Privacy Policy

This document was written in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018 — LGPD), the European Union General Data Protection Regulation (Regulation (EU) 2016/679 — GDPR), the Brazilian Internet Civil Framework (Law No. 12,965/2014) and the guidance of the Brazilian National Data Protection Authority (ANPD). The rights that apply to you depend on your jurisdiction of residence.

1. Identification of the Controller

This Privacy Policy describes how AISAC Tecnologia ("AISAC", "we", "us", "our") processes personal data collected through the AISAC Academy platform, available at aisac.academy and its subdomains (including the technical address aisac-academy.vercel.app), as well as through its forms, e-mails and other support channels. By using the platform, you declare that you have read, understood and agreed to this Policy.

This document is the AISAC Academy service-specific privacy notice and complements the general Privacy Policy of the AISAC ecosystem, published in the AISAC Legal Center. If they conflict on something specific to the Academy, this document prevails.

Data controller:

• Legal name: AISAC TECNOLOGIA, SISTEMAS E CERTIFICAACOES LTDA (trade name Aisac; brand AISAC)
• Brazilian tax ID (CNPJ): 69.215.099/0001-45
• Address: Av. Cristóvão Colombo, 2144, Sala 408, 3º andar — Floresta, Porto Alegre/RS, postal code 90560-001, Brazil
• Contact e-mail: contact@aisac.global
• Data Protection Officer (DPO): Bruno Bracaioli — e-mail: dpo@aisac.global

2. Definitions

For the purposes of this Policy, the definitions of the LGPD (art. 5) and the GDPR (art. 4) apply:

• Personal data: information relating to an identified or identifiable natural person.
• Sensitive personal data: data revealing racial or ethnic origin, religious belief, political opinion, trade-union membership, data concerning health or sex life, genetic or biometric data, when linked to a natural person.
• Data subject: the natural person to whom the personal data relates.
• Controller: the natural or legal person who makes the decisions regarding the processing of personal data.
• Processor: the natural or legal person who processes personal data on behalf of the controller.
• Creator (or School): a user who creates a school on the platform and publishes courses for their Students.
• Student: a user enrolled in one or more courses of a School.
• Processing: any operation performed on personal data (collection, storage, use, sharing, deletion, etc.).
• Consent: a free, informed and unambiguous statement by which the data subject agrees to the processing of their data for a specific purpose.
• Anonymisation: the use of reasonable technical means so that data can no longer be associated with an individual.

3. Personal Data We Collect

We collect only the data strictly necessary for the purposes described in this Policy. The categories of data processed are:

• Account and identification: display name, e-mail address, password (stored only as a cryptographic hash — never in plain text) or your Google account identifier, profile picture, preferred language and theme.
• Learning profile: enrollments, lesson progress, quiz answers and results, personal notes, issued certificates (with a public verification code), experience points (XP), study streaks and achievements.
• User content: comments on lessons, questions sent to the AI tutor and any other material you actively submit.
• Creator data: School name and identifier, brand elements (logo, colours), published courses and materials, and third-party integration credentials you configure (stored encrypted).
• Payments: transaction identifiers, plan, amount, currency, status and the last four digits of the card, provided by our payment processor. We do not store full card numbers.
• Browsing and technical data: IP address, browser type and version, operating system, pages visited, access time, security records and, when you authorise it, device identifiers for push notifications.
• Communications: e-mail preferences and delivery records of transactional e-mails.
• Cookies and similar technologies: as described in section 10.

We do not intentionally collect sensitive personal data. If you voluntarily send us such data (for example, in comments or in questions to the AI tutor), it will be processed only with your explicit consent or under the other legal bases of art. 11 of the LGPD.

4. Sources of Data

We obtain your personal data from the following sources:

• Directly from you, when you create an account, fill in forms, watch lessons, answer quizzes, comment or interact with the AI tutor.
• Automatically, through cookies and similar technologies in your browser when you access the platform.
• From Google, when you choose to sign in with your Google account (see section 16).
• From Creators, when a Creator enrolls you in a course or sends an invitation to your e-mail.
• From third-party providers of services essential to our operation (for example, the payment processor), as described in section 6.

5. Purposes and Legal Bases

All processing of personal data by us is grounded on at least one of the legal bases of art. 7 of the LGPD and, where applicable, art. 6 of the GDPR:

• Creating and maintaining your account, authenticating you and delivering courses, progress and certificates — Performance of a contract (LGPD art. 7, V / GDPR art. 6(1)(b)).
• Processing payments and issuing tax documents — Performance of a contract and compliance with a legal obligation (LGPD art. 7, II and V / GDPR art. 6(1)(b) and (c)).
• Operating the AI tutor and generating automatic lesson notes — Performance of a contract (LGPD art. 7, V / GDPR art. 6(1)(b)).
• Gamification (XP, streaks, achievements and leaderboard) — Performance of a contract. The leaderboard shows your display name and picture to other Students of the same School; you can change both in your profile settings.
• Sending transactional e-mails (account confirmation, password reset, certificate issued, achievements) — Performance of a contract.
• Sending push notifications and optional communications — Consent (LGPD art. 7, I / GDPR art. 6(1)(a)), revocable at any time.
• Securing the platform, preventing fraud, limiting abuse and keeping audit trails — Legitimate interest and compliance with a legal obligation (LGPD art. 7, II and IX / GDPR art. 6(1)(c) and (f)).
• Operating and improving the platform (aggregated usage metrics) — Legitimate interest of the controller, balanced in favour of the data subject's rights.
• Complying with legal and regulatory obligations — Compliance with a legal obligation.
• Exercising or defending rights in judicial, administrative or arbitral proceedings — LGPD art. 7, VI / GDPR art. 6(1)(f).

6. Sharing with Third Parties

We do not sell personal data. We share data with processors strictly necessary for providing the service, all bound by contractual obligations of confidentiality and data protection. Our current processors and partners are:

• Vercel, Inc. — hosting, CDN, application execution and aggregated usage and performance metrics (Vercel Web Analytics and Speed Insights, cookieless — section 10). Data processed: IP, headers, access logs, aggregated browsing and performance metrics. Processing location: USA and global region.
• Supabase, Inc. — database, authentication and file storage. Data processed: account data, learning data and user content. Processing location: USA.
• Resend, Inc. — transactional e-mail delivery. Data processed: name, e-mail and message content. Processing location: USA.
• Upstash, Inc. — cache, rate limiting and processing queues. Data processed: technical identifiers (IP or user ID) and queue messages. Processing location: USA and global region.
• Anthropic, PBC — AI models behind the tutor and lesson-note generation. Data processed: lesson content, your questions to the tutor and the context needed to answer. We do not send your e-mail or password. Processing location: USA.
• Stripe, Inc. — payment processing. Data processed: name, e-mail, payment data. Processing location: USA and global region.
• Google LLC — Sign in with Google (section 16) and playback of embedded YouTube videos, subject to Google's privacy policy.
• Video and community providers configured by the Creator (for example, Panda Video, Telegram, Discord) — only when the School you are enrolled in enables those integrations, and only the data required for them to work.
• Creators — the Creator of the School you are enrolled in has access to your name, e-mail, progress and results to manage their courses. In that relationship the Creator is an independent controller of their Students' data and must comply with applicable data protection law.
• Public authorities, when required by law, court order, official investigation or to defend the rights of AISAC or third parties.

In the event of a merger, acquisition or corporate reorganisation, data may be transferred to the successor entity, subject to this Policy.

7. International Data Transfers

Because we use global providers, your data may be transferred to and stored on servers located outside Brazil and outside the European Union, including in the United States of America. We ensure that every international transfer complies with art. 33 of the LGPD and arts. 44-49 of the GDPR through:

• Standard Contractual Clauses approved by the European Commission or standard clauses approved by the ANPD;
• Transfers to countries with an adequacy decision issued by the ANPD or the European Commission;
• Your specific consent, where applicable;
• Additional technical measures (encryption in transit and at rest, pseudonymisation) to protect your data against unauthorised access.

You have the right to request a copy of the safeguards adopted through the channel indicated in section 12.

8. Data Retention

We keep your personal data only for as long as necessary for the purposes for which it was collected, except where the law requires a longer period:

• Account and learning data: while your account is active. After a deletion request, data is deleted or anonymised within 30 (thirty) days, except for backups (deleted within a further 30 days) and legal obligations.
• Certificates: the verification record (name, course, date and code) is kept while the certificate is valid, to allow public verification of authenticity. You may request its removal, which invalidates the certificate.
• Payment data: for the period required by applicable tax and civil law.
• Access logs and technical data: 6 (six) months, in accordance with art. 15 of the Brazilian Internet Civil Framework.
• AI tutor conversations: while your account exists; you can delete them at any time.
• Support messages: up to 2 (two) years from the last contact.
• Data linked to the exercise of rights in proceedings: for as long as the proceedings and any limitation period require.

Once the retention period ends, data is securely deleted or irreversibly anonymised.

9. Information Security

We adopt reasonable technical and organisational measures to protect personal data against unauthorised access, destruction, loss, alteration, communication or dissemination, in accordance with art. 46 of the LGPD and art. 32 of the GDPR. These include:

• Encryption in transit (TLS 1.2 or higher) for all communications with the platform;
• Encryption at rest for databases and file storage;
• Data isolation per School and row-level access control in the database (Row-Level Security);
• Role-based access control under the principle of least privilege;
• Passwords stored exclusively as hashes; Google authentication via OAuth 2.0 / OpenID Connect;
• Rate limiting on authentication flows and logging of security events;
• Periodic vulnerability assessment and dependency updates;
• An incident response plan, with notification to the ANPD and affected data subjects in the event of a security incident with relevant risk or harm, in accordance with art. 48 of the LGPD.

We describe these practices in more detail on our Security page.

10. Cookies and Similar Technologies

We use cookies (small files stored in your browser) and similar technologies (such as the browser's local storage) to operate the platform. The categories used are:

• Strictly necessary cookies: essential for authentication and security (login session, abuse protection). They do not require consent.
• Preferences: remember your language and theme between visits. They do not require consent.
• Embedded third-party cookies: when playing embedded videos (for example, from YouTube), the video provider may set its own cookies under its privacy policy.

To measure platform usage and performance, we use Vercel Web Analytics and Vercel Speed Insights (provided by Vercel, already listed as a processor in section 6). These tools do not use cookies, produce only aggregated metrics, and do not enable cross-site tracking or individual visitor identification. Before any event is sent, URL query parameters that could carry an authentication token, a verification code or an e-mail address are automatically stripped. We do not use advertising cookies, tracking pixels, or third-party advertising analytics tools (such as Google Analytics/GA4 or Google Tag Manager). If this changes, this Policy will be updated and consent will be requested where required.

You can manage or block cookies in your browser settings. Blocking strictly necessary cookies prevents you from logging in to the platform.

First-party acquisition attribution. When you arrive through a link with campaign (utm) parameters or from another website, we store a first-party cookie, scoped to our own domain and valid for 30 days, containing the campaign source (utm), the referring website's host (never the full address) and the landing page. This cookie is not used for advertising and is not shared with third parties; when you create your account, that information is copied to your profile so we know where our learners come from, and the cookie is deleted. The legal basis is AISAC's legitimate interest in understanding where our audience comes from (LGPD art. 7, IX; GDPR art. 6(1)(f)), with minimal impact on you.

Marketing e-mail (opt-in). If, and only if, you tick the optional updates checkbox (at sign-up, or later on your profile page), we will send you AISAC marketing e-mail with product news and course updates, and we record when and where you gave your consent. This consent is separate from the Terms, applies to AISAC (not to course creators) and can be withdrawn at any time by turning the option off on your profile or with the unsubscribe link in every e-mail. The legal basis for these e-mails is your consent (LGPD art. 7, I; GDPR art. 6(1)(a)).

11. Your Rights as a Data Subject

The LGPD (art. 18) and the GDPR (arts. 15 to 22) grant you, as a data subject, the following rights, which can be exercised free of charge at any time:

• Confirmation of the existence of processing of your personal data;
• Access to the personal data processed;
• Correction of incomplete, inaccurate or outdated data;
• Anonymisation, blocking or deletion of unnecessary or excessive data, or data processed in breach of the LGPD;
• Portability of your data to another service or product provider, subject to trade and industrial secrets;
• Deletion of personal data processed on the basis of consent, except where the law allows retention;
• Information about the public and private entities with which we share your data;
• Information about the possibility of not giving consent and the consequences of refusal;
• Withdrawal of consent at any time, without affecting the lawfulness of processing carried out before withdrawal;
• Objection to processing carried out under a legal basis other than consent, where the LGPD is not complied with;
• Review of decisions made solely on the basis of automated processing that affect your interests (LGPD art. 20);
• Lodging a complaint with the Brazilian National Data Protection Authority (ANPD) or with the competent supervisory authority in your country (GDPR art. 77).

12. How to Exercise Your Rights

To exercise any of the rights listed in section 11, send a reasoned request to our DPO at dpo@aisac.global (copying contact@aisac.global), including:

• Your full name and the e-mail registered on the platform;
• A clear description of the right you wish to exercise;
• Proof of identity (to prevent fraud and protect your own data); and
• Any supporting documents.

We will respond within 15 (fifteen) days under art. 19 of the LGPD and within 30 (thirty) days under art. 12 of the GDPR; this period may be extended by an equal period in cases of justified complexity.

Handling your request is free of charge, except for manifestly unfounded or excessive requests, for which a reasonable fee may be charged.

13. Protection of Minors

Our services are not intended for people under 18. We do not knowingly collect personal data from children (under 12) or adolescents (between 12 and 18) without the specific and prominent consent of at least one parent or legal guardian, in accordance with art. 14 of the LGPD and art. 8 of the GDPR.

If we become aware that we have collected data from a minor without proper consent, the data will be deleted immediately. Parents or guardians who identify such a situation should contact us through the channel in section 12 to request deletion.

14. Automated Decisions and Profiling

Gamification (XP, levels, leaderboard), lesson-note generation and AI tutor answers are automated features that do not produce legal effects or significantly affect your interests. We do not make decisions based solely on automated processing that produce such effects.

If we start to do so in the future (for example, personalised course recommendations with relevant effects), we will inform you in advance of the criteria used and guarantee your right to:

• Obtain a clear explanation of the criteria and procedures used in the automated decision;
• Request human review of decisions made solely on the basis of automated processing that affect your interests, under art. 20 of the LGPD and art. 22 of the GDPR.

15. Complaints and Competent Authorities

Without prejudice to your right to contact us directly (section 12), you may lodge a complaint with the competent authorities:

• Brazil — National Data Protection Authority (ANPD): https://www.gov.br/anpd/
• European Union — the data protection supervisory authority of your country of residence. The full list is available at: https://edpb.europa.eu/about-edpb/board/members_en
• United Kingdom — Information Commissioner's Office (ICO): https://ico.org.uk/

16. Google User Data (Sign in with Google)

AISAC Academy offers a "Continue with Google" option that uses Google OAuth 2.0 / OpenID Connect to authenticate you.

Scopes requested: openid, https://www.googleapis.com/auth/userinfo.email and https://www.googleapis.com/auth/userinfo.profile. These scopes only allow us to identify you and obtain your e-mail and basic profile information. We do not request access to Gmail, Google Drive, Calendar, Contacts or any other data in your Google account.

Data received: Google account identifier, name, e-mail address and verified-e-mail flag, profile picture and language. We use this data exclusively to create or authenticate your account on the platform and to populate your display name and profile picture, which you can change at any time.

Data we store: the linked identity (Google identifier and e-mail) is kept by our authentication provider, encrypted at rest. We do not store Google access or refresh tokens in our database; after sign-in, your session is maintained with the platform's own credentials.

Limited Use: AISAC Academy's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use Google user data only to provide and improve the features above; we do not sell it; we do not use it for advertising; we do not transfer it except as necessary to operate the service or as required by law; and no human reads this data except with your consent, for security or debugging purposes, or when legally required.

Revoking access: you can disconnect AISAC Academy from your Google account at any time at https://myaccount.google.com/permissions. After that, you can still access your account through the other sign-in methods (e-mail and password or magic link).

17. Changes to this Policy

This Policy may be updated periodically to reflect changes in our services, legal requirements or best practices. The latest version will always be available at https://aisac.academy/legal/privacy, in Portuguese and English, with the date of the last update.

Material changes will be communicated with reasonable notice, by e-mail to registered users or by a prominent notice on the platform. Continued use of the services after the new version is published constitutes acceptance of the changes, except where the law requires renewed consent.

18. Contact

If you have questions, requests or complaints about this Policy or about the processing of your personal data, contact us:

• DPO: dpo@aisac.global
• General support: contact@aisac.global
• Postal address: Av. Cristóvão Colombo, 2144, Sala 408, 3º andar — Floresta, Porto Alegre/RS, postal code 90560-001, Brazil