PicFlow Privacy Policy

Last updated: July 27, 2026

This policy explains, in plain language, what data PicFlow uses, why we use it, who may receive it, and which choices you have.

In short: your files are used to create and deliver your Energy Cards. We do not sell your personal data. Measurement cookies are enabled only if you allow them.

1. Who is responsible for PicFlow

PicFlow is a product operated exclusively by OLLIELAB SOLUCOES EM TECNOLOGIA E INOVACAO LTDA, Brazilian company registration (CNPJ) 53.871.680/0001-85, headquartered at Rua Doutor Francisco Pati, 322, Vila São Francisco, São Paulo/SP, 05352-090, Brazil.

Under Brazil’s General Data Protection Law (LGPD), Ollielab is the controller of personal data processed to provide PicFlow.

2. Data we use

Depending on how you use PicFlow, we may process:

  • Account data: name, email, profile picture, language and information required for sign-in.
  • Uploaded content: images, videos, audio, text and information you provide to create an Energy Card.
  • Creation results: generated art, title, description, detected vibration, artistic style, translations and other Energy Card data.
  • Usage and security data: IP address, browser, device, visited pages, date and time, error logs, access attempts and events needed to protect the service.
  • Interactions: shares, views, preferences and support requests.
  • Cookie preference: your decision to allow or reject Analytics measurement.

Example: when you upload a travel video, PicFlow must receive it to analyze it, create the artwork and assemble the Energy Card. The file and its results may include people, voices, locations or other personal information.

The current launch is free and has no active checkout. If payments are introduced, we will update this policy and the information shown before a purchase.

3. Why and how we use data

We use personal data to:

  • create, store, organize and share Energy Cards;
  • authenticate accounts and keep the service secure;
  • process media and generate art, text and translations with artificial intelligence;
  • provide support and service-related communications;
  • prevent fraud, abuse, illegal content and violations of the Terms;
  • measure performance and improve PicFlow, where measurement requires consent and you have allowed it;
  • comply with legal obligations and valid authority requests.

Depending on the situation, our legal grounds may include performance of a contract or steps requested by you, consent, compliance with law, exercise of legal rights and legitimate interests assessed against your rights.

4. Artificial intelligence

PicFlow uses AI providers to analyze uploaded content and produce creative results. Parts of a file, instructions and necessary context may be sent to those providers.

Example: a flower photo may produce the description “serene and vibrant energy” and abstract artwork. This is an automated creative interpretation, not a scientific, medical or psychological assessment.

AI results may contain errors or unexpected similarities. Review them before publishing or relying on them. Do not upload unnecessary sensitive data, confidential documents or third-party content without permission.

5. Sharing and visibility

An Energy Card may remain private or be accessible by link, depending on the options available in the product. If you create a shareable link, anyone who receives it may open and forward it.

Example: if you send a link through WhatsApp, the recipient may reveal the Energy Card and forward it to someone else. Removing a publication from PicFlow does not delete copies or screenshots already made outside the platform.

Sharing buttons may open WhatsApp, Instagram, LinkedIn, YouTube or other services. Once you leave PicFlow, the selected service’s policies also apply.

6. Who may receive data

We share only what is needed with providers supporting:

  • hosting, databases, storage and media delivery;
  • authentication and security;
  • AI analysis and generation;
  • error monitoring and, with your permission, Analytics;
  • support and operational communications;
  • compliance with legal obligations.

Some providers may process data outside Brazil. Where this occurs, we seek mechanisms and safeguards compatible with the LGPD.

We do not sell your personal data.

7. Cookies and similar technologies

We use two categories:

  • Necessary: keep sign-in, security, language and essential preferences working. They cannot be disabled in the panel because the service depends on them.
  • Measurement and Analytics: help us understand visited pages and performance. Google Analytics loads only after explicit permission.

On your first visit, you may accept all, reject optional, or configure. Later, use Manage cookies to change your choice. If you withdraw permission, future measurement stops; data already processed may remain for the applicable provider retention period or a legal obligation.

8. How long we keep data

We keep data for as long as needed to provide the service, maintain security, comply with law and exercise legal rights. The period varies by data type and context.

  • Content and Energy Cards remain while your account or the relevant feature is active, unless deletion is requested or retention is required.
  • Temporary files and technical records are deleted or anonymized when no longer needed.
  • Backups may remain for a limited additional period until they are safely replaced.

When you delete content or an account, we begin removal from active systems, subject to temporary backups, fraud prevention and legally required retention.

9. Your rights

Under the LGPD, where applicable, you may request:

  • confirmation and access;
  • correction of incomplete or inaccurate data;
  • information about sharing;
  • anonymization, blocking or deletion;
  • portability, subject to regulation;
  • withdrawal of consent and information about its consequences;
  • objection to unlawful processing;
  • review of decisions made solely by automated means, where applicable.

We may request information to confirm your identity before fulfilling a request.

10. Security and incidents

We use technical and administrative measures proportionate to risk, including access controls, transmission protection, security logs and need-to-know restrictions. No system is completely immune to incidents.

If an incident creates relevant risk or harm, we will take the steps required by law, including notice to the ANPD and affected individuals when applicable.

11. Minimum age

PicFlow is intended for people aged 18 or older. If we identify an account created against this rule, we may suspend access and remove data as permitted by law.

12. Changes to this policy

We may update this policy to reflect changes in the product, providers or law. We will provide appropriate notice of material changes and update the date above.

13. Contact

For questions, support or privacy rights requests: