1. Introduction
Cantivy ("we," "our," or "Cantivy") values its users’ privacy and is committed to protecting the personal data you provide to us. This Privacy Policy describes how we collect, use, store, and protect your information when you use our platform, available at cantivy.com and in our mobile app.
This policy complies with Brazil’s General Data Protection Law (LGPD — Law No. 13.709/2018) and other applicable legislation. By using our services, you agree to the practices described in this document.
If you do not agree to the terms of this policy, please do not use our services. If you have questions, contact us at contato@cantivy.com.
2. Data We Collect
We collect different categories of information depending on how you interact with our platform:
2.1 Data You Provide
- Account data: name, email address, password (stored in encrypted form), and profile photo, when applicable.
- Payment data: billing information, including the name on the card and billing address. Credit card data is processed directly by our payment provider and is not stored on our servers.
- Generated content: text prompts you enter to generate music, musical style preferences, and generated music you choose to save.
- Communications: messages you send us by email or through the contact form.
2.2 Data Collected Automatically
- Usage data: pages visited, features used, access frequency, session duration, and history of interactions with the platform.
- Technical data: IP address, browser type and version, operating system, device identifiers, time zone, and language settings.
- Performance data: error logs, crash reports, and diagnostic data that help us improve our services.
2.3 Third-Party Data
If you choose to create an account using third-party authentication services such as Google or Apple, we will receive the basic profile information you authorize us to share, as defined in those providers’ privacy policies.
3. How We Use Your Data
We use your personal data for the following purposes, based on the stated legal bases:
3.1 Providing the Service (Contract Performance)
- Create and manage your account on the platform.
- Process and generate music based on your prompts.
- Process payments and manage subscriptions.
- Provide technical support and customer service.
- Send transactional communications such as registration confirmations, receipts, and account notifications.
3.2 Continuous Improvement (Legitimate Interest)
- Analyze usage patterns to improve the quality of generated music.
- Identify and correct technical problems on the platform.
- Develop new features and functionality.
- Conduct internal research on the musical preferences of Brazilian users.
3.3 Marketing Communications (Consent)
With your explicit consent, we may send newsletters, platform news, and special offers. You can unsubscribe from these communications at any time using the unsubscribe link included in each email.
3.4 Compliance with Legal Obligations
We may use your data to comply with obligations imposed by law, regulations, or court orders.
5. Data Sharing
Cantivy does not sell, rent, or trade your personal data with third parties. We may share your information only in the following circumstances:
- Service providers: We share data with companies that help us operate the platform, such as cloud infrastructure providers, payment processors, and analytics tools. These partners are contractually required to protect your data and use it only for the purposes we specify.
- Corporate transfers: In the event of a merger, acquisition, or sale of company assets, your data may be transferred. We will notify you before any transfer that substantially changes how your data is used.
- Legal obligations: We may disclose your data when required by law, legal proceedings, a court order, or a government request.
- Protection of rights: We may disclose information when we reasonably and in good faith believe disclosure is necessary to protect our rights, the safety of our users, or the general public.
6. Third-Party Services
Our platform integrates third-party services that have their own privacy policies. We recommend that you read them:
- Google Analytics: used to analyze traffic and behavior on the platform. Learn more at policies.google.com/privacy.
- Stripe: payment processor for subscriptions. Learn more at stripe.com/br/privacy.
- Amazon Web Services (AWS): cloud infrastructure where our servers operate. Learn more at aws.amazon.com/pt/privacy.
Cantivy is not responsible for these third parties’ privacy practices. When you use features that depend on these services, you are also subject to their privacy policies.
7. Security
We implement technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:
- Encryption of data in transit using TLS (Transport Layer Security).
- Password encryption using secure hashing algorithms (bcrypt).
- Role-based access control to limit internal access to data.
- Continuous security monitoring and intrusion detection.
- Periodic security audits.
Despite our efforts, no data transmission or storage system is 100% secure. If a security incident affects your data, we will notify you as required by the LGPD.
8. Data Retention
We retain your personal data for as long as necessary to fulfill the purposes described in this policy, unless the law requires a longer retention period.
- Account data: retained while your account is active. After the account is deleted, the data is removed within 90 days, except where retention is required by law.
- Payment data: retained for the period required by Brazilian tax and fiscal legislation (generally 5 years).
- Technical logs: retained for up to 12 months for security and diagnostic purposes.
- Generated music: retained until you delete it or your account is closed.
9. Your Rights (LGPD)
Brazil’s General Data Protection Law (LGPD) guarantees you the following rights regarding your personal data:
- Confirmation and access: Confirm whether we process your data and obtain a copy of the information we hold about you.
- Correction: Request correction of incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion: Request anonymization, blocking, or deletion of data that is unnecessary, excessive, or processed in violation of the LGPD.
- Portability: Request the transfer of your data to another service or product provider.
- Deletion: Request deletion of personal data processed based on your consent.
- Withdrawal of consent: Withdraw your consent at any time without affecting the lawfulness of processing carried out previously.
- Objection: Object to data processing when it is based on other legal grounds, if the LGPD is not being complied with.
- Information: Be informed about the public and private entities with which we share your data.
To exercise any of these rights, send a request to contato@cantivy.com. We will respond within 15 business days, as required by the LGPD.
10. Minors
Our services are intended for people aged 13 or older. We do not knowingly collect personal data from children under 13. If you are responsible for a child and believe they provided us with data without your authorization, contact us at contato@cantivy.com so that we can delete the information.
Users between 13 and 18 must have the consent of a legal guardian to use our paid services.
12. Your Rights Under the LGPD and How to Exercise Them
Brazil’s General Data Protection Law (Law 13.709/2018) grants you a set of rights over the personal data we process — in practice, for Cantivy, this consists of the email address you provide when joining the waitlist and browsing data collected by Microsoft Clarity.
- Confirmation and access — know whether we process any of your data and receive a copy of it.
- Correction — correct incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion — of data that is unnecessary, excessive, or processed unlawfully.
- Portability — receive your data in a structured format to take to another provider.
- Deletion of data processed with consent — delete what you authorized whenever you choose.
- Information about sharing — know which public and private entities we share data with.
- Withdrawal of consent — withdraw your authorization at any time, at no cost.
To exercise any of these rights, write to contato@cantivy.com with the subject "LGPD." We respond within 15 calendar days. The request must come from the same registered email address — we do not ask for an ID document or photo because we do not have those data to compare and do not want to start collecting them.
Regarding retention periods: we keep the waitlist email until you request its removal or until the product is discontinued, whichever comes first. Microsoft retains Clarity behavioral data according to its policy, currently for 13 months, and the data we receive is always aggregated. Cookie consent is stored only in your own browser under the key cantivy_cookie_consent and disappears when you clear site data — we do not keep a copy. To learn more about who operates the service, see the about Cantivy page.
13. Changes to This Policy
We may periodically update this Privacy Policy to reflect changes in our practices, services, or applicable law. We will notify you of significant changes by email or through a prominent notice on our platform.
The "last updated" date at the top of this document indicates when the policy was last reviewed. We recommend reviewing this policy periodically.
12. Contact
If you have questions, concerns, or requests related to this Privacy Policy or the processing of your personal data, contact our Data Protection Officer (DPO):
You also have the right to file complaints with Brazil’s National Data Protection Authority (ANPD) at www.gov.br/anpd.