Privacy Policy
This policy explains what isanna studio (operated by ISANNA TECNOLOGIA LTDA — full registered company details are on our Legal page) collects, why, and your choices. We keep it minimal.
What we collect
- The text you paste (e.g. your résumé and a job description) — used to generate your result and stored so you can re-open and refine it from your link or account.
- Your email — to deliver your result, let you sign in, and hold your document balance.
- Usage + analytics — basic events (page views, runs, purchases) and, if enabled, Google Analytics, to understand and improve the service. The Meta Pixel is an ad-platform tool and loads only after you opt in to ad-conversion sharing (see below) — never by default.
How we use it
Your inputs are sent to our AI provider to generate your draft, and stored so you can re-open your result from your link or account and refine it with your remaining documents. We do not sell your raw data (the text you paste or your raw email).
Legal basis & where your data goes
- Performance of a contract — generating and delivering your document and holding your document balance.
- Legitimate interest — basic first-party analytics and keeping the Service secure and free of abuse.
- Consent — ad-conversion sharing and any Google Analytics, which run only after you opt in.
Our processors operate in the United States and elsewhere, so your data is processed internationally under appropriate safeguards. You have the right to lodge a complaint with a supervisory authority — Brazil's ANPD, an EU data-protection authority, or the UK ICO, as applicable.
Advertising & conversion measurement
Ad-conversion sharing is off by default. We do not share anything with ad partners for advertising unless you opt in (turn it on) yourself — there is no default-on state to opt out of. Only if you have opted in, and when advertising is enabled, do we send a server-side purchase event to ad partners to measure ad performance. When you have opted in, that event includes a one-way hashed (irreversible) version of your email, the purchase value, and ad click identifiers — never the text you paste and never your raw email. The ad partners named below act as our sub-processors for this measurement only.
You are always in control. Everywhere — the EU, UK, Brazil, the US, and anywhere else — this sharing happens only after you opt in via the consent banner, and stays off until then. You can turn it back off at any time below:
Ad-conversion sharing. Ad-conversion sharing is off for this browser (the default). Turn it on only if you want to opt in.
Processors we rely on
- Anthropic (Claude API) — generates your draft from your inputs.
- Supabase — database hosting (your inputs, results, documents).
- Cloudflare (Turnstile) — bot / abuse verification when you submit a form.
- Fly.io — application hosting.
- Resend — sends your result + sign-in emails.
- Paddle — our payments provider, processes payments as merchant of record; we never see your full card details.
- Meta, Google, and Reddit — ad-conversion measurement, as sub-processors when advertising is enabled and you have consented; they receive the hashed purchase event described above, not your inputs.
Retention & your rights
How long we keep different types of data:
| Data type | Retention |
|---|---|
| Generated results & documents (inputs, output, access link) | Up to 24 months after your last visit, then permanently scrubbed |
| Refunded / failed order documents | Deleted after 90 days |
Raw payment payloads (orders.raw) | Nulled after 90 days; a minimal order record is kept for statutory bookkeeping |
| Abuse / security logs | 30 days |
| Analytics events (funnel + visitor identities) | 180 days |
| Erasure requests (DSAR) | Audited; documents quarantined immediately, remaining data hard-purged after a 30-day reversible window |
To access, export, or delete your data, email hello@isanna.aiand we will action it. We honor deletion requests under applicable law (incl. Brazil's LGPD and the GDPR/CCPA where relevant).
Cookies
We use a session cookie to keep you signed in and an attribution cookie to remember how you arrived. Google Analytics loads only if configured. The Meta Pixel and its ad-platform cookies (e.g. _fbp/_fbc) are off by default and load only after you opt in to ad-conversion sharing using the toggle above — turning it back off stops the pixel and suppresses the server-side conversion measurement described above.
Questions: hello@isanna.ai.