your data and do not use it for advertising.
4. Providers that process the data
InkOS uses the providers below, which process data on our behalf and only for the purposes of this policy:
| Provider | Purpose and what it receives | Where |
|---|---|---|
| Supabase | Database, authentication and storage of images and files | São Paulo, Brazil |
| Vercel | Hosting of the InkOS website and servers; content delivery network for public pages | Servers in São Paulo, Brazil; global delivery network |
| Google (Gemini) | Prompts and uploaded images, to generate, edit and analyze images and text and to translate prompts | United States |
| OpenAI | Prompts and images (GPT Image engine and prompt extraction) and voice dictation audio, for transcription | United States |
| Black Forest Labs | Prompts and reference images (InkOS Image and InkOS Image Pro engines, from the FLUX family) | Germany and United States |
| Replicate | Running third-party models: the image to enlarge in Upscale 4K and, as an alternative, the FLUX engines | United States |
| Topaz Labs (via Replicate) | The image to enlarge in Upscale 4K | United States |
| Meshy | A temporary link to the chosen image, to generate the 3D model (plans with 3D Studio) | Outside Brazil |
| Asaas | Payments in Brazil (Pix and card): name, CPF, email, mobile number and account identifier | Brazil |
| Stripe | Payments outside Brazil (card): name, email and account identifier | United States and Ireland |
| Google (sign-in) | Sign in with Google, when you choose this option | United States |
| Hostinger | Sending InkOS emails (such as the inactivity notice) and the support mailbox | Outside Brazil |
| Google Fonts | Website fonts; receives the IP address and browser of anyone who opens the site | Global |
AI providers receive only what each request needs: the prompt and the images (or the audio, for dictation). InkOS does not send them your name, email, CPF or phone number. The image and instructions are processed by the provider of the engine you chose, under that provider's terms for API use.
If you contact support through WhatsApp, the conversation also goes through WhatsApp (Meta), under that service's terms.
We may also share data when required by law or by order of a competent authority.
5. International transfers
The InkOS database, files and servers are located in Brazil. Data sent to the providers marked as located outside Brazil in the table above is transferred to other countries to perform the service you signed up for and at your request (LGPD art. 33), with providers that adopt data protection safeguards in their terms.
6. AI model training
- InkOS does not train or fine-tune its own AI models with your images, prompts or other content.
- Your creations are not published in Explore. Explore shows only images selected and published by the InkOS team.
- The use of data by AI providers follows each provider's terms for API use, including on training and on retention for abuse monitoring. OpenAI states publicly that, by default, it does not use data sent through its API to train its models. For the other providers, their own terms apply.
7. What is public
Your library is private: no other user sees your creations. The privacy of the library does not prevent processing by the providers above or restricted access by authorized people when needed for support, security, operation of the service or compliance with legal obligations.
8. How long we keep it
- Account and profile: for as long as the account exists.
- Images and files: for as long as the account exists, and you can delete each of them whenever you want. After one consecutive year without authenticated access, counted from the last access, stored images and files (library, poses, attachments and 3D scenes) may be deleted for inactivity. Before that, at 11 months without access, we send a notice to the account's email, at least 30 days in advance, so you can sign in and download whatever you want from the Library. A new sign-in restarts the count. The account remains. We record the date and the number of files deleted.
- Payments: subscription and payment records are kept for the period required by tax and consumer protection law, including after the account is deleted.
- Usage and consumption: for as long as needed to manage credits, costs and security. If the account is deleted, these records are no longer linked to you.
- Acceptance of the Terms: for as long as the account exists.
- Application access logs: for the period required by the Brazilian Internet Civil Framework (6 months) or longer, when necessary for security or the defense of rights.
- Account deletion: can be requested at any time at contato@inkos.studio. We delete the account, the profile and the content, keeping only what the law requires us to keep or what is needed for the defense of rights.
9. Your rights
At any time and free of charge, you can request: confirmation that we process your data; access to it; correction of incomplete or inaccurate data; anonymization, blocking or deletion of unnecessary data; portability; information about who we share it with; deletion of data processed based on your consent and withdrawal of that consent; and review of decisions made solely on the basis of automated processing (LGPD arts. 18 and 20).
To do so, write to contato@inkos.studio from your account's email address. We respond within 15 days. You can also download your images at any time from the Library and file a complaint with the Brazilian National Data Protection Authority (ANPD).
10. Cookies and browser storage
InkOS does not use advertising cookies or third-party analytics or tracking tools. Your browser stores locally (localStorage and sessionStorage) only:
- the sign-in session (needed to keep you signed in);
- preferences, such as language, tool display mode and Prompt Creator output language;
- interface flags, such as introductions already seen, and temporary operating data.
You can clear this data in your browser settings; you will be signed out. The site loads fonts from Google Fonts and some images from external servers, which receive the IP address and browser of anyone who opens the page.
11. Security
We use encrypted connections (HTTPS), passwords stored with encryption, restricted access to data and private storage of creations. No system is completely immune to failures; if an incident occurs that may pose a relevant risk, we will notify you and the ANPD, as required by law.
12. Minimum age
To sign up for InkOS you must be at least 18 years old and legally able to enter into contracts (section 2 of the Terms of Use). We do not knowingly collect data from minors; if we identify such a case, we will delete the data.
13. Changes to this policy
We may update this policy. The version and date at the top show the version in force; important changes will be announced on the platform or by email.
14. Users in the European Union (GDPR)
If you are in the European Economic Area, the GDPR also applies to the processing of your personal data. The controller is the person named in section 1, reachable at contato@inkos.studio.
- Legal basis (GDPR art. 6): performance of a contract (art. 6(1)(b)) to create and run your account and provide the service; legitimate interests (art. 6(1)(f)) for security, preventing abuse and duplicate accounts, and improving the service; legal obligation (art. 6(1)(c)) where the law requires it; and consent (art. 6(1)(a)) where we ask for it, which you can withdraw at any time.
- Your rights: access (art. 15), correction (art. 16), erasure (art. 17), restriction of processing (art. 18), portability in a structured, machine-readable format (art. 20) and objection to processing based on legitimate interests (art. 21).
- How to exercise them: write to contato@inkos.studio from your account's email address. We respond within 15 days, and never later than one month.
- International transfers: your data is processed in Brazil and by the providers listed in section 4, in the countries indicated, to perform the service you signed up for.
- Complaints: you can lodge a complaint with the data protection supervisory authority of your EU country of residence.