Privacy Policy
Last updated: 19 May 2026.
Who we are
DuoCast is operated from Brazil. For LGPD subjects, we are the “controlador”. Data Protection Officer: privacidade@duocast.com.br.
What we collect
- Account data — name, email, hashed password, plan slug, terms-accepted timestamp.
- Show / episode content — what you create on the platform, including topics, scripts, voice / avatar IDs, and generated media.
- Provider call metadata — for cost meters: provider name, stage, estimated cost. We do not log raw provider responses.
- Billing — handled by Stripe; we receive customer/subscription IDs but never your full card number.
- Cookies — required session cookies for auth, plus a locale preference cookie. No third-party tracking by default.
Subprocessors
We share the minimum necessary data with these subprocessors to operate the service:
- Neon (Postgres hosting)
- Cloudflare R2 (asset storage)
- Vercel (hosting)
- OpenAI / Anthropic (script generation, when configured)
- ElevenLabs (voice synthesis)
- D-ID / HeyGen / Tavus / Hedra (avatar video, opt-in)
- Shotstack (video assembly)
- Stripe (payments)
- Resend (transactional email)
- Sentry (error monitoring)
Why we process data
- To provide the service (legal basis: contract).
- To send transactional + safety emails (legal basis: legitimate interest).
- To bill you (legal basis: contract).
- To comply with our legal obligations.
Your rights (LGPD / GDPR)
You have the right to access, correct, delete, port, or restrict processing of your data. Email privacidade@duocast.com.brand we will respond within 15 days. You may also lodge a complaint with the ANPD (Brazil) or your local data protection authority.
Retention
We keep account data while the account is active and for up to 30 days after deletion (legal/accounting holds may extend retention for billing records up to 5 years per Brazilian tax law).
Children
DuoCast is not intended for users under 13. Content created on DuoCast targeting children must use child-safe scenes and styles configured in the show settings.
International transfers
Some subprocessors are based outside Brazil/EU; we use the providers' Standard Contractual Clauses where applicable.