Legal document · LGPD

Sub-processors

Prolytiq uses the processors listed below to provide product functionality. Under the LGPD (Lei Geral de Proteção de Dados, Brazil's General Data Protection Law, Law 13.709/18), we publicly disclose who processes personal data on our behalf, for what purpose, in which jurisdiction, and where to find their policies and DPAs (Data Processing Agreements).

Last reviewed: 2026-05-14

Vercel, Inc.

Purpose: Hosting of the web application (Next.js), serverless functions, edge CDN, runtime logs.
Data processed: Request logs (IP anonymized to /24, user-agent, paths), inline payloads during function execution.
Jurisdiction: United States (Delaware), with global edge POPs.
Privacy: https://vercel.com/legal/privacy-policy
DPA: https://vercel.com/legal/dpa

Supabase, Inc.

Purpose: Postgres database (user data, projects, audit records), authentication (Supabase Auth), file storage (Storage), optional realtime.
Data processed: Registration data (name, email, specialty, institution), project content, article PDFs, audit logs.
Jurisdiction: United States (Delaware), database in us-east-1 (AWS).
Privacy: https://supabase.com/privacy
DPA: https://supabase.com/legal/dpa

Anthropic PBC

Purpose: AI model provider (Claude). Processes prompts/texts submitted through the screening, extraction, critical appraisal, and synthesis features.
Data processed: Text content of scientific articles and prompts generated by the platform. No user personal data is sent.
Jurisdiction: United States (California).
Privacy: https://www.anthropic.com/legal/privacy
DPA: https://www.anthropic.com/legal/dpa

Stripe, Inc.

Purpose: Payment processing, subscription management, invoices, billing communication.
Data processed: Email, name, card data (PCI scope handled by Stripe, never touches Prolytiq), billing address, transaction history.
Jurisdiction: United States (Delaware) and Ireland (Stripe Payments Europe Ltd, EU processing).
Privacy: https://stripe.com/privacy
DPA: https://stripe.com/legal/dpa

Resend, Inc.

Purpose: Transactional email delivery (account confirmation, data export notifications, password recovery, security alerts).
Data processed: Recipient email address, transactional email content.
Jurisdiction: United States (Delaware).
Privacy: https://resend.com/legal/privacy-policy
DPA: https://resend.com/legal/dpa

Cloudflare, Inc.

Purpose: CDN, authoritative DNS, WAF (Web Application Firewall), DDoS protection.
Data processed: Requester IP, request headers, traffic patterns (no TLS payload inspection).
Jurisdiction: United States (Delaware), with global PoPs.
Privacy: https://www.cloudflare.com/privacypolicy/
DPA: https://www.cloudflare.com/cloudflare-customer-dpa/

Google LLC

Purpose: OAuth (Sign in with Google), Google Workspace (admin@prolytiq.com), optional Google Drive for project attachments.
Data processed: User's Google email, optional profile photo, OAuth tokens (email + profile scope).
Jurisdiction: United States (California).
Privacy: https://policies.google.com/privacy
DPA: https://workspace.google.com/terms/dpa_terms.html

International data transfers

Several of the processors listed above process data outside Brazil (United States and European Union). Under the LGPD, these transfers take place by means of:

Performance of a contract entered into by the data subject (use of the platform).
Specific contractual clauses with the processor (DPAs linked above).
The processors' adherence to principles equivalent to those of the LGPD (EU GDPR, California CCPA).

Changes to this list

We update this page whenever we add or remove a sub-processor. Material changes (a new processor, a significant change of purpose or jurisdiction) are communicated to affected users by email at their registered address, with at least 30 days' notice when applicable.

DPO (Encarregado) contact

For questions about data processing or sub-processors, or to exercise your rights: admin@prolytiq.com.

You can also export your data or delete your account at any time at /settings/privacy.