Privacy policy

This applies to the Catálogo Blucher MCP server at https://catalogo.blucher.com.br/mcp and to these pages. In short: we log how the catalog is used, to understand demand and keep the service running, without the name, e-mail or IP address of whoever uses it.

What we log

For each tool call we keep a record with:

• the tool called, date and time;
• the parameters the assistant sent (for example the search text, area or ISBN), after removing e-mail addresses, phone numbers, Brazilian tax IDs (CPF) and web addresses;
• the results returned (the ISBNs and how many) and, if any, the error;
• the response time (latency);
• the client: the request's User-Agent, which usually names the AI app that made the call; we also remove from it e-mail addresses, phone numbers and web addresses, which some bots include as contact details;
• an IP address hash: SHA-256 of the IP combined with a random salt that changes every day and is never stored. It is used only to count distinct clients per day; on its own, it cannot recover the IP or link one day's usage to another's;
• the client app: the name and version it reports (for example, claude-code 2.1, major and minor number only) or, when it reports none, those in the User-Agent, and whether the call came from an AI provider's servers (Anthropic, OpenAI), by the source address range;
• the approximate location: country, state and city that the delivery network (Cloudflare) derives from the IP, and a map point rounded to about 10 km. The IP itself is not stored. When the call comes from a provider's servers (Claude on the web, ChatGPT), the location is that of its data center, not of the user;
• the search intent (for example, topic discovery, a specific title or a syllabus reading list), classified by the server's own rules from the tool, its parameters and the first book in the answer, without AI.

None of these items, on its own, says who you are. Together, though, city, app and time can link calls from the same person across days, especially in a small city and on a direct connection (not through a provider). That is why this record is seen only by the team that runs the service, in the internal dashboard (which can also export the call list), and is never published or matched against another database to identify anyone.

For recomendar_para_ementa, the call record keeps only the syllabus length, never its text. The text, with the topics that did or did not match a book, goes to a separate syllabus record; before storing it we remove e-mails, phone numbers, CPFs, web addresses and lines starting with “Professor”, “Professora”, “Prof.” or “Docente” (where the instructor's name usually appears).

What we do not log

• your IP address in clear text, neither in the usage records nor in the server's access log (see the technical logs under “Who has access”);
• e-mail, phone, name or any account data: the service has no sign-up, login, cookies or browsing analytics;
• your conversation with the assistant: the server only receives the parameters the assistant chooses to send to each tool;
• purchase or payment data: purchases happen on Blucher's website, not here.

Please do not paste personal data into a question or syllabus anyway: automatic cleaning is an extra safeguard, not a guarantee.

Why we use it

For demand statistics (what agents look for, what they do not find, which syllabus topics have no book, which books show up in answers, from which countries and cities and through which apps the demand comes) and to operate the service (performance, errors and abuse prevention). We do not use the records for advertising, do not profile people and do not sell or share the records with anyone.

Who has access

The Editora Blucher team that runs the service, through an internal dashboard with a Blucher account sign-in, and the infrastructure providers operating it on our behalf: hosting and the content delivery and security network (Cloudflare), which processes traffic, including IP addresses, to deliver responses and block abuse, and keeps its own technical security logs. For semantic search, the question and the syllabus topics (already stripped of e-mails, phone numbers and instructor lines) are turned into vectors by Workers AI, the AI service of the same Cloudflare: the text is processed only to compute the vectors, Cloudflare does not use it to train models or keep it longer than needed to respond, and processing may take place outside Brazil. No other AI service receives these texts.

On our server, the web server's access log keeps the time, requested address, status, response time and User-Agent, without the full IP address: at most the network prefix, without the last part that identifies the connection. The application keeps no access log. The full IP address only appears in the web server's error log, when the connection to the application fails, as a technical security record. These logs stay on the server, are discarded by rotation and are not combined with the usage records.

How long

Call and syllabus records are kept for 24 months. After that they are deleted and only monthly aggregates remain: counts per tool (calls, searches without results, errors, distinct clients per day) and the syllabus topics left uncovered, with how often they occurred.

Catalog data

Everything the server returns is already public on each book page at https://www.blucher.com.br: title, authors and their public bios, synopsis, table of contents, price, edition and availability. The server publishes nothing that is not on the website.

Your rights and contact

Since we keep no name, e-mail or IP address, we usually have no way to find a person's records to access, correct or delete. For any request under Brazil's data protection law (LGPD), questions about this policy or corrections to catalog data, write to catalog@blucher.com.br. If this policy changes, the new version is published on this page.