Updated on 10 October 2026

Privacy Policy

This document explains, in plain language, what data Optimus keeps about you, why it keeps it and what you can demand at any time.

We keep the minimum needed to run the account and bill it. Access keys are encrypted. We do not sell any data to anyone.

01Who handles your data

Optimus is operated by Gamora3D, in Brazil. We are the controller of the data described here, as defined by the Brazilian data protection law (Law 13.709/2018).

02What we collect

Account data: name, e-mail and a password stored only as a cryptographic hash — never in readable form.

Service data: the names of your projects, the record of your server being created, the month's AI usage and technical access logs (IP address, browser, date and time).

Keys and secrets: your server's SSH key and, if you choose to use your own, your AI API key. Both are encrypted in the database with AES-256-GCM and never come back in plain text through any API route.

Payment data: processing is done by the billing provider. Your card never passes through our servers and is not stored by us.

03What we use it for

To create and keep your server, authenticate your access, measure the monthly AI quota, issue billing and notify you about the service.

Technical logs serve security and troubleshooting. We do not build behaviour profiles and we do not run advertising.

04Cookies

We use our own, essential cookies: one keeps you signed in, one remembers your language and one remembers light or dark theme. There is no third-party tracking cookie and no ad network.

05Who we share with

The infrastructure provider that hosts your server, the payment provider, the transactional e-mail provider and the AI model provider that answers your conversations.

Each one receives only what its job requires. We do not sell, rent or hand over data to third parties for commercial purposes.

06How we protect it

Always HTTPS, hashed passwords, secrets encrypted at rest and restricted administrative access. No system is infallible: if an incident puts you at risk, we notify you and the competent authority.

07How long we keep it

Account data for as long as the account exists. Once closed, we delete or anonymise within 30 days, except records the law requires us to keep, such as tax records.

08Your rights

You may request confirmation of processing, access, correction, anonymisation, portability and deletion of your data, and withdraw consent. Write to the address at the end of this page; we answer within 15 days.

09Changes to this document

If we change something relevant, we notify you by e-mail and update the date at the top. The version in force is always the one published here.

Questions about this document

Write to suport@buykure.com and we answer on the same channel.

Back to the home page