Privacy Policy

1. Controller

The controller of your personal data is 62.101.105 CAUA DE MORAIS, a Brazilian company registered under CNPJ no. 62.101.105/0001-94, located at Rua Confissão, 191, Casa 2, Gleba do Pêssego, São Paulo - SP, CEP 08265-230, Brasil, operator of Fablone. This policy follows the Brazilian General Data Protection Law (Law 13,709/2018, “LGPD”) and the Brazilian Internet Civil Framework (Law 12,965/2014).

Privacy contact and data protection officer: [email protected]. As a small processing agent we may be exempt from appointing an officer (ANPD Resolution 2/2022), but we keep this channel to serve data subjects and the Brazilian Data Protection Authority (ANPD).

2. Data we process

• Sign-up: name, email and password. The password is stored only as a hash (Argon2id); we never see it in plain text.
• Access and security: IP address, date and time of access, browser and operating system (user agent) and session identifiers (we keep only the token hash).
• Platform use: stories opened, chapter and reading or listening position, library, daily views and approximate country (from the browser language or network, never a precise location), language and reading and audio preferences.
• Acceptance of the terms: accepted version and date, as proof of the contract.
• Payments (paid plans): plan, amounts, dates, status and transaction identifiers. Card data is handled directly by Stripe; we keep only the Stripe customer ID, plan, status and period end. For invoicing we may process tax ID and billing address.
• Support: whatever you send us when you get in touch.

We do not intentionally collect sensitive personal data. We do not sell personal data.

3. Purposes and legal bases

• Creating and keeping your account, signing you in, delivering content, saving progress and library, and processing payments: performance of a contract (LGPD art. 7, V).
• Keeping access logs (IP, date and time) for 6 months: legal obligation (Internet Civil Framework art. 15; LGPD art. 7, II).
• Keeping tax and payment records: legal obligation and exercise of rights (art. 7, II and VI).
• Security, fraud and abuse prevention, login attempt limits: legitimate interest (art. 7, IX).
• Personalized recommendations and “most watched in your country”, from your history and aggregate statistics: legitimate interest, always in line with what you expect from the service.
• Improving the platform with aggregate statistics: legitimate interest.
• Account messages (security, changes to the terms, billing): performance of a contract. Promotional emails, if sent, depend on your consent, which you can withdraw at any time.

4. Artificial intelligence

We use third-party artificial intelligence services to produce catalog content (narration, voices, scripts, translations, sounds and image descriptions). These services receive the story texts, not your personal data. Recommendations on the platform are computed by our own systems and do not make decisions with legal effects on you.

If in the future you can submit text to create stories, that content may be processed by these providers to generate the result, as stated in the feature itself.

5. Sharing

We share data only when necessary, with:

• infrastructure providers (hosting, database, storage, email), acting as processors under our instructions;
• Stripe, which processes payments and may handle data outside Brazil, and invoicing providers, to charge and meet tax obligations;
• Google Fonts, which serves the site fonts and receives your IP when loading them;
• public authorities, under a court order or legal request;
• successors, in a reorganization, sale or transfer of the business, keeping the safeguards of this policy.

6. International transfers

Some providers may store or process data outside Brazil (for example in the United States or the European Union). Such transfers follow LGPD art. 33, with contractual clauses and safeguards compatible with Brazilian law.

7. Retention

• Account data, progress and library: while the account is active. When you delete it, they are erased within 30 days.
• Sessions: until they expire (30 days) or you sign out; then they are deleted automatically.
• Access logs (IP, date and time): 6 months, as required by the Internet Civil Framework, or longer under a court order.
• Payment and tax data: 5 years, as required by tax law.
• Aggregate, anonymous statistics may be kept indefinitely, as they do not identify you.

8. Your rights

Under LGPD art. 18 (and, where applicable, similar laws such as the GDPR), you may at any time and free of charge:

• confirm whether we process your data and access it;
• correct incomplete, inaccurate or outdated data (name and password can be changed in your profile);
• request anonymization, blocking or deletion of unnecessary or unlawfully processed data;
• request portability of your data;
• request deletion of your account and of data processed based on consent;
• know who we share your data with;
• withdraw consent and object to processing based on legitimate interest;
• request review of decisions made solely by automated processing.

Send your request to [email protected] from your account email. We will reply within 15 days. We may ask for information to confirm your identity. You may also complain to the ANPD (gov.br/anpd) or to your local data protection authority.

9. Security

We take technical and administrative measures to protect your data: encrypted connections (HTTPS), Argon2id password hashing, session tokens stored only as hashes, session cookies unreadable by scripts, login attempt limits, role-based access control and restricted access to our systems. No system is fully immune; if a security incident poses a relevant risk, we will notify you and the ANPD, as required by LGPD art. 48.

10. Children and teenagers

Accounts can only be created by people 18 or older. We do not knowingly collect children’s data. Minors should use the platform through the account and under the supervision of their parents or guardians. If we find a child’s data processed without parental consent (LGPD art. 14), we will delete it.

11. Cookies

We only use necessary and preference cookies and local storage. See the Cookie Policy for details.

12. Changes

We may update this policy. The last update date is shown at the top of the page, and material changes will be announced by email or on the platform.