Privacy Policy

Last updated: 10/10/2026

This is a courtesy translation. In case of any discrepancy, the Portuguese version prevails.

This policy explains, in plain language, what personal data Gira processes, for what purpose, who it shares it with, how long it keeps it, and how you exercise your rights. It follows Brazil's General Data Protection Law (Law 13,709/2018, “LGPD”), Brazil's Internet Civil Framework (Marco Civil da Internet, Law 12,965/2014), and the Brazilian Consumer Protection Code. For visitors from the European Economic Area and the United Kingdom, we also observe the principles of the GDPR.

Who the controller is

The controller of the data processed on Gira (girapdf.com.br) is [LEGAL NAME], registered under CNPJ No. [CNPJ], located at [FULL ADDRESS]. General contact: [email protected].

Data Protection Officer (DPO)

The Data Protection Officer (DPO) is [DPO NAME], who can be reached by email at [email protected] or via [email protected]. This is the channel for exercising your rights, asking questions about this policy, and submitting complaints.

What data we process, why, and on what legal basis

Registration data (name, email, password stored only as an irreversible hash, plan): creating and maintaining your account and delivering the plan you purchased. Legal basis: performance of a contract (art. 7, V).
Sign in with Google or Microsoft (name, email and, if available, profile photo, received from the provider you chose): authenticating you without creating a password. Legal basis: performance of a contract (art. 7, V). We don't receive your password for these services.
Uploaded files (documents and images, including any personal data within them): running the tool you requested (convert, compress, protect, sign, extract text and the like). Legal basis: performance of a contract (art. 7, V). We don't read the content for any other purpose.
Text sent to AI tools: to generate the summary or translation you requested, only after you confirm on screen. Legal basis: performance of a contract, with a prominent notice and express confirmation before each use (see “Artificial intelligence”).
Access logs (IP address, date and time with time zone, page accessed, and browser): to comply with the retention obligation of Brazil's Internet Civil Framework (art. 15) and protect the service against fraud and abuse. Legal basis: compliance with a legal obligation (art. 7, II) and legitimate interest in security (art. 7, IX).
Visit statistics (how many pages were viewed per hour and how many different browsers visited each day): measuring site usage. It uses no cookies and doesn't store your IP address: the address and browser become a code that changes every day (with a random daily key) and is deleted within 2 days; after that, only totals remain. Legal basis: legitimate interest (art. 7, IX).
Usage count (number of tasks, tools used, date and time; for visitors without an account, also the IP address): applying each plan's limits and free usage. Legal basis: performance of a contract and legitimate interest in preventing abuse of the free plan.
Billing data (name, email, plan, amount, date and transaction ID; card details stay with the payment provider, not with us): receiving payments, issuing tax invoices and meeting tax obligations. Legal basis: performance of a contract and legal obligation.
Acceptance record (date, time, and version of the terms accepted): to prove what was accepted and when. Legal basis: regular exercise of rights (art. 7, VI) and legal obligation.
Customer support (messages exchanged by email or WhatsApp): responding to requests, questions and complaints. Legal basis: performance of a contract and regular exercise of rights.
Reviews (rating, optional comment, tool, language and date, linked to your account or, without an account, to a browser code): improving the tools and, only if you allow it and moderation approves, showing the comment on the site with your first name. Legal basis: legitimate interest (art. 7, IX) and, for publication, consent (art. 7, I). They are included in “Download my data” and deleted with the account.
Referral program (link between the invite link and the account that signed up): to grant referral benefits. Legal basis: performance of a contract.
Personalized ads (Google cookies and identifiers, only for visitors and Free accounts on content pages): showing ads based on your interests. Legal basis: consent (art. 7, I), which you give or refuse in the ad notice and can withdraw at any time.

We do not intentionally process sensitive personal data. If a document you upload contains this type of data, it is used only to run the requested tool and is deleted within the periods below.

What happens to your files

In most tools, the file is processed in the server's memory and returned directly to you, without being stored. When a conversion goes through the queue, the file and the result stay on the server only as long as needed and are automatically deleted within 2 hours at most, even if nobody downloads the result. Once deleted, the file cannot be recovered: always keep the original.

Your documents are not used to train artificial intelligence, for advertising, or for any purpose other than the tool you chose.

My documents (optional): account holders can turn on “Save my results” in My documents. It's off by default. When it's on, conversion results are stored privately, only for your account, for the period you choose (24 hours on the Free plan; 7 or 30 days on Plus and Business), and are automatically deleted when that period ends. You can delete one file or everything at any time, and turning the option off deletes what was stored. If your company has set a retention policy, that policy prevails.

Share with Gira: when you send a file through your phone's “Share” menu (installed app), it's stored for up to 30 minutes, tied to your browser, just so you can choose the tool, and then it's automatically deleted.

The name and size of your most recently downloaded files are stored in your own browser to build the session's download list. This information never reaches the server and disappears when you close the browser.

Artificial intelligence tools

In the AI summary, Translate PDF, and Chat with your PDF tools, the necessary text from the document is sent to Anthropic PBC, an external artificial intelligence provider based in the United States. This flow may constitute an international transfer of personal data. Use these tools only when you are authorized to share the content. Gira must keep documented the legal mechanism applicable to the transfer and the contracts with its processors/sub-processors.

Before each use, the screen shows this notice and only continues after you confirm. No other tool sends content to AI. The text is processed by Anthropic as a processor, under its commercial terms, which do not allow this content to be used to train models. Companies can turn off AI for all accounts in their domain. The result is generated automatically, may contain errors, and should be reviewed by you; no decision about you is made in an automated way by Gira.

In Chat with your PDF, the PDF file is not stored: only the text extracted from it is kept, linked to your account and session, while the conversation is open (at most for the period shown on the page and never beyond 2 hours). With each question, the relevant parts of the text and the question are sent to Anthropic. You can end the conversation at any time, which deletes the text immediately.

Signing with a digital certificate

In the Sign with digital certificate tool, the A1 certificate file (.pfx or .p12) and its password are used only in the server's memory during signing and are discarded right after. They are not written to disk, queue, database, file storage, or logs. The signed PDF is returned directly to you and is not stored either.

Company accounts (Gira Business)

If your account belongs to a company on Gira, that company's admins can see your usage: tools used, date and time, number and total size of files, sign-ins, and login attempts. They can also reset your password (without ever seeing the new password) and sign your account out. Document names and contents are not part of this record and are not shared with the company. In these cases, the company is the controller of this usage data and Gira acts as a processor, following its instructions.

Ads and third-party cookies

To keep the free plan available, visitors and Free accounts may see Google AdSense ads on the site's content pages (home page, tool explainer pages, help, and security). There are no ads on the screens where you upload and download files, and Plus and Business subscribers don't see ads.

Third-party vendors, including Google, use cookies to serve ads based on your previous visits to this and other websites. Google's advertising cookie enables it and its partners to show ads based on those visits.
Before showing any ad, we ask whether you accept personalized ads. Until you choose, no ads are requested. If you decline, we show only non-personalized ads, which don't use your history to choose the ad but may still use cookies to limit repetition, measure results in aggregate and fight fraud.
You can change your choice whenever you want through the “Cookie preferences” link in the footer. You can also turn off personalized advertising in Google Ad Settings or at aboutads.info.
For visitors from the European Economic Area, the United Kingdom, and Switzerland, consent is collected through Google's own certified privacy message (a consent management platform compatible with the IAB TCF).
Your documents are never used for ads, and no file content is shared with ad networks.
Learn how Google uses data from partner sites at policies.google.com/technologies/partner-sites.

The full list of cookies and browser local storage is in the Cookie Policy.

Who we share data with

We share data only with providers needed to operate the service, who act as processors and may only use the data to serve us:

Hosting and database: [HOSTING PROVIDER AND SERVER COUNTRY].
Cloudflare, Inc. (USA): content delivery network and attack protection; receives your IP address and technical connection data.
Anthropic PBC (USA): only in the AI tools, when you confirm their use.
Google LLC (USA): AdSense ads on content pages, Sign in with Google (if you choose it).
Microsoft Corporation (USA): Sign in with Microsoft, if you choose it.
Email delivery: [EMAIL PROVIDER], for sign-up confirmation and password recovery.
Payments: Mercado Pago (payments in Brazilian reais) and Stripe, Inc. (payments in dollars or euros), which processes billing under its own privacy policy.
Authorities: when there is a court order or a valid legal request.

We do not sell or rent personal data.

International data transfer

Some of the providers above are located outside Brazil, mainly in the United States. These transfers are made to perform the contract with you or at your request (art. 33, II and IX, of the LGPD) and are backed by contractual data protection clauses with the providers, under ANPD Board Resolution No. 19/2024 (Resolução CD/ANPD nº 19/2024). You can request more information about these safeguards through the Data Protection Officer (DPO) channel.

How long we keep data

Uploaded files and results: 2 hours at most, with automatic deletion. In direct-download tools, the file leaves memory as soon as the response is sent.
Access logs: 6 months, as required by art. 15 of Brazil's Internet Civil Framework (Marco Civil da Internet), or longer only if there is a court order or a request from an authority.
Account data: for as long as the account exists. After a deletion request, it's deleted within 30 days, except for what the law requires us to keep.
Usage count (which tool was used and when): up to 180 days, with automatic deletion. Cookie-free visit statistics keep the daily code for up to 2 days; after that, only totals remain, with no personal data.
Billing data and tax invoices: for the period required by tax law (generally 5 years).
Acceptance and support records: for as long as they may be needed to prove rights and obligations, subject to statutes of limitations.

Your rights

Under art. 18 of the LGPD, you may request, at any time and free of charge:

confirmation that we process your data, and access to it;
correction of incomplete, inaccurate, or outdated data;
anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
portability of your data to another provider;
deletion of data processed based on your consent;
information about who we share your data with;
information about the option not to consent and the consequences of refusing;
withdrawal of consent (for example, for personalized ads);
objection to processing carried out under another legal basis, if the LGPD is not being complied with;
review of decisions made solely on the basis of automated processing.

In your account, no request needed: in My account, “Download my data” instantly generates a file with the data linked to your account (access and portability), and “Delete my account” deletes the account (erasure).

How to exercise your other rights: send your request to [email protected] or [email protected], from your account email. To protect you, we may ask you to confirm your identity. We respond to requests for confirmation of processing and for access within 15 days, and to other requests as soon as possible. If you're not satisfied, you can file a complaint with the National Data Protection Authority (ANPD) at gov.br/anpd or with consumer protection agencies.

Children and adolescents

Gira is not directed at children. Registration and plan purchases are intended for people over 18; adolescents should only use the service with the authorization and supervision of their parents or guardians. We do not knowingly collect data from children under 12, nor do we knowingly show personalized ads to minors. If we identify a child's data processed without a guardian's consent, it will be deleted. Guardians can notify us through the Data Protection Officer (DPO) channel.

Security

We use an encrypted connection (HTTPS with HSTS), hashed passwords, a signed session cookie, login attempt limits, isolated file processing, and browser security headers. Details are on the Security page. No system is completely immune; if an incident occurs that may pose a significant risk or harm, we will notify the affected data subjects and the ANPD, under art. 48 of the LGPD.

Changes to this policy

When this policy changes, we update this page and the date at the top. If the change is significant, we notify you in advance by email or by a notice on the site and, when required by law, we ask for new consent.