Privacy Policy

PP §1 - Who we are (controller)

echobuild (echobuild.app) is a set of tools for gaming communities to organize information: to catalog, build, compare and share builds. Monster Hunter Wilds is the first game covered. The platform is operated by Inovapad Consultoria e Marketing Ltda, registered with the Brazilian Corporate Taxpayers' Registry (CNPJ) under No. 46.797.060/0001-88, which acts as the controller (controlador) of the personal data processed on the platform, under the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD").

We operate as a small-scale processing agent (agente de tratamento de pequeno porte), under Resolution CD/ANPD No. 2/2022 of the Brazilian Data Protection Authority (ANPD), and this Policy reflects obligations proportionate to that regime.

Our core principle is data minimization (LGPD, art. 6, III): we collect only what is strictly necessary for the platform to work, and this Policy describes exactly what that is.

PP §2 - What we collect and why

PP §2.1 - Account and login (Discord)

Login to echobuild is exclusively via Discord (OAuth). From Discord we receive only your user ID and your username (nick). We use this data to create and maintain your account and to identify you within the platform.

About your email address: login uses only your Discord identity. On the authorization screen, Discord states that it will share your email address with echobuild: that transmission comes from Discord itself and we have no way to disable it.

We delete that address the moment it arrives, before anything is written. It does not remain in our database, it is not used for anything and it is not shared with anyone. This is a direct application of the necessity principle (LGPD, art. 6, III): what we do not need, we do not keep.

This has a practical consequence, described in Terms §9.3: since we hold no email address of yours, we cannot contact you outside the platform.

PP §2.2 - What we actively do NOT collect

We do not collect, request or store: civil name, CPF (Individual Taxpayers' Registry number), telephone number, address, date of birth, precise geolocation, financial data (card, bank account) or any sensitive personal data as defined in LGPD art. 5, II. No platform feature needs this data, and adding any of it in the future would require revising this Policy first.

PP §2.3 - Builds and content you create

Builds you create are private by default. You may optionally make them public (via a view link) and take part in the community layer (builds endorsed by community leaders). Published content is visible according to your settings. The exception is a build that echobuild features in the curated catalog: the featured copy stays public, with your name as author for as long as your account exists, even if you unpublish or delete the original build (ToS §5.2).

Please note: titles and free text of published builds are public. Avoid including personal data in them, yours or anyone else's.

PP §2.4 - Game inventory

If you use inventory mode, we store the equipment state you record, linked to your account. The inventory is private: it is not shown to other users. When you request a Build Doctor analysis, it is processed as provided in PP §2.5. Purpose: progress calculation and farming recommendations. You may clear it at any time.

PP §2.5 - Build Doctor (AI-assisted analysis)

When you request an analysis from Build Doctor, the content sent (build, inventory where applicable, and the analysis parameters) is processed by an artificial intelligence operator (operador), located outside Brazil (Anthropic). See PP §4 (international transfer). We keep a technical cache of the results, to reduce cost and response time for repeated analyses. That cache is linked to your account and is erased together with it when you delete your account (PP §6.4). As of this date, we do not state a maximum retention period for the cache.

PP §2.6 - Community affiliation and public profile

• Community affiliation: a public, self-declared field under your control (one community at a time; you may change or remove it whenever you wish).
• Public profile: what appears on your profile (preferred weapons, games, community, published builds) is chosen by you. The exposure is controlled by the data subject (titular), except for authorship of builds featured in the curated catalog (PP §2.3).

PP §2.7 - Supporter (monetization)

Analysis credits for supporters are granted by your nick on the platform, and we do not ask for an email address at checkout. There is no paid tier in operation as of this date, and therefore no supporter payment is processed today. When there is, the payment will be processed by an external payment processor, identified in PP §5 before any charge; echobuild does not receive personal data about the supporter from that processor beyond confirmation of payment, linked to your nick (see PP §5). We keep only the record of the credit grant, linked to your account.

PP §2.8 - Technical records (logs)

Like any service on the internet, our infrastructure automatically records technical access data, including IP address, date and time, and the resource accessed, exclusively for security, fraud prevention and abuse investigation. See section 6.2 of this Policy for retention periods.

PP §2.9 - Reports

When you submit a report, we process your identification, the address of the content reported and the message you wrote. The purpose is to assess the report, to notify the decision and to curb misuse of the channel. The legal bases are compliance with a legal obligation and, for the preservation described at the end of this section, the regular exercise of rights (section 3). We keep this data for 12 (twelve) months after the case is closed and then erase your identification; where the report arrives by email, the message is erased 12 (twelve) months after receipt. Erasure is carried out by a monthly routine. The record of the action we took remains as a minimum administrative trail (section 6.2), with no data identifying you. Where the case has been reported to a competent authority, where retention for a longer period is determined by a competent authority or by court order, or where preservation is necessary for the regular exercise of rights in judicial, administrative or arbitral proceedings, we preserve what is necessary for as long as that necessity lasts, recording the reason.

PP §3 - Legal bases

We process personal data on the following LGPD legal bases:

• Performance of a contract (art. 7, V): account, builds, inventory, Build Doctor analyses you request, the granting of supporter credits, and the affiliation and profile you configure.
• Legitimate interests (art. 7, IX): security records (logs with IP), the Doctor's technical cache, and abuse and fraud prevention.
• Compliance with a legal or regulatory obligation (art. 7, II): retentions required by law, where applicable (see PP §6).
• Regular exercise of rights (art. 7, VI): preservation of report and moderation records where necessary in judicial, administrative or arbitral proceedings.

We do not use consent as a basis for essential features. We prefer not to collect. Where an exposure is optional (public build, profile, affiliation), it follows from an action of yours, within the performance of the contract, and is reversible by you.

PP §4 - International data transfer

Three operations involve the international transfer of personal data, under Chapter V of the LGPD:

1. Build Doctor: the content sent for analysis is processed by Anthropic, an AI model operator located outside Brazil (United States). The transfer occurs exclusively to carry out the analysis you requested.
2. Edge infrastructure (CDN): we use Cloudflare as a delivery and protection layer; requests to the platform travel through Cloudflare's global network, which includes the technical record described in PP §2.8.
3. Backups: the database is replicated to cloud storage operated by Cloudflare (R2), outside Brazil, and the copies expire within 30 days. They contain the personal data held on the platform.

In all cases, the transfer relies on the mechanisms of art. 33 of the LGPD and on the data protection contractual instruments of these suppliers.

PP §5 - Who we share data with

We do not sell or rent personal data. We do not display advertising. We share data only with operators (operadores) strictly necessary to the operation:

• Anthropic: processing of Build Doctor analyses (PP §2.5, §4).
• Cloudflare: traffic delivery and protection (PP §4).
• Hostinger: hosting of the platform infrastructure, with a server located in São Paulo, Brazil.
• Payment processor: there is no paid tier in operation as of this date, and therefore no payment processor is an operator of echobuild today. When there is, the processor will be identified in this section before any charge. The relationship with it runs in the opposite direction: it is the processor that handles the supporter's payment; echobuild neither sends personal data to it nor receives personal data from it beyond the confirmation needed to grant the credits.

We may also share data when required by law or by order of a competent authority.

PP §6 - Retention and erasure

PP §6.1 - While your account exists

Account data, builds, inventory, affiliation and profile are kept for as long as your account exists and you do not remove them.

This retention is not open-ended: accounts with no activity at all for 24 (twenty-four) consecutive months may be terminated, with erasure of the associated data and the same effects provided for account deletion (sections 6.2 and 6.3 of this Policy). The full rule, including the absence of prior notice and the reason for it, is in Terms of Service §9.3. To keep your account active, all you need to do is access it.

PP §6.2 - Account deletion

When you delete your account, we erase your identifiers and unlink your content from the active systems. We transparently declare the minimum residual retentions that remain, on the basis of art. 16 of the LGPD:

• Internet application access logs: we keep the access records, that is, the IP address, the date and time, and the resource accessed in the request, under confidentiality, for six months, and erase them afterwards. The purpose is security and abuse prevention, and the period follows the parameter of art. 15 of the Brazilian Civil Rights Framework for the Internet (Marco Civil da Internet). Where retention for a longer period is determined by a competent authority or by court order, we preserve the records covered by that determination for as long as it lasts. We do not keep records of the requests processed at the network edge. Cloudflare processes the traffic as an infrastructure operator, under its own retention periods.
• Minimum administrative trail: the record of the actions we take on the platform remains, with your identifier replaced by a random code. We do not keep the correspondence between that code and you.
• Backups: we do not edit backups; removal is completed by the natural expiry of the backup cycle, within 30 days. If a backup is restored, the deletion is reapplied.

We do not promise "perfect anonymization". We promise erasure from the active systems with residual retention that is declared and justified, and that is what this section describes.

PP §6.3 - What happens to your content on deletion

Deletion erases the builds you created, including those that were public. Builds of yours that echobuild has featured in the curated catalog remain online, without your name, because other people came to rely on them.

This is not an option chosen at the moment of deletion: it is how the platform works, and the confirmation screen states this before you confirm.

PP §6.4 - Build Doctor cache

The technical cache of analyses is linked to your account and is erased automatically when the account is deleted. Each entry receives a technical expiry date, but erasure once that period elapses is not yet carried out automatically. We therefore do not state a maximum retention period for the cache.

PP §7 - Your rights (LGPD, art. 18)

At any time you may request: confirmation of the existence of the processing, access to your data, correction, anonymization, blocking or erasure of whatever is unnecessary or excessive, portability, erasure of data processed with consent (where applicable), information on data sharing, and review of automated decisions.

You exercise a good part of these rights directly on the platform (editing your profile, clearing your inventory, unpublishing builds, deleting your account). For the rest, use the contact channel in PP §9. We confirm receipt and inform you, in simplified form, whether we process data about you within 15 days. The complete and detailed statement is delivered within 30 days, counted from your request. Before delivering any data, we need to confirm that the request comes from the account holder; confirmation may be done through your Discord account.

You may also petition the Brazilian Data Protection Authority (ANPD).

PP §8 - Cookies, measurement and technical records

• Cookies and browser storage: we use only our own cookies, needed for operation or to remember choices you made. They are: the login session, which keeps you signed in and is linked to your account, kept until you sign out or the session expires; the language you chose, kept for up to one year, including for people without an account; and a note that you closed the first-access notice in the inventory, kept for up to one year. We also keep, only in your browser, the controller scheme you chose on the Hunting Horn page, until you clear your browser data. The choice records do not identify you, and none of them is shared with third parties. We do not use advertising cookies or third-party trackers. You can delete them in your browser settings; without them, the platform forgets these choices, and without the session you need to sign in again.
• Usage measurement: as of this date we do not perform aggregate usage measurement. There is no audience analytics tool installed on the platform. Should we adopt one, it will be aggregate, with no tracking cookies and no individual identification, and this Policy will be updated before the tool enters operation.
• Security logs: as provided in section 6.2 of this Policy, technical access data (including IP) is kept under confidentiality for six months, exclusively for security and abuse prevention.

We do not use: Google Analytics, social network pixels, session recording, fingerprinting.

PP §9 - Contact and data protection channel

Channel for exercising rights and for questions about this Policy: privacidade@echobuild.app. For general matters: contato@echobuild.app.

Inovapad has not appointed a data protection officer (encarregado) and is not required to appoint one. Under the small-scale processing agent regime declared in §1, art. 11 of Resolution CD/ANPD No. 2/2022 waives that obligation. The address privacidade@echobuild.app is the point of contact for data protection matters and receives communications from data subjects and from the ANPD.

PP §10 - Changes to this Policy

This Policy may be updated when the platform gains features that change how data is processed. Material changes will be announced on the platform itself, with the date of the current version always shown at the top. Continued use after the new version takes effect indicates awareness of the new text, without prejudice to your rights as a data subject.