Privacy notice

In short

• Caititu does not keep the text of what you ask or search for (except what goes into a problem report), nor your IP address.
• Each use of the connector leaves only one line (time, tool, name of the program, duration, number of results), deleted after one year.
• Messages sent through the contact form are kept for 180 days and then deleted automatically.
• Your conversation with the AI chat stays with the chat's company, not with Caititu.
• This site uses Google Analytics only for visit statistics, and only if you accept.

Who is responsible for the data

The data are the responsibility of the Caititu team, an independent and free project. Caititu has no representative in the European Union: the GDPR exempts it when the use of data is occasional and low-risk (art. 27(2)(a)). For any request about your data, write to contact@caititu.org or use the contact form.

The connector (Caititu inside the chat)

When you ask a question, the AI chat sends Caititu's server a search request. The server answers with the paragraphs and does not keep the text of the request.

• What is kept: for each use, one line with the time, the tool used, the name of the program that made the request (for example, “Claude”), how many seconds it took and how many results came back.
• What is not kept: the text of the question or of the search, your IP address, your name, your chat account.
• What for: to know how much and how the tool is used, and to find errors.
• For how long: one year. Then the lines are deleted.

Since these lines hold nothing that identifies you, there is no way to tell which of them came from your use.

Your conversation with the chat

The conversation stays with the company of the chat you use (for example, Anthropic for Claude or OpenAI for ChatGPT), under its privacy rules. Caititu does not see the conversation: it only receives the search requests the chat sends.

Problem reports

If the chat finds a possible error in the base, Caititu tells it to send a report to the project only after asking whether you agree, and to include your question only if you agree to that too. The chat asks, not Caititu, which cannot check that it did.

• What is kept: the date and time; what the chat wrote about the problem (the decision, the paragraph, what looks wrong and what you expected); the call to Caititu that gave the odd answer, with what was searched in it, and what it returned; and what the base holds at that point today.
• What is not kept: your IP address, your name, your chat account.
• For how long: 180 days. Then the report is deleted.

Do not put personal data, yours or anyone else's, in the report.

The contact form

• What is kept: the date and time it was sent, the language of the page, the message and, if you write them, the subject, the name and the e-mail address (all three optional).
• What is not kept: your IP address.
• Where: on Caititu's server. Only the project reads it, on a page with its own password.
• For how long: 180 days. Then the message is deleted automatically. You may ask for it to be deleted sooner.

E-mail

The address contact@caititu.org forwards messages, through Porkbun's forwarding service in the United States, to the project's mailbox (on Gmail, Google's, in the United States), which is outside Caititu's server. There, the message is kept under the rules of that e-mail service, not for the 180 days of the form. If you prefer that period, use the form.

This site

• Caititu's server does not record who opens the pages: there is no access log and no IP address kept.
• The language of the page is chosen from your browser's settings, without a cookie.
• Fonts and images come from the site itself. The only request to another site is Google Analytics', and only if you accept (see below).

Visit statistics (Google Analytics)

• On your first visit, a banner asks whether you accept statistics cookies. Until you accept, nothing from Google is loaded and nothing is sent to it. If you decline, the same holds.
• If you accept, the site loads Google Analytics, which stores cookies in your browser (the cookies _ga and _ga_…, which last two months and are read only by Google Analytics) and sends Google data about the visit (pages viewed, type of device and browser, approximate country and region), used only for visit statistics: how many people visit the site and what they read. To do so, Google receives your IP address and also processes this data in the United States.
• The data of each visit are kept two months in Google Analytics. After that, only totals remain (visits per page, per country), with nothing that links them to you. The site asks Google not to link visits to your Google account nor use them for advertising, and data sharing with Google is switched off.
• Google processes these data on Caititu's behalf and also in the United States. For people in the European Union, this transfer rests on the European Commission's adequacy decision on the EU-U.S. Data Privacy Framework of 10 July 2023 (GDPR, art. 45), in which Google takes part. For people in Brazil, the transfer rests on your consent, given in the cookie banner (LGPD, art. 33, VIII).
• To change your mind at any time, use the “Cookies” button in the footer: declining after accepting stops the statistics and deletes those cookies.
• This applies to this site only. The connector, which the chat uses to search, has no Google Analytics, and no question asked to Caititu reaches Google.

Where the data are

On a server rented from Hetzner Online GmbH, in Nuremberg, Germany. The server's own system logs are kept for 30 days and keep no IP addresses either. Google Analytics data stay with Google.

Who processes data on Caititu's behalf: Hetzner Online GmbH (Germany), which hosts the server; Google (Google Analytics, only with your consent); Porkbun (United States), which forwards e-mail; and Google (Gmail, United States), where the project's mailbox is.

On what basis we use the data

• Google Analytics statistics and their cookies: your consent (GDPR, art. 6(1)(a); LGPD, art. 7, I; Directive 2002/58/EC, art. 5(3); German TDDDG, § 25), which you can withdraw at any time, without affecting what was done before.
• Contact form, e-mail and problem reports: the project's legitimate interest in answering those who write and in correcting the base (GDPR, art. 6(1)(f); LGPD, art. 7, IX). You can object and ask for them to be deleted.
• The IP address of whoever opens the site or uses the connector: used only at the moment of delivering the page or the answer, never recorded (legitimate interest in running the service safely: GDPR, art. 6(1)(f); LGPD, art. 7, IX).
• Your choice about cookies, kept in your browser: needed to respect that choice (TDDDG, § 25(2), 2).
• The connector's usage lines identify no one.

Your rights

You can ask for: confirmation that Caititu holds data about you and access to it; correction; anonymisation, blocking or deletion of what is unnecessary; portability; deletion of what was processed with your consent; information on whom the data are shared with; and restriction of use. You can also object to a use based on legitimate interest and withdraw your consent at any time (if you do not consent, the site works the same). These are the rights of art. 18 of the LGPD and arts. 15 to 21 of the GDPR, plus any your country's law gives you. Write to contact@caititu.org or use the form: we answer within 15 days. You can also complain to a data protection authority: in Brazil, the ANPD; in the European Union, the one of the country where you live, work or where the problem happened.

Changes to this notice

If anything changes, this notice changes first. Last updated: 16 October 2026.