Privacy Policy

2Who we are (Controller)

3A TECH, CNPJ 55.668.091/0001-20, headquartered in São Paulo, Brazil, is the controller of the personal data processed in the Service, except for Class Mode in schools, where the Partner School acts as controller and Pupilu as processor (LGPD, Art. 5, VI and VII).

Data Protection Officer (DPO): contato@pupilu.com.br.

3Who this Policy applies to

• Guardians and adult users who create an Account for themselves or their dependents.
• Children and adolescents linked to a Guardian Account (Full Mode).
• Students registered by Partner Schools (Class Mode).
• Teachers linked to Partner Schools.
• Partner Schools (legal entities), regarding contact and management data.
• Visitors to the website pupilu.com.br.

4What data we collect

• From Guardians and adults: full name, email, password (stored as an argon2id hash), date and time of acceptance of the terms, registration IP, device model, operating system, language, billing data (processed by a payment gateway, without storing the full card number).
• From children and adolescents in Full Mode: name (provided by the Guardian), date of birth, avatar (optional), chosen study area, learning progress (lessons completed, right and wrong answers, XP, streak), achievements, messages sent to the AI Tutor.
• From students in Class Mode: name (typed by the student in class), class and grade (linked by the teacher), learning progress, achievements. In this mode we do not collect email, phone number, address, photo, documents, or payment data of minors.
• From teachers: name, institutional email, password (hash), school and classes managed, panel access records.
• From schools: company name, CNPJ, address, contact email, contract data (seats contracted, term, plan), aggregated usage data.
• Usage and device data: IP address and the approximate location derived from it (country, state, and city, never the exact device location), time zone, device model and operating system, access logs, error telemetry, and in-app actions (app opens, lessons started and completed, exercises done and missed, study times).

5How we collect it

• Directly from you when you create an Account, complete a profile, use features, or subscribe to a Plan.
• Automatically through use of the Service (logs, metrics, telemetry), including through the usage analytics tool described in section 9.
• From the Partner School, for students in Class Mode (name, class, grade).
• From essential third parties: app stores (for in-app subscriptions), payment gateway, transactional email provider.

6Legal bases (LGPD Art. 7 and 11)

• Performance of a contract: operating the Account, processing payments, providing paths and progress.
• Consent: processing data of children and adolescents (Full Mode), sending marketing communications (opt-in), optional use of AI.
• Compliance with a legal or regulatory obligation: issuing invoices, responding to authorities (LGPD, ANPD, CGI.br, Brazilian Internet Civil Framework).
• Legitimate interest: fraud prevention, platform security, continuous improvement of the Service, with impact assessment whenever applicable.
• Educational purposes: processing data of students in Class Mode based on the Partner School's legitimate interest in carrying out its educational activity, with reinforced safeguards for minors.

7Children and adolescents (LGPD Art. 14 and ECA)

Data of children and adolescents is always processed in their best interest and with reinforced safeguards.

In Full Mode, consent is given by the Guardian when accepting these Terms and the Privacy Policy, and may be withdrawn at any time without affecting the contractual relationship already established.

In Class Mode, the Partner School is the controller and is responsible for the legal basis of the processing within its educational activity. Pupilu, as processor, follows the School's instructions, applies safety filters, and keeps the data restricted to the school environment until any Adoption by the Guardian.

We do not profile minors for advertising purposes, do not target ads at minors, and do not share minors' data for purposes unrelated to the educational service.

8What we use the data for

• Authenticating users and keeping sessions active.
• Recording learning progress and calculating XP, streaks, lives, achievements, and ranking.
• Personalizing recommendations of paths, difficulty, and reviews.
• Running the AI Tutor with filters appropriate to the user's profile.
• Sending operational communications (billing, security alerts, changes to the terms).
• Sending marketing communications only with explicit opt-in and never to minors.
• Measuring app usage (screens, app opens, lessons, errors, approximate region) to improve the Service and fix problems.
• Choosing the time and number of study reminders, based on when the student usually studies.
• Showing learning results to Partner Schools, only with aggregated and anonymous metrics.
• Preventing fraud, abuse, and breaches of these Terms.
• Complying with legal, tax, and regulatory obligations.

9Who we share data with

• Cloud hosting and managed database providers, under processor agreements, with servers in Brazil or abroad.
• Transactional email provider, to send Account messages.
• Usage analytics tool (PostHog, with servers in the United States), which receives app usage events, the IP address, and approximate location. Events are linked to an encrypted profile code, without name, email, or other contact data.
• Ad network (Google AdMob), on the free plan only. For children under 13, ads follow child-directed mode; for ages 13 to 17, ads are always non-personalized; for adults, ads are only personalized with permission.
• Payment gateway and app stores (App Store, Google Play), to process subscriptions; we do not store full card numbers.
• AI Provider (language model), only with the content needed to answer the user's question; where applicable, under a corporate contract that prohibits use for model training.
• Partner School, exclusively to view the progress of its own students (Class Mode) and of students whose Guardian adopted them via an adoption code (Full Mode linked to the school).
• Public authorities, upon court order, a well-founded administrative request, or to comply with a legal obligation.
• In case of corporate reorganization (merger, acquisition, sale of assets), with prior notice to data subjects and the same guarantees maintained.
• We do not sell personal data in any form.

10AI Tutor — specific processing

Messages sent to the AI Tutor are processed by the contracted AI Provider and stored on our servers for security, support, and improvement purposes.

We do not send the AI Provider identifiable personal data beyond the content of the question. Identifiers such as name, email, and sensitive data are removed or replaced before sending.

Conversations may be reviewed, on an aggregated and anonymized basis, for quality and safety audits. Individual access to a specific conversation only happens when there is a well-founded need (e.g., incident investigation, court order) and is logged.

11Cookies, identifiers, and local storage

• On the website: strictly necessary cookies (session, security), functional cookies (preferences), and, optionally, anonymous analytics cookies.
• In the app: secure local storage (AsyncStorage) for the session token, active profile, and interface preferences.
• For users under 18, we do not use advertising identifiers or cross-app tracking (IDFA, AAID).
• For adults on the free plan, the advertising identifier is only used for personalized ads if the person allows it: on iPhone, through the system tracking prompt (ATT); on Android, according to the device's ad settings.
• You can clear local data at any time by uninstalling the app or ending the session with the Log out button.

12How long we keep data

• Active Account: for as long as the contractual relationship lasts.
• After the Account is closed at the holder's request: up to 90 days for possible reactivation; then anonymization or permanent deletion, except for data retained due to legal obligations.
• Class Mode without adoption: the Profile may be marked inactive after 60 days and purged 90 days after deactivation, freeing the School's seat.
• Access and security logs: up to 6 months, as required by the Brazilian Internet Civil Framework (Art. 15) and security best practices.
• Daily app usage record (app opens, lessons, and study times, used for reminders): deleted together with the Profile.
• Tax and contractual documents: for the legal period (up to 5 years for tax purposes, 5 years under consumer law for consumer claims).
• Encrypted backups: rotated within 30 days.

13Information security

• Traffic protected by TLS (HTTPS) in all communications.
• Passwords stored with a secure cryptographic hash (argon2id), never in plain text.
• Internal access restricted by role (principle of least privilege) and recorded in audit logs.
• Incident monitoring and a documented response plan.
• In the event of a security incident that may pose a relevant risk or harm to data subjects, Pupilu will notify the ANPD (Brazilian Data Protection Authority) and the affected data subjects under Art. 48 of the LGPD.

14Data subject rights (LGPD Art. 18)

• Confirmation that processing takes place.
• Access to personal data.
• Correction of incomplete, inaccurate, or outdated data.
• Anonymization, blocking, or deletion of unnecessary or excessive data, or data processed in breach of the LGPD.
• Portability of data to another provider (upon express request).
• Deletion of data processed based on consent.
• Information about public and private entities with which Pupilu has shared your data.
• Information about the possibility of not giving consent and the consequences.
• Withdrawal of consent.
• For children and adolescents, rights are exercised by the Guardian; in Class Mode, by the Partner School regarding processing under its control.

15How to exercise your rights

Send your request to contato@pupilu.com.br stating: the data subject's name, the Account email (if applicable), a description of the request and, for minors, the Guardian's details.

We will respond within 15 calendar days, as set out in Art. 19 of the LGPD. We may ask for proof of identity to prevent improper access to the data.

If the request is denied or the answer is unsatisfactory, you may contact the Brazilian National Data Protection Authority (ANPD) at www.gov.br/anpd.

16International data transfers

Some essential providers (for example, cloud hosting and the AI Provider) may store and process data outside Brazil, in jurisdictions recognized as adequate by the ANPD or covered by standard contractual clauses.

The safeguards in Art. 33 of the LGPD apply: necessity for the performance of a contract, contractual protection guarantees, international security certifications, and the obligation to report incidents.

17Changes to this Policy

This Policy may be updated to reflect changes in the Service, the law, or operational practices. Material changes will be announced by email and/or in-app notice at least 15 days in advance.

The version history is available upon request to the Data Protection Officer.

18Contact

Data Protection Officer (DPO): contato@pupilu.com.br.

General support: contato@pupilu.com.br.

Mailing address: São Paulo, Brazil.

Brazilian National Data Protection Authority (ANPD): www.gov.br/anpd.