Trakto Privacy Policy

Version 2026-08-21 — effective as of September 1, 2026

This Privacy Policy explains how Trakto collects, uses, shares and protects personal data when you use the trakto.studio platform, our websites, the API, the MCP server, Trakto Links and our customer service channels (together, the "Platform").

It was written to comply, at the same time, with the LGPD (Brazilian General Data Protection Law, Law 13,709/2018), the General Data Protection Regulation of the European Union and the United Kingdom (GDPR and UK GDPR), the California privacy law (CCPA/CPRA) and the Canadian law (PIPEDA). Sections 11 to 14 provide information specific to each regime. In the event of conflict, the rule most protective of you applies.

Summary of what matters:

• Your documents, uploads, prompts, generated images/videos and brand kits are not used to train AI models — not by us, and not by the AI providers we use.
• We do not sell your personal data.
• Card data stays with Stripe; Trakto does not store it.
• Analytics and marketing only with your consent where the law requires it (EU/UK/Canada) and with an opt-out option in other regions.
• You can access, correct, export and delete your data at any time.

1. Who the controller is

1.1. The controller of the personal data processed in the context of this Policy is Blob Animação Gráfica Interativa Ltda., CNPJ (Brazilian corporate taxpayer registry) 05.196.991/0001-43, with its principal place of business at Avenida Álvaro Otacílio, 3731, Bloco Espanha – Edf. JTR, Sala 602, Jatiúca, Maceió/AL, 57036-850, Brazil ("Trakto", "we", "us").

1.2. Data Protection Officer (DPO). Our officer in charge of personal data processing, under art. 41 of the LGPD and art. 37 of the GDPR, can be contacted at dpo@trakto.io (Data Protection Officer: Diogo Nobre).

2. Scope and roles: when we are controller and when we are processor

2.1. We are the controller of the personal data of those who create an account, visit our websites, interact with our customer service or receive our communications. This Policy deals mainly with these situations.

2.2. We are the processor in relation to third-party personal data that you enter into your content — for example, photos of your agency's clients, names in a presentation, product spreadsheets with buyer data. In these cases, you (or the organization you represent) are the controller, and the processing follows your instructions, in accordance with the Data Processing Addendum. If you are a data subject whose data appeared in a design created by a Trakto customer, direct your request to that customer; we will help as needed.

2.3. Visitors to Trakto Links. When you view a Trakto Link published by a user, Trakto collects basic technical data and view metrics (Section 3.5) as controller for security purposes and as processor to provide statistics to the user who published it.

3. What data we collect

3.1. Data you provide to us

• Sign-up and profile: name, e-mail, password (stored as a hash), profile photo, language, country, job title and company (optional), identity provider data (such as Google) when you choose that login method.
• Billing data: name, billing address, CPF/CNPJ (Brazilian taxpayer IDs) or tax identification where required, purchase history, subscribed plan. Card data is collected and stored directly by Stripe; Trakto receives only an identifier, the last four digits, the card brand and the expiration date.
• Content: documents, uploads (images, videos, audio, fonts, PDFs, spreadsheets), text, prompts sent to the AI features, generated outputs, brand kits, comments and version history.
• Communications: messages sent to support, survey responses, participation in beta programs.
• Team data: names and e-mail addresses of people you invite to your workspace.

3.2. Data collected automatically

• Usage data: features used, actions in the editor, AI models invoked, credits consumed, documents created, dates and times.
• Technical data: IP address, browser type and version, operating system, screen resolution, device language, session identifiers, referring pages.
• Security and diagnostic logs: authentication records, application errors (via Sentry), latency, render failures.
• Cookies and similar technologies: as described in the Cookies Policy.

3.3. Data from third parties

• Identity providers: when you sign in with Google, we receive your name, e-mail and photo, according to the permissions you grant.
• Integrations you connect: when you connect external accounts (for example, social networks for publishing or file import), we receive the data you authorize.
• Business partners: on Enterprise plans, we may receive contact data of representatives of the contracting organization.

3.4. Sensitive data

Trakto does not request sensitive data (racial origin, religious beliefs, political opinions, health data, biometric data, sexual orientation). If you include such data in your content, you do so at your own responsibility, as controller, and must have a legal basis for it. Photos of faces are processed only as images, for rendering and for the features you invoke; we do not create biometric identification models.

3.5. Visitors to Trakto Links

When you open a Trakto Link, we collect IP address (truncated after initial processing), approximate country/region, device and browser type, referrer, date and time and interaction events (views, clicks, time on page). This data is used for security, abuse prevention and to provide aggregated statistics to the user who published the link.

4. What we use the data for and on what legal basis

What we do NOT do: we do not use your content, prompts or outputs to train AI models; we do not make automated decisions with legal or similarly significant effects on you without human review; we do not sell personal data; we do not profile you for advertising purposes based on your content.

5. Artificial intelligence and your data

5.1. No-training commitment. Documents, uploads, prompts, generated images, videos and audio, and brand kits are not used to train, fine-tune, evaluate or improve AI models, whether by Trakto or by the AI providers.

5.2. How we use the providers. To deliver AI features, Trakto sends your prompts and, when necessary, the reference content (for example, an image for background removal) to AI providers through commercial APIs. These providers are contracted exclusively under commercial regimes that prohibit the use of the data for training and limit retention to the time needed to process the request, prevent abuse and comply with the law. The current providers are:

5.3. Proprietary models and heuristics. Some features (such as the auto-animation engine and the layout solver) run on Trakto's own deterministic logic, without sending data to third parties.

5.4. Moderation. Prompts and outputs may go through automated safety classifiers (Trakto's or the providers') to detect content prohibited by the AI Acceptable Use Policy. Flagged content may be reviewed by members of the Trakto team, under confidentiality and restricted access, exclusively for moderation and security purposes.

5.5. Voice cloning and use of faces. Features that use a real person's voice or face require you to declare that you have that person's consent. Voice samples submitted for cloning are treated as your content, are not used to train general models and can be deleted at any time. voice cloning is not available on the Platform

6. Who we share data with

We share personal data only in the cases below, always limited to the minimum necessary.

6.1. Sub-processors. Companies that process data on our behalf, under contracts with obligations of confidentiality, security and no use for their own purposes:

The current list of sub-processors, with prior notice of changes, is maintained in Annex III of the Data Processing Addendum.

6.2. Members of your workspace. If you take part in a team workspace, your name, e-mail, photo and activity in shared documents are visible to the other members and to the administrator.

6.3. Public. Content you publish to Trakto Links, templates you make public and your public profile (if any) are accessible to third parties, according to your settings.

6.4. Authorities and legal obligations. We may share data when required by law, court order or competent authority, or to protect the rights, safety and property of Trakto, its users or third parties. We assess each request and, when possible and permitted, notify you.

6.5. Corporate transactions. In the event of a merger, acquisition or sale of assets, data may be transferred to the successor, which will be bound by this Policy. We will notify you before your data becomes governed by a different policy.

6.6. We do not sell personal data and do not share it for third-party behavioral advertising without your consent (see Section 13 for the definition of "sale" and "sharing" under the CCPA/CPRA).

7. International transfers

7.1. Trakto is headquartered in Brazil and uses infrastructure and vendors located mainly in the United States in the USA only. Your data may therefore be transferred to and processed outside your country.

7.2. From Brazil abroad (LGPD, arts. 33 to 36). We base transfers on standard contractual clauses approved by the ANPD (Brazilian National Data Protection Authority) (Resolution CD/ANPD No. 19/2024) or on another recognized mechanism, in addition to contractual guarantees that recipients apply a standard of protection compatible with the LGPD.

7.3. From the EU/UK to outside the EEA/UK. We use the European Commission's Standard Contractual Clauses (Decision 2021/914), the UK Addendum (or the IDTA), and transfer impact assessments. Where the vendor is certified under the EU-U.S. Data Privacy Framework, we also rely on that certification. Copies of the mechanisms may be requested from the DPO.

7.4. From Canada. We inform you that data may be processed outside Canada and be subject to the laws of the countries where it is located, including access by local authorities in accordance with applicable law.

8. How long we keep the data

After these periods, the data is deleted or irreversibly anonymized. We may keep data longer if necessary to comply with a legal obligation, to exercise rights in judicial or administrative proceedings, or in the event of a hold ordered by an authority.

9. How we protect the data

We adopt technical and organizational measures proportionate to the risk, including: encryption in transit (TLS 1.2+) and at rest; role-based access control and the principle of least privilege; strong authentication for the team; environment segregation; audit logs; regular backups with restore testing; vulnerability management; code review; and contracts with security obligations with all sub-processors. Annex II of the Data Processing Addendum describes the measures in detail.

No system is 100% secure. If a security incident occurs that may cause relevant risk or harm to you, we will notify you and the competent authorities within the statutory deadlines (in Brazil, in accordance with Resolution CD/ANPD No. 15/2024; in the EU/UK, within 72 hours to the supervisory authority where applicable).

10. Your rights

Regardless of where you are, you can:

• Access the data we hold about you and obtain a copy;
• Correct incomplete, inaccurate or outdated data;
• Delete your data and your account;
• Export your data in a structured, commonly used format (portability);
• Restrict or object to certain processing, especially processing based on legitimate interest;
• Withdraw consent at any time, without affecting the lawfulness of prior processing;
• Not be discriminated against for exercising your rights;
• Lodge a complaint with a data protection authority.

How to exercise them. Much of this can be done directly in the account settings (edit profile, export, delete account, manage e-mail and cookie preferences). For other requests, write to dpo@trakto.io. We respond within 15 days (LGPD) or 30 days (GDPR/CCPA/PIPEDA), extendable where the law permits, in which case we will notify you. We may ask for information to confirm your identity. You may designate an authorized representative, in accordance with applicable law.

11. Specific information — Brazil (LGPD)

11.1. Legal bases. We process data on the legal bases of art. 7 of the LGPD indicated in Section 4, and sensitive data, if any, only in the cases provided for in art. 11.

11.2. Data subject rights (art. 18). In addition to the rights in Section 10, you may: confirm the existence of processing; obtain information about the entities with which we share data; be informed about the possibility of not providing consent and the consequences of doing so; request the anonymization, blocking or deletion of unnecessary or excessive data or data processed in non-compliance; and request the review of automated decisions (art. 20).

11.3. Data Protection Officer. See Section 1.2.

11.4. Authority. You may lodge a complaint with the ANPD (Brazilian National Data Protection Authority) — gov.br/anpd — and with consumer protection bodies.

11.5. Children and teenagers. See Section 16.

11.6. Impact report. We maintain a personal data protection impact report for the highest-risk operations and will present it to the ANPD upon request.

12. Specific information — European Union and United Kingdom (GDPR / UK GDPR)

12.1. Legal bases. Indicated in Section 4. Where we rely on legitimate interest, we carry out a balancing test and you may request a summary from the DPO.

12.2. International transfers. See Section 7.3.

12.3. Rights. In addition to the rights in Section 10: the right to object to direct marketing at any time (art. 21(2)); the right not to be subject to a solely automated decision with legal effects (art. 22) — we do not make this type of decision.

12.4. Supervisory authority. You may complain to the authority of your country of residence, place of work or place of the alleged infringement. In the United Kingdom, to the Information Commissioner's Office (ico.org.uk). not appointed at this time

12.5. Cookies. In the EU/UK, non-essential cookies are activated only after your consent (opt-in), in accordance with the ePrivacy Directive / PECR.

13. Specific information — California (CCPA/CPRA)

13.1. Categories collected in the last 12 months (under Cal. Civ. Code §1798.140): identifiers (name, e-mail, IP, account identifiers); commercial information (purchase history, plan); internet activity (usage, interactions, cookies); approximate geolocation data (derived from IP); audio, visual and electronic content (your content and outputs); professional information (job title, company, optional); limited inferences for product personalization. We do not collect categories of sensitive personal information, except for login credentials (protected by hashing) and, if you enter them, data contained in your content, processed only to provide the service.

13.2. Sources: you; your device; identity providers; authorized integrations.

13.3. Purposes: Section 4. Recipients: Section 6. We disclose information to service providers for business purposes.

13.4. Sale and sharing. Trakto does not sell personal information. The use of third-party advertising pixels and cookies may be considered "sharing" for cross-context behavioral advertising; such sharing only occurs with your consent and you may opt out at any time via the "Do Not Sell or Share My Personal Information" link in the website footer and in the cookie settings. We honor Global Privacy Control (GPC) signals as an opt-out request.

13.5. Your rights: to know/access; to delete; to correct; portability; to opt out of sale/sharing; to limit the use of sensitive information (not applicable, as we do not use it to infer characteristics); not to suffer retaliation. Exercise them through the account settings or via dpo@trakto.io. You may use an authorized agent; we will verify the authorization.

13.6. Retention: Section 8.

13.7. Minors: we do not sell or share data of minors under 16 years of age.

14. Specific information — Canada (PIPEDA and provincial laws)

14.1. We process personal data of Canadian residents with consent (express or implied, depending on sensitivity and reasonable expectations) for the purposes identified in Section 4, and limit collection to what is necessary.

14.2. You may withdraw consent at any time, subject to legal or contractual restrictions and with reasonable notice; in some cases, this may prevent us from providing the service.

14.3. Transfers. Your data may be processed outside Canada (Section 7.4).

14.4. Access and correction. You may request access and correction. We respond within 30 days. You may lodge a complaint with the Office of the Privacy Commissioner of Canada (priv.gc.ca) or with the competent provincial authority (for example, the Commission d'accès à l'information du Québec). not applicable at this time

14.5. Privacy officer: the DPO indicated in Section 1.2.

15. Cookies, analytics and marketing

15.1. We use cookies and similar technologies as described in the Cookies Policy.

15.2. Where prior consent is required (opt-in): EU, UK, Canada and other jurisdictions that require it — cookies and analytics and marketing tools are only activated after you accept them in the banner.

15.3. In other regions (opt-out): analytics may be active by default on the basis of legitimate interest, and you may disable it at any time in the cookie settings. Third-party marketing always depends on consent.

15.4. Marketing e-mails. Every marketing e-mail has an unsubscribe link. Transactional e-mails (security, billing, changes to terms) are necessary for the service and cannot be disabled for as long as the account exists.

16. Children and teenagers

16.1. The Platform is intended for people 18 years of age or older. We do not knowingly collect data from children under 13. no: the Platform is intended exclusively for adults aged 18 and over

16.2. If we become aware that we have collected data from a minor without the required consent, we will delete the data. Parents and guardians may contact us at dpo@trakto.io.

17. Changes to this Policy

We may update this Policy to reflect changes to the Platform, the law or our vendors. Material changes will be communicated at least 15 days in advance by e-mail or notice on the Platform. Changes to the list of sub-processors follow the procedure in the Data Processing Addendum. The version history is at the end of the document.

18. Contact

• Data Protection Officer (DPO): dpo@trakto.io
• Support: suporte@trakto.studio
• Address: Avenida Álvaro Otacílio, 3731, Bloco Espanha – Edf. JTR, Sala 602, Jatiúca, Maceió/AL, 57036-850, Brazil

Version history