Privacy Policy
anatomic Privacy Policy — version 0.4 Effective date: October 31, 2026
This policy explains what personal data anatomic processes, why, who we share it with and how long we keep it. It follows Brazil's General Data Protection Law (LGPD).
1. Who we are
The controller of your data is SIMBIO LABS LTDA, CNPJ 69.798.123/0001-16, headquartered at Rua José Bonifácio, 1929, Centro, São Carlos, SP, 13560-610, Brazil ("Simbio", "we", "us"). Our data protection officer is SIMBIO LABS LTDA, who can be reached at privacidade@simbiolabs.com.br.
2. Data we process
a) Account: name, email and password (we only keep an encrypted hash of the password, never the password itself). b) Age verification: the verification result and date (section 4). c) Access logs: kept for the period required by law (section 8). d) Service use: prompts, uploaded images, generated images, image fingerprints (hashes) and generation parameters. e) Acceptances: each acceptance of the terms, with version, date and time, IP address, browser and language. f) Purchases: pack, amount, date and the payer details our third-party payment processor passes to us (name, email, country and, for Pix, CPF). We do not receive your full card number. g) Identity verification (idproof): document video and photos, the printed-portrait crop and fields read from the document (name, number, CPF and MRZ) (section 4.1).
3. Why we use it and on what legal basis
| Purpose | Data | Legal basis (LGPD) |
|---|---|---|
| Create and run your account, generate images, provide support | a, d | Performance of a contract (art. 7 V) |
| Verify age (anatomic is for adults only) | b | Legal obligation (art. 7 II and art. 11 II "a"), under Brazil's ECA Digital (Law 15,211/2025, art. 9) |
| Verify that an identity document looks authentic | g | Fraud prevention in electronic identification (art. 11 II "g"); when this check is on the age-verification path, also legal obligation (art. 7 II and art. 11 II "a") |
| Keep access logs | c | Legal obligation (Marco Civil da Internet, art. 15) |
| Enforce the rules, monitor use and trace images | d, c | Legitimate interest in keeping the platform safe and exercise of legal rights (art. 7 VI and IX) |
| Prove acceptance of the terms | e | Exercise of legal rights (art. 7 VI) |
| Billing, tax records and fraud prevention | f | Contract, legal obligation and legitimate interest (fraud prevention) |
| Newsletters, if we ever send them | Consent, which you can withdraw at any time |
Adult prompts and images may reveal information about sex life, which the LGPD treats as sensitive data. We process it with restricted access, only to provide the service you signed up for and to enforce the rules (art. 11 II "d").
Improving our models. In the future, we may use some generated images, always anonymised, to improve our models; anonymised data is not personal data (LGPD, art. 12). You can object at any time by writing to privacidade@simbiolabs.com.br (art. 18 §2), and your objection applies from then on. Photos of real people uploaded as references are never included. We do not use your images in advertising or promotion without your consent.
Today we only send service emails (receipts and account notices).
4. Age verification
Access to anatomic requires age verification through a reliable mechanism. Age-verification data is processed by SIMBIO LABS LTDA itself (controller), through its own solution anatomic ageproof. There is no external processor for age verification.
4.1 Identity verification (idproof)
When anatomic needs to check whether an identity document looks real and untampered, we use our own solution anatomic idproof, operated by SIMBIO LABS LTDA (controller). The verdict is advisory: idproof does not block or approve access by itself.
We collect a short tilt video of the document, photos of the front and back, a crop of the portrait printed on the document, and the fields read from it (name, number, CPF and MRZ). The printed portrait is biometric data (LGPD, art. 5 II) and is used only for authenticity checks. idproof does not receive your selfie, does not do face matching and does not estimate your age from the portrait.
Temporary storage is on Supabase. Processing of the document images may run on Runpod (Runpod, Inc., USA), including outside Brazil.
idproof retention periods are in section 8.
5. Cookies
We only use necessary cookies: login and session cookies. We do not use advertising or tracking cookies.
6. Who we share data with
We share data only with companies that help us run anatomic (processors), and only what they need:
- Supabase: database, login and storage;
- Vercel: web app hosting;
- Runpod (Runpod, Inc., USA): image processing;
- Resend: email delivery;
- Cloudflare: network and security;
- Our third-party payment processor: payments. It handles card data as an independent controller, under its own rules.
Authorities receive data only when the law requires it: account details to competent administrative authorities where the law allows, and access logs, prompts or images only under a court order.
We do not sell personal data and we do not use your data for advertising.
7. International transfers
Some processors store or process data on servers outside Brazil, such as in the United States and Europe. In those cases we rely on the safeguards in art. 33 of the LGPD, such as the standard contractual clauses approved by the ANPD or equivalent mechanisms.
8. How long we keep data
| Data | Retention |
|---|---|
| Uploaded and generated images | While the account exists; deleted when the account is deleted |
| Access logs | For the period required by law |
| Generation history (prompts, parameters, hashes) | While the account exists (active or inactive) and for 6 months after deletion |
| Account, purchases, age verification and acceptances | 5 years after account deletion |
| Document video and photos (idproof) | Deleted when the result is ready; the printed portrait may be kept up to 5 minutes |
| Abandoned idproof session | Up to 30 minutes |
| Name, document number, CPF and MRZ (idproof) | Up to 30 days or until the product that requested verification fetches the portrait |
| idproof verdict and image-free audit | Up to 12 months |
9. Closing or deleting your account
Closing your account is a simple request to contato@simbiolabs.com.br. The account becomes inactive, your data is kept as in an active account, and unused credits stay frozen. Later, you can ask us to reactivate the account or request a refund of your paid unused credits.
Deleting your account and data is your right under the LGPD, requested separately by emailing privacidade@simbiolabs.com.br. We reply within 15 days. Before deleting, we remind you that you can request a refund of your paid unused credits. On deletion, we delete your images and profile. We keep only what the law requires, for the legal period, counted from deletion. In our reply, we tell you what was kept, why and until when.
10. Your rights
Under the LGPD (art. 18), you may ask for: confirmation that we process your data; access; correction; anonymisation, blocking or deletion of unnecessary or unlawfully processed data; portability; deletion of data processed on the basis of consent; information about who we share data with; and review of automated decisions. You may also withdraw consent and object to processing.
Write to privacidade@simbiolabs.com.br. We may confirm your identity before replying. If you are not satisfied, you can complain to Brazil's National Data Protection Authority (ANPD).
11. Security
We use encryption in transit, encrypted password storage, role-based access. No system is perfect; if an incident poses a relevant risk to you, we will notify you and the ANPD.
12. Minors
anatomic is not for anyone under 18. If we find that an account belongs to a minor, it is blocked and deleted. We keep only what the law requires, such as access logs for the legal period and what is needed to respond to authorities.
13. Changes to this policy
This policy is versioned and dated. If we make a material change, we will tell you in the app or by email before it takes effect.
14. Contact
Data protection officer: SIMBIO LABS LTDA — privacidade@simbiolabs.com.br Support: contato@simbiolabs.com.br Address: Rua José Bonifácio, 1929, Centro, São Carlos, SP, 13560-610, Brazil