Privacy policy

Last updated: September 25, 2026

This policy explains what data Lyra collects, why, who it is shared with and how you exercise your rights. It follows Brazil’s General Data Protection Law (LGPD, Law 13.709/2018).

The data controller is Menezes Apps. Privacy requests can be sent to suporte@lyrapdf.com.br.

1. Data collected

• Sign-up: your email and the identifier provided by the social sign-in provider you chose, such as Google or Apple.
• Study material: the PDF files you import and the study spaces you organize them in.
• Content you create: notes, region clips, flashcards, Tutor conversations and review history.
• Progress: the page where you stopped, reading preferences and review scheduling.
• AI usage: date, call type and number of tokens used, to control limits and cost. This record does not keep the content of the conversation.

Lyra does not use tracking cookies or advertising tools. Your session is kept by a token stored in your browser’s local storage.

2. Purpose and legal basis

Data is processed to provide the service you signed up for when creating your account — the legal basis is performance of a contract (art. 7, V). The AI usage record relies on the legitimate interest (art. 7, IX) of keeping the service viable and preventing abuse.

3. Who data is shared with

Lyra does not sell data and does not share it for advertising. Three processors are needed for it to work:

• Anthropic — receives the passages you select and send to the Tutor, to generate the answer. It receives the passage and the conversation context, not the whole file.
• Railway — hosts the server and the database, where your account, files and content are kept.
• Vercel — hosts the web application that runs in your browser.

These three operate outside Brazil, which constitutes an international data transfer. It happens because it is necessary to perform the contract with you (art. 33, II, item “d”).

4. How long data is kept

For as long as your account exists. When you delete your account, your files, notes, flashcards and conversations are deleted. The AI usage record, which contains no content, is kept unlinked from your identity for cost control.

Access logs subject to Brazil’s Internet Civil Framework (Marco Civil da Internet) may be kept for the applicable legal period, with restricted access.

5. Your rights

The LGPD guarantees you, at any time, the right to:

• confirm that processing exists and access your data;
• correct incomplete or outdated data;
• request anonymization, blocking or deletion of unnecessary data or data processed unlawfully;
• request data portability;
• delete data processed based on your consent;
• know which entities your data was shared with — the list is in section 3;
• revoke consent.

To exercise any of them, write to suporte@lyrapdf.com.br. We reply within 15 days.

6. Security

Access to the service is authenticated by social sign-in and a signed token, and all traffic is encrypted over HTTPS. Your files are kept in restricted-access storage, accessible only through your account.

No system is immune to incidents. If a security incident poses a relevant risk to your rights, you and Brazil’s National Data Protection Authority will be notified, as required by art. 48 of the LGPD.

7. Changes

Changes to this policy will be communicated by email or inside the service before they take effect.