Privacy Policy

Last updated: October 11, 2026

This Privacy Policy explains how TazzoGram ("TazzoGram," "we," "us," or "our") collects, uses, and protects information when you use the TazzoGram application and related services (the "Service"), available at tazzogram.com and its subdomains.

The Service is operated by GS4D Tech Services Ltda ME, CNPJ 68.647.830/0001-49, a company registered in Brazil, trading as "TazzoGram". That company is the controller of the personal data described in this policy.

1. Information we collect

We collect the minimum information needed to operate the Service:

• Account information. When you sign in with Google or register with an email address, we receive your email address and, for Google sign-in, basic profile information (name, profile image) provided by Google. We use your email domain to determine whether you qualify for free-tier or business-tier access.
• ENGWhen you pay by Boleto, we ask for your CPF or CNPJ and send it to Asaas, which needs it to issue the Boleto. We do not keep it on our servers.POR
• Diagram content you upload or create. Files and diagram code you open, edit, or generate in the Service are processed to provide the core functionality (format conversion, AI-assisted change requests, and rendering), and are not stored on our servers. The Mermaid code and the rendered diagram exist only in your browser while the page is open, and we never save them to your device. We do record the name of each file you convert, in our usage log, so we can support you and measure usage. See Section 3 for how the content is handled while it is being processed.
• ENGIf you make an external link, anyone who has the link can see that diagram, including its text, until the link ends or you turn it off. A one-time link opens for one person, one time: when it is opened, we delete the picture from our server and the link stops working for everyone. We keep only the picture (for a one-time link, only until it is opened), its name, its Roles list, the number of views and the time of the last view. We do not keep who opened it.POR
• Usage and technical data. We log basic technical information (IP address, browser type, timestamps, and general geographic region derived from IP address) to secure the Service, enforce rate limits, and default the interface language for Brazil-based visitors. Sign-in attempts are recorded together with the IP address they came from, so we can protect accounts against abuse. Those records are kept for 90 days and are then deleted. Separately, country-level lookups are cached only as a hash of the IP address, never in readable form, for up to 30 days. To make TazzoGram fit the way you work, we record which parts of the app you use (for example Open File, the language list or Save As), together with your account e-mail. These records never include file names, diagram content or the words you type. Those records are also kept for 90 days and are then deleted. When you visit tazzogram.com, we use Google Analytics to count visits, and we look up which company or internet provider your connection comes from, with the city and country. We keep only that company name, city and country for 90 days, never your internet address, and we use it only to understand who is interested in TazzoGram.
• Notices you accept. When you accept the notice shown before a legal, tax or regulatory request, we keep your e-mail, the date and the version of the notice text, to show that you saw it.
• Local browser storage. The Service uses your browser's local storage (not cookies) to remember preferences such as language selection and sidebar state. This data stays on your device and is not transmitted to us except where explicitly noted below.

2. How we use information

• To provide, maintain, and improve the Service.
• To authenticate you and enforce tier-based access limits (free, business, or approved accounts).
• To process diagram content through our AI-assisted conversion and change-request features.
• To communicate with you about your account, including approval notices for business-tier access.
• To detect, prevent, and address abuse, fraud, or security issues.

3. AI processing of diagram content

When you use TazzoGram's AI-assisted features (for example, requesting a change to a diagram, or translating page text), the relevant text is sent to Anthropic's Claude API for processing. This content is used only to generate the response shown to you and is not used by TazzoGram to train any model. Please review Anthropic's own privacy policy for how Claude API processes this data.

We work to keep your organization's sensitive details away from the AI models and tools we use. When PROTECT is on, TazzoGram's Redaction Glossary replaces names, company names, code names, e-mail and internal addresses, and reference codes in your diagram text with neutral codes such as C0001, C0002 and C0003 before anything is sent for an AI-based change. When the answer comes back, your browser puts the real words back. The Glossary is kept in your browser, not on our servers, until you clear it. Words inside images, photos and scans cannot be masked, so those files are sent as they are. The app warns you before that happens.

By default, your diagram's Glossary of business terms and obfuscation settings stay in your browser only and are never transmitted to our servers.

Connecting TazzoGram to your organization's own GitHub account or Slack workspace is not a self-service feature. On the Practice and Firm plans you can ask us for it, and our team sets it up with you as an add-on. Until that is done, TazzoGram writes nothing to GitHub or Slack for you, and your Glossary stays in your browser. Once it is set up, your shared Glossary and the diagram versions you choose to save are written to a repository in your GitHub account, and change announcements are posted to the Slack channel you choose. Who can see them is decided by your own GitHub and Slack permissions, you can revoke our access at any time, and GitHub and Slack handle that data under their own privacy policies.

4. Sharing of information

We do not sell your personal information. We do not share your information with third parties for their own marketing purposes. We may share information with:

• Service providers who help us operate the Service (hosting, email delivery, payment processing by Stripe for cards and Asaas for Boleto, AI processing as described above), bound by confidentiality obligations.
• Authorities, if required by law, or to protect the rights, property, or safety of TazzoGram, our users, or others.

5. Data retention

We retain account and usage information for as long as your account is active or as needed to provide the Service, comply with legal obligations, resolve disputes, and enforce our agreements. You may request deletion of your account and associated data at any time (see Section 8).

6. Security

We use industry-standard measures to protect your information, including encrypted connections (HTTPS/TLS), access controls, and rate limiting. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. International users

TazzoGram is used by visitors from Brazil and other countries. If you are located in the European Economic Area, the United Kingdom, Brazil, or another region with its own data protection law (such as the LGPD or GDPR), you may have additional rights over your personal data, including the right to access, correct, or delete it, and the right to object to certain processing. Contact us using the details in Section 8 to exercise these rights.

8. Contact us

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be reflected by an updated "Last updated" date at the top of this page.