Last updated: August 31, 2026
This Policy describes how Isabella Becker (CPF 272.004.978-60), operator of Alchemy of Virtues, processes the personal data of the Users of her digital products and services, in accordance with the General Personal Data Protection Law (Law 13,709/2018 — LGPD).
Address: Rua dos Ingleses, 446, apto. 82, Bela Vista, São Paulo — SP, CEP 01329-000.
Because this is an operation run by an individual, Isabella Becker herself acts as Data Protection Officer (DPO), to whom the User may address all requests related to this Policy.
This Policy applies to all products of the Brand — The Soul Map, The Compass, the course The Architecture of the Possible, the books, the Study Hub and the Premium Hub, The Virtologist Center, and the free maps and tests.
We do not store credit card data. Financial processing is carried out by the payment and retail platforms, which have their own policies. From them we receive only the payment status and the non-sensitive identifiers needed to release access.
When using the Brand's instruments and platforms, the User may record:
Some of the free maps and tests run entirely in the User's browser, keeping the answers only in the device's own local storage (localStorage). In these cases, the Operator neither receives nor stores the answers, and clearing the browser data deletes them permanently. Each instrument states, on its own screen, which of the two regimes it operates under.
| Purpose | Legal basis |
|---|---|
| Registration and operation of the products | Performance of contract (Art. 7, V) |
| Invoicing and billing | Compliance with legal/contractual obligation (Art. 7, II and V) |
| Recording of personal work in the instruments | Express consent (Art. 7, I and Art. 11, I) |
| Generation of readings with AI support | Express consent (Art. 7, I and Art. 11, I) |
| Sending notices about products and waiting lists | Consent (Art. 7, I), revocable at any time |
| User support | Performance of contract + legitimate interest (Art. 7, V and IX) |
| Complying with tax and regulatory obligations | Legal obligation (Art. 7, II) |
| Defense in judicial or administrative proceedings | Regular exercise of rights (Art. 7, VI) |
We share only strictly necessary data, with the following processors:
| Processor | What for | What it receives |
|---|---|---|
| Google LLC (Firebase) | Database, authentication, and storage | Registration and content data from the products that save to the server |
| Netlify, Inc. | Hosting of the pages and execution of server functions | Data in transit and technical access logs |
| Anthropic PBC | Generation of readings by artificial intelligence (see section 5) | The instrument's answers, without name, email, or contact data |
| Hotmart Company E-commerce LTDA | Payment processing and customer area | Data necessary for the financial transaction |
| Book retail platforms | Sale and delivery of digital and print books | Purchase data, according to the platform's own policy |
| Sendinblue/Brevo | Sending transactional emails and notice lists | Name and email |
| Public authorities | Compliance with a court order or legitimate request | Whatever is legally required |
5.1. Some products — in particular The Soul Map — generate a reading text from the User's answers with the support of an artificial intelligence model provided by Anthropic PBC (United States), accessed by the Operator through an application programming interface (API).
5.2. What is sent: only the instrument's answers and results, to the extent necessary to produce the text. The User's name, email, CPF, or any contact data are not sent.
5.3. What does not happen: according to the provider's commercial terms in force at the time of contracting, content sent via API is not used to train models.
5.4. AI processing takes place upon express consent, obtained before generation. A User who does not consent should not use the product, in which case the Refund Policy applies.
5.5. The generated text is material for reflection — it is not a report, diagnosis, or professional opinion.
The data is stored in Firebase (Google) and in Netlify's services, with main servers in the United States. AI processing likewise takes place in the United States. The international transfer takes place on the basis of (i) the data subject's consent, (ii) contractual guarantees offered by the processors, and (iii) Arts. 33 et seq. of the LGPD.
| Category | Retention period |
|---|---|
| Active account | For as long as the contractual relationship lasts |
| Lifetime-access products | For as long as the product is kept online, or until a deletion request |
| After subscription cancellation | Up to 90 (ninety) days for reactivation; after that period, deletion |
| Name and email on notice lists | Until unsubscription, which is available in every mailing |
| Tax data (invoices, financial records) | 5 (five) years from the last payment (legal obligation) |
| Log and security data | 6 (six) months |
In accordance with Art. 18 of the LGPD, the data subject may at any time:
To exercise any of these rights, simply send an email to the address provided in the footer. We will respond within 15 (fifteen) days.
In the products aimed at therapists and virtologists, the professional User may enter information about their own patients or clients.
In these cases, the professional is the controller of this data: it is their responsibility to obtain the data subject's consent, observe professional confidentiality, and uphold the rights provided for in the LGPD. The Operator acts as processor, limited to the professional's instructions, and does not access this content except when technically necessary for support, upon request.
Details in the Cookie Policy.
The Brand's products are not directed at persons under 18 (eighteen) years of age and do not intentionally process data of children and adolescents. Should the Operator identify improper processing, it will be stopped immediately and the data deleted.
We adopt reasonable technical and administrative measures to protect the data, including:
Even so, no transmission over the internet is 100% secure. In the event of a security incident that may pose a risk to data subjects, we will notify the National Data Protection Authority (ANPD) and the affected data subjects, as required by Art. 48 of the LGPD.
Changes will be communicated by email and/or notice on the platforms, at least 15 (fifteen) days in advance when they involve material changes.
Isabella Becker personally acts as Data Protection Officer. Requests related to this Policy should be addressed to the email provided in the footer.
The data subject may also file a complaint directly with the National Data Protection Authority (ANPD) through the website www.gov.br/anpd.