Privacy Policy

The data controller is ANDERSON DE ALMEIDA MELO TECNOLOGIA DA INFORMACAO LTDA, a company registered in Brazil under company number (CNPJ) 53.137.423/0001-14, with its registered office at [PLACEHOLDER: FULL ADDRESS].

Data protection officer (DPO): Anderson de Almeida Melo (managing partner) — hey@educacodes.com. Until the dedicated channel is published, use hey@educacodes.com — every privacy request reaches that inbox.

This Policy covers the educa.codes app and the educa.codes website. Under contracts with schools or organisations, the controller and processor roles may differ and will be set out in the applicable agreement.

We process only what is needed for the app to work, to measure your learning and to keep your account secure.

We use data to provide the contracted service, authenticate and protect your account, build and adjust your study plan, validate progress, process purchases, answer support, moderate for safety, measure quality and comply with legal obligations.

Legal bases vary by purpose and country: performance of a contract, compliance with a legal obligation, legitimate interests, exercise of rights in proceedings, or consent (LGPD, arts. 7 and 11; GDPR, art. 6).

Marketing, optional communications and additional social features rely on consent where the law requires it, and can be switched off without losing educational access.

We do not use your data for third-party behavioural advertising and we do not sell it.

Profiles are private by default. Connecting requires a request and an acceptance, and discovery happens through an exact handle, a private code or an explicit invitation — not through broad search or your contact list.

The ranking shows only verified XP among connections, with an opt-out. Milestones are structured: nobody else publishes free text on your profile.

We never show your email, age, country, school, location or authentication identifiers to other users. We do not share your answers, your code or your detailed progress with connections.

Blocking removes future visibility and interaction. Reports and safety cases are access-restricted to the responsible team.

educa.codes is used by learners of many ages, and we treat that with extra care. The minimum age is [PLACEHOLDER: MINIMUM AGE], subject to local law and to the store rating.

Accounts of eligible minors start private. Social features may be disabled, read-only or subject to guardian authorisation, depending on country and age band.

We do not ask for identity documents for normal use and we do not store raw documents in the main database. Any additional age assurance will be proportionate, with minimised data and a defined retention period.

Guardians may request access, correction and deletion of the data of a minor in their care, and withdraw consent. Email hey@educacodes.com.

If we discover an account below the permitted age or invalid consent, we restrict the service and delete or anonymise the data as required.

We share the minimum necessary with vendors acting on our behalf under contract: hosting and API, database and authentication, app stores and subscription processing, email delivery, crash reporting and quality metrics, and support tooling.

The current subprocessor list will be published at [PLACEHOLDER: SUBPROCESSOR LIST URL] and will contain only vendors that are actually active.

We may also share data to comply with a legal obligation or a competent authority's order, to investigate fraud and abuse, to protect people's rights and safety, and in a corporate reorganisation — in which case this Policy continues to apply to the transferred data.

We do not sell personal data and we do not pass it to data brokers.

Our infrastructure vendors may process data outside Brazil and outside the European Economic Area.

When that happens, we use the mechanisms required by applicable law — such as standard contractual clauses, adequacy decisions or equivalent safeguards under the LGPD (art. 33) and the GDPR (chapter V).

We keep data for as long as the purpose that justified it requires, respecting legal retention periods and the defence of rights.

In practice: your progress stays while the account exists; raw usage events and technical logs have short lifetimes; practice-environment artefacts are ephemeral; unsubscribe and email-complaint records are kept in minimised form precisely so we can keep honouring your choice.

When you delete your account, we erase or anonymise the associated data, except for what the law requires us to retain or what is needed for security, fraud prevention and ongoing disputes.

We use authentication, row-level access control (RLS), encryption in transit, environment separation, server-side secrets, logs with sensitive-data redaction, backups and an incident response plan.

No system is infallible. If a significant security incident occurs, we will notify affected data subjects and the competent authority within the deadlines and in the form the law requires.

Found a vulnerability? Email hey@educacodes.com. Responsible disclosure is welcome and will not be treated as an attack.

The LGPD (art. 18) and the GDPR (arts. 15 to 22) grant you rights over your data. You can exercise them free of charge and without losing access to the service.

Send your request to hey@educacodes.com from your registered email, saying what you want (access, export, correction or deletion).

We may ask for proportionate identity confirmation — enough not to hand your data to someone else, and nothing beyond that.

We reply within 15 days in Brazil (LGPD, art. 19) and within 30 days in the European Union (GDPR, art. 12), extendable where the law allows, always with notice.

Important reminder: deleting your account in the app does not automatically cancel a subscription managed by the App Store or Google Play. Cancel it in the store too.

The educacodes.com website is static and loads fonts and images from its own domain. Preferences such as theme, language and sound stay only in your browser's local storage — they are not sent to a server and are not used to track you.

If we ever install audience analytics, we will disclose it here, configure it with minimised data and subject it to consent where the law requires.

In emails, open tracking stays off when it is not necessary. Unsubscribes, hard bounces and complaints always take precedence over any automation.

Purchases on mobile are processed by Apple or Google, which handle your payment data under their own privacy policies.

Links to social networks, such as our TikTok profile, lead to third-party services with their own policies. This Policy does not cover what happens there.

Apple, App Store, Google, Google Play and TikTok are trademarks of their respective owners, mentioned only to identify the platform.

We may update this Policy. The last-updated date is at the top of the page, and the current version is published here and in the app. A material change gets notice and, where required, renewed consent.

Questions, privacy requests and security reports: hey@educacodes.com.

Data protection officer (DPO): Anderson de Almeida Melo (managing partner) — hey@educacodes.com. Supervisory authority in Brazil: Autoridade Nacional de Proteção de Dados (ANPD).