Solow Privacy Policy
Last updated: September 10, 2026
The Portuguese version governs in case of conflict.
This policy explains which personal data SOLOW LTDA (CNPJ 61.879.800/0001-19, Avenida Pref. Osmar Cunha, 416, Cond. Koerich, Apt. Sl. 1108, Quadra 0000, Centro, CEP 88015-100, Florianópolis/SC, Brazil) processes when you use the website solow.app, the server mcp.solow.app and the sign-in and payment pages, and how you exercise your rights under the Brazilian General Data Protection Law (Law 13,709/2018, "LGPD") and, where applicable, other privacy laws such as the GDPR.
Controller: SOLOW LTDA. Data Protection Officer: Everton Marcelino Junior, [email protected].
1. What data we process
We process the minimum needed to provide and bill the service.
| Data | Source | Purpose | Legal basis (LGPD art. 7; GDPR art. 6) |
|---|---|---|---|
| Email address | You, at sign-in | Identify your account, send the sign-in code, receipts and subscription notices | Performance of a contract |
| Sign-in code (stored as a hash, valid for 10 minutes) and attempt count | Generated by us | Confirm the email is yours | Performance of a contract |
| Preferred language | Your app or the website | Answer in your language | Legitimate interest |
| Signup country inferred from the IP address; only the country code is stored for this purpose | Cloudflare, when the account is created | Determine trial availability in Brazil and prevent abuse | Performance of a contract; legitimate interest |
| Customer, subscription and payment identifiers generated by Stripe or Asaas; amount, currency, payment method, dates and status of each charge | Payment processors | Bill, renew, refund and meet tax obligations | Performance of a contract; legal obligation |
| Brazilian tax id (CPF), only when you pay by Pix or card in Brazil | You, at payment | Required by Asaas and the Pix system to issue the charge | Legal obligation; performance of a contract |
| Usage counters (queries this cycle, trial queries, per-minute rate window) | Generated by us | Enforce plan limits and prevent abuse | Performance of a contract; legitimate interest |
| Technical log per query: timestamp, tool name, plan, response code, and a hashed account identifier | Generated by us | Operate, measure and protect the service | Legitimate interest |
| Referral code and who referred whom | You | Credit referral queries | Performance of a contract |
| IP address and browsing data on the website, aggregated and without cookies | Cloudflare Web Analytics | Measure site traffic | Legitimate interest |
What we do not process. We do not store the content of your questions or of your AI application's answers. Query parameters (for example, the ticker requested) pass through the server to fetch the data and are not stored linked to you. We do not store card data. We use no tracking cookies and no advertising pixels.
2. Who we share data with
We share data only with processors needed to run the service, each limited to its function:
| Processor | Role | Data | Location |
|---|---|---|---|
| PARTNR LTDA (Brazil) | Market data provider | Tool name, query parameters and a hashed account identifier (not your email) | Brazil / Google Cloud (US) |
| Stripe, Inc. (US) | International payments | Email, amounts, currency and charge status; card data stays with Stripe | US / EU |
| Asaas Gestão Financeira Instituição de Pagamento S.A. (Brazil) | Payments in Brazil | Name, email, CPF, amounts and charge status | Brazil |
| Cloudflare, Inc. (US) | Hosting of the website and server, database, delivery of sign-in and receipt emails, traffic statistics | All data above, in transit and at rest | Global network; data at rest may be stored outside Brazil |
We do not sell personal data. We do not share it with advertisers. AI application providers (Anthropic, OpenAI, Cursor and others) do not receive your data from Solow; what you type into the application is governed by that provider's policy.
3. International transfers
Cloudflare and Stripe process data outside Brazil. Transfers rely on standard contractual clauses and on those providers' safeguards, under LGPD art. 33 and, where applicable, GDPR chapter V.
4. How long we keep data
| Data | Retention period |
|---|---|
| Account (email, language, signup country, referral) | While the account exists, plus 30 days after a deletion request |
| Sign-in codes | 10 minutes, then deleted |
| Payment records and processor identifiers | 5 years after payment, for tax obligations and legal defense |
| Usage counters | Current cycle plus 12 months, aggregated |
| Technical query logs | 90 days |
| Website traffic statistics | Aggregated, not individually identifiable |
Trial accounts with no payment and no use for 12 months are deleted.
5. Your rights
At any time and free of charge you may request (LGPD art. 18; GDPR arts. 15 to 22):
- confirmation that we process your data, and access to it;
- correction of incomplete or outdated data;
- anonymization, blocking or deletion of unnecessary data;
- portability;
- information about whom we share data with;
- deletion of data processed on the basis of consent;
- withdrawal of consent, where consent is the basis;
- objection to processing based on legitimate interest.
To exercise these rights, write to [email protected] from your account email. We respond within 15 days. Deleting your account ends the subscription; payment records are kept for the legal period. You may also complain to the Brazilian National Data Protection Authority (ANPD) or, if you are in the EU/EEA or UK, to your local supervisory authority.
6. Security
Data in transit is protected by TLS. Sign-in codes are stored as hashes. Access tokens are encrypted and contain neither your plan nor your email. Internal access is limited to people who operate the service. No system is fully secure; in the event of an incident with material risk we will notify you and the relevant authority as required by law.
7. Children
The service is for people aged 18 and over. We do not knowingly process data of minors; if we identify a minor's account, it will be deleted.
8. Changes
Material changes to this policy will be announced by email at least 15 days in advance. The current version is always at solow.app/en/privacy.
9. Contact
SOLOW LTDA, CNPJ 61.879.800/0001-19, Avenida Pref. Osmar Cunha, 416, Cond. Koerich, Apt. Sl. 1108, Quadra 0000, Centro, CEP 88015-100, Florianópolis/SC, Brazil. DPO: Everton Marcelino Junior, [email protected]. Support: [email protected].
Solow is a product operated by SOLOW LTDA with data supplied by PARTNR LTDA. Solow provides data, not investment advice.