Privacy Policy

1. Who we are

The ContoSecretos website (contosecretos.com.br) is an editorial platform for serialized erotic short stories published under the pen name Helena Noir. It is operated by Marcelo Oliveira, with infrastructure, development, and technical control provided by QuickSolutions-ai.com, the company that is also responsible for LGPD compliance.

Controlling company details:
CNPJ 65.270.934/0001-99
Address: Av. Costa Machado, 291 — Conjunto 41, Canto do Forte, Praia Grande / SP
Contact: helenanoircs@gmail.com

This policy applies to anyone who accesses, views, reads, buys, or interacts with content, stories, series, characters, chat, letters, or any other feature of the website.

2. Adult content notice

ContoSecretos publishes adult literature intended exclusively for people over 18. Access is conditioned on prior age confirmation (age gate). If you are a minor, you must not use this website.

3. Data we collect

Registration and identity

• Email and name via Google sign-in (OAuth). We do not store your Google password — only what Google sends us: verified email, name, and photo (optional).
• Pronoun and display name, if you choose to set them up in My library.

Purchases and payments

• Billing email (may differ from your Google email), amount, payment gateway used, and transaction code.
• Card or bank account data never passes through our servers — it is processed directly by the payment gateway you choose.

Reading and interaction

• Which stories you opened, read, finished, or marked as favorites.
• Quotes you saved.
• Reading-page bookmarks.
• Messages exchanged in the chat with fictional characters — stored encrypted at rest. See details in the AI & Chat Policy.
• Letters written to characters or to Helena Noir.

Browsing telemetry (our own analytics, LGPD-safe)

• Session cookie (UUID, 30 days) to recognize the same device across visits. It is not a fingerprinting cookie and is not cross-referenced with any third-party data.
• IP address hashed with salted SHA-256 — we never store your IP in plain text.
• User-agent summary (browser, operating system, device type).
• Approximate country / city (derived from the IP before hashing).
• Pages visited, referrer, UTMs, and approximate reading time.
• We honor your browser's Do Not Track (DNT) signal. If you have DNT turned on, no telemetry is recorded. This applies to our own analytics; the Google Ads tag on /en/publish follows Google's rules, not DNT.

Newsletter (optional)

• Email and date of consent, if you choose to sign up.

Author application (/en/publish form)

If you apply to publish with us through the form at /en/publish, we collect:

• Pen name and/or real name (you choose which to provide)
• Email and/or WhatsApp (at least one, so we can get back to you)
• What you wrote to tell us about yourself
• A link to or excerpt of a story, if you choose to send one
• Confirmation that you are of legal age (18+) and acceptance of this policy
• Light forensics to prevent spam: IP address and browser user agent at the time of submission
• Origin of the visit, if you arrived through an ad or campaign link: Google's click identifier (gclid) and the utm_* parameters that came in the URL. They serve only to let us know which campaign brings in authors that our editorial team actually approves. They do not identify you, and applications that arrive on their own carry none of them.

This data is accessible only to the editorial team, which reviews each application. Texts submitted with an application are not used to train AI models without the author's express consent. If your application does not move forward to author registration, we keep the record for up to 12 months for internal documentation and then discard it.

Active author registration

If your application is accepted and you start publishing under the imprint, the internal registration stores the data needed to pay royalties:

• Full legal name (private, never shown publicly)
• Contact email
• Public byline (pen name)
• Payout details (bank account or payment key) for paying royalties
• Agreed standard royalty percentage

This data is seen only by the platform administrator and authorized editors. Your public byline (pen name or real name, your choice) appears at /en/author/[slug] and on published stories. Everything else stays private.

4. What we DO NOT collect

As a matter of principle, ContoSecretos does not collect:

• Government ID numbers or identity documents — except where an active author's payout details include a tax ID, see section 3
• Credit card numbers or financial passwords
• Full home address
• Biometric, genetic, or health data
• Declared sexual orientation, religion, ethnicity, political opinion
• Precise GPS location
• Data from minors — the age gate is a prerequisite

5. Legal basis for processing

We process your data on the following bases (LGPD Art. 7):

• Explicit consent — you give it when you pass the age gate and use the service. It is also the separate, revocable basis for the Google Ads campaign cookies on /en/publish (section 9): without your acceptance in the cookie notice, they do not exist.
• Performance of a contract — when you buy a story, we need your email to deliver the file.
• Legitimate interest — aggregated telemetry to improve the catalog and prevent abuse/fraud.
• Compliance with a legal obligation — issuing invoices (notas fiscais) when applicable.

6. How we protect your data

• In transit: everything goes over HTTPS/TLS. There are no unencrypted connections.
• At rest: PostgreSQL database (Supabase) with disk encryption. Chat messages are encrypted at the application level before they reach the database.
• Passwords: we do not store passwords — sign-in is exclusively through Google OAuth.
• Internal access: restricted to Marcelo Oliveira and the QuickSolutions-ai technical team under NDA.
• Monitoring: anomalous access attempts are logged and reviewed.

7. Where your data is processed

We use third-party infrastructure subject to privacy standards equivalent to or higher than those required by the LGPD:

• Vercel (hosting and edge functions) — may temporarily replicate data on servers in the United States for regional performance. Under standard contractual clauses for international transfers.
• Supabase (database and storage of reading files) — São Paulo region (Brazil).
• Google — for two distinct and separate purposes: authentication (OAuth), at sign-in; and Google Ads, exclusively on the /en/publish page, which runs a paid campaign to attract new voices to the imprint. The Ads tag does not exist on any other page and is only activated with your consent — see section 9. No reading, purchase, chat, or letter data is shared with Google in either case.
• Resend — sending transactional emails (download link, sign-in magic link, author application confirmation, editorial review notifications), when applicable.
• OpenAI, DeepSeek, and/or other language model providers — used by the character chat. See details in the AI & Chat Policy.
• Payment gateways (for purchases on the Portuguese-language site) — receive only what is necessary to process the purchase. Each has its own privacy policy. English editions are sold by ebook stores, which handle payment under their own policies.

8. Data sharing

ContoSecretos does not sell personal data. Sharing happens only:

• With the infrastructure providers listed above, strictly as needed to operate the service.
• In response to a court order, a competent authority, or a legal obligation.
• In aggregated and anonymized form, in public reports about platform usage — without identifying readers.
• With Google Ads, subject to consent and only from the /en/publish page: the signal that a visit coming from an ad turned into an application. This is what lets us measure whether the author recruitment campaign pays for itself. Nothing about reading, purchases, or conversations with characters goes along with it. Without consent, this signal is sent anonymously and in aggregate, with no cookie and no click identifier. If in the future we report to Ads which applications actually turned into authorship, this will use only the click identifier stored at submission, and only for those who consented — never your name, email, or the text you wrote.

9. Cookies

We use only essential and functional cookies:

• Reader session (1 UUID, 30 days).
• Age-gate confirmation preference.
• Google OAuth cookies during sign-in.

We do not use social media cookies or cross-site behavioral tracking, and no reading, purchase, or chat page loads any advertising cookie.

Exception — the /en/publish page, subject to consent. This page, and only this page, runs a paid Google Ads campaign. If — and only if — you accept in the cookie notice, Google sets _gcl_au and _gcl_aw (90 days) to measure whether the ad turned into an application. The legal basis here is your consent (LGPD Art. 7, I), not legitimate interest.

We implement Google's Consent Mode v2: before you give any answer, and forever if your answer is “essential only,” the tag runs switched off — it sets no cookie and does not receive the ad click identifier.

You can withdraw consent at any time, in the “Your choice” section of the Cookie Policy, with the same number of clicks it took to accept. The effect is immediate. Your choice is valid for 6 months, after which we ask again.

10. Retention period

• Browsing sessions (detailed telemetry): 30 days. Anonymous aggregates are kept indefinitely.
• Purchases and customer emails: for as long as the business relationship lasts + 5 years for tax obligations.
• Chat messages: for as long as the account exists, unless you request deletion (see rights below).
• Newsletter: for as long as you want to receive it + 6 months of unsubscribe records.

11. Your rights (LGPD Art. 18)

You may, at any time, exercise the rights to:

• Confirmation that processing takes place
• Access to the data we hold about you
• Correction of incomplete, inaccurate, or outdated data
• Anonymization, blocking, or deletion of unnecessary data or data processed in noncompliance
• Portability of your data (structured format)
• Deletion of data processed with your consent
• Information about whom we share data with
• Revocation of consent

To exercise any of these rights, send an email to helenanoircs@gmail.com. We respond within 15 business days.

12. Children and adolescents

ContoSecretos is intended for adults. We do not knowingly process data from anyone under 18. If we identify an account belonging to a minor, the account is deleted and the email is blocked.

13. Security incidents

In the event of an incident that may pose a significant risk or harm to data subjects, we notify the National Data Protection Authority (ANPD, Brazil's data protection authority) and the affected data subjects within a reasonable time, as required by the LGPD.

14. Changes to this policy

We may update this policy. Versions and dates are recorded at the top. Significant changes are communicated by email (to registered users) or by a prominent notice on the website for 30 days.

15. Contact and DPO

Data Protection Officer (DPO): QuickSolutions-ai.com
CNPJ: 65.270.934/0001-99
Address: Av. Costa Machado, 291 — Conjunto 41, Canto do Forte, Praia Grande / SP
Email: helenanoircs@gmail.com
Operations lead: Marcelo Oliveira