Privacy policy
1. Controller
The controller for all data processing related to Tuca is Semeia Lab Serviços Ltda. Tuca is a brand of this company.
- SEMEIA LAB SERVIÇOS LTDA.
- Rua Visconde de Inhaúma, nº 134, Sala 2001 – Parte
- Rio de Janeiro, RJ, CEP 20.091-901, Brazil
- CNPJ: 66.940.215/0001-09
Privacy contact: tuca@semeialab.com
Encarregado (data protection officer under the LGPD): Simon Hirter
2. Scope
This policy covers the Tuca website https://tuca.guide, the Tuca chat service on WhatsApp and the purchase of the Tuca Pass, Carnival Pass and bundle. Where Meta (WhatsApp) or Stripe act as controllers themselves, their own privacy policies also apply.
3. Data we process
We only process what we need for the chat, your pass and payment. We don't need passport, ID or health data – please don't send such details in the chat.
| Area | Data | Source |
|---|---|---|
| Website visit | IP address, browser, time (server logs) | automatic |
| Purchase | name, email, pass purchased, purchase date, payment status; card details only at Stripe | you, via Stripe |
| WhatsApp chat | phone number, WhatsApp profile name, messages, timestamps | you |
| Pass status | pass type, start and expiry date, free questions used | generated by us |
| Requests to us | content of your email | you |
| Waitlist | email address, interest (Tuca Pass, Carnival Pass or both), time of sign-up and confirmation | you |
4. Purposes and legal bases
| Purpose | GDPR (EU) | LGPD (Brazil) |
|---|---|---|
| Chat answers, pass management, payment processing | performance of a contract, Art. 6(1)(b) | Art. 7 V (performance of a contract) |
| Accounting and tax obligations | legal obligation, Art. 6(1)(c) | Art. 7 II (legal obligation) |
| Security, abuse and fraud prevention, improving the knowledge base | legitimate interest, Art. 6(1)(f) | Art. 7 IX (legitimate interest) |
| Waitlist and launch updates by email (Brevo) | consent, Art. 6(1)(a) | Art. 7 I (consent) |
For people in Switzerland, the processing principles of the Federal Act on Data Protection (FADP) apply; the purposes above apply accordingly.
5. Service providers and recipients
We only share data with providers we need to run Tuca. We don't sell your data or share it for advertising.
| Provider | Task | Role | What matters for you |
|---|---|---|---|
| Meta Platforms (WhatsApp Cloud API) | delivers the chat messages | processor | messages stored for at most 30 days, not used for advertising |
| Anthropic (Claude) | generates the answers to your questions | processor | inputs and outputs deleted within 30 days |
| Stripe | processes payments | controller or processor, depending on the activity | we never see your card details |
| Website hosting (Hostinger) | runs the website | processor | server logs |
| Bot server or database (Hetzner, Helsinki) | stores our copy of the chats and your pass status | processor | deletion as in section 7 |
| Plausible Analytics | measures website traffic | processor | no cookies and no personal data; servers in Germany |
| Brevo | manages the waitlist and sends confirmation and launch emails | processor | EU provider based in Paris; sign-up confirmed by email (double opt-in), unsubscribe anytime |
6. International transfers
Your data is processed in Brazil and, through our providers, also in the USA and other countries. For transfers from the EU and Switzerland we rely on adequacy decisions or the standard contractual clauses of each provider. Transfers from Brazil follow the LGPD rules on international transfers.
7. Retention
| Data | How long |
|---|---|
| Our copy of your chats | up to 30 days after the pass expires, immediately on request |
| Chats from free use without purchase | 30 days after the last message, immediately on request |
| Messages at Meta (WhatsApp) | at most 30 days, technically needed for delivery |
| Inputs and outputs at Anthropic | deleted within 30 days; longer only for usage policy violations or legal obligations |
| Purchase and invoice data | at least 5 years from the year following the purchase (Arts. 173 and 195 CTN); electronic tax documents up to 11 years under Brazilian tax law |
| Website server logs | [add host's period] |
| Waitlist (Brevo) | until you unsubscribe, at the latest [12 months after the last email] |
8. AI-generated answers
Tuca answers your questions with Claude, an AI model by Anthropic, based on our verified knowledge base. Your chats are not used to train AI models. Answers may contain errors despite our checks. For safety, health and legal matters, official sources take precedence. There are no automated decisions with legal effect on you.
9. Your rights
You can request access, correction, deletion, restriction and portability of your data at any time, object to processing and withdraw consent – for the waitlist also anytime via the unsubscribe link in every email. Write to tuca@semeialab.com; we respond within [add period].
You can also complain to a supervisory authority:
- Brazil: Autoridade Nacional de Proteção de Dados (ANPD)
- EU: the data protection authority in your country of residence
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC)
10. Further notes
- Security: transmission is encrypted (HTTPS, WhatsApp encryption). Only people at Semeia Lab who need it for the service can access chats.
- Sensitive data: please don't send passport, credit card or health details in the chat.
- Minimum age: Tuca is intended for people aged 18 and over.
- Cookies: the website uses no tracking cookies. For audience measurement we use Plausible Analytics (EU-hosted, without cookies and without personal data). When you pay, Stripe sets technically necessary cookies on stripe.com for fraud prevention.
- Changes: we update this policy when the service changes. The current version on the website applies.