APRENDA
1. Who we are
This Privacy Policy explains how AprendaPlay (“we”) processes the personal data of the platform's users. For the purposes of the Brazilian General Personal Data Protection Law (LGPD — Law No. 13,709/2018), we act as the controller of the data described here. For any privacy matter, contact our data protection officer at [email protected].
2. Data we collect
Registration data
Name, username, email and password. The password is stored only as a cryptographic hash: not even our team can read it.
Profile data (optional)
Photo or avatar, date of birth, status (for example, “student”) and the bio you write.
Study and gamification data
Completed challenges, correct answers, XP, level, stars, study time, streaks and participation in leagues and rankings.
Technical access logs
IP address, browser and device type, as well as the date and time of access and of completed activities.
Payment data
When you purchase a Premium plan: CPF or CNPJ (Brazilian tax IDs), email and, when needed for the boleto, address. We also record the plan, amount, method and status of the payment. Card details are entered directly into Mercado Pago and are not kept by us.
Cookie Policy & Tracking Technologies
Used to keep your session and remember preferences, such as the light or dark theme.
Details about cookies are in our Cookie Policy.
3. What we use your data for
| Purpose | Legal basis (LGPD) |
|---|---|
| Create and maintain your account, authenticate your access and provide the platform's features | Performance of a contract (art. 7, V) |
| Record your progress and calculate XP, levels, stars, streaks and rankings | Performance of a contract (art. 7, V) |
| Process payments and grant Premium access | Performance of a contract and compliance with a legal obligation (art. 7, II and V) |
| Keep access logs for the period required by law | Compliance with a legal obligation (art. 7, II) |
| Prevent fraud, abuse and attacks, such as excessive requests | Legitimate interest (art. 7, IX) |
| Improve the platform based on usage statistics | Legitimate interest (art. 7, IX) |
| Respond to your support requests | Performance of a contract and legitimate interest |
We do not sell your personal data and we do not use it for third-party advertising.
4. What other users can see
Gamification has a social dimension. That is why your name, username, photo, level, XP and stars may appear in rankings and leagues, and your profile information — such as your bio, status and age calculated from your date of birth — may be seen by other logged-in users.
Your email, payment data and access logs are never shown to other users.
5. Who we share it with
- Mercado Pago: processing of Premium plan payments, under Mercado Pago's own privacy policy.
- Infrastructure providers: hosting and content delivery services needed to keep the platform online, such as the networks that deliver fonts and libraries.
- Public authorities: when there is a legal obligation, a court order or a request from a competent authority.
We require these partners to handle the information properly and securely, limited to the purposes described here.
6. How we protect your data
- Passwords stored only as cryptographic hashes;
- encrypted connection (HTTPS) between your device and the platform;
- role-based access control, so that only authorized people can access the administrative areas;
- protection against excessive requests and abusive access attempts;
- logging of changes made to the platform's data.
No system is completely immune to failures, but we work continuously to reduce risks. In the event of a relevant security incident, we will notify the affected data subjects and the Brazilian National Data Protection Authority (ANPD), as required by the LGPD.
7. How long we keep it
- Account and study data: while your account is active or until you request its deletion.
- Access logs: for a minimum of 6 (six) months, as required by the Brazilian Internet Civil Framework (Marco Civil da Internet — Law No. 12,965/2014).
- Payment data: for the period required by tax legislation.
After these periods, the data is deleted or anonymized.
8. Your rights
The LGPD guarantees you, among others, the rights to:
- confirm that your data is being processed and access it;
- correct incomplete, inaccurate or outdated data;
- request the anonymization, blocking or deletion of unnecessary data or data processed in breach of the law;
- request the portability of your data;
- obtain information about who we share your data with;
- withdraw your consent, when the processing is based on it;
- request the deletion of your data and the closure of your account.
You can update most of your profile data directly on the platform. To exercise the other rights, write to [email protected] from your registered email; we will reply within the period set by law. You can also file a complaint with the ANPD.
9. Children and adolescents
The platform is aimed at students preparing for public service exams and college entrance exams. Use by adolescents must take place with the consent and supervision of their parents or legal guardians, and the processing of data of children and adolescents follows their best interests, under Article 14 of the LGPD.
10. International transfer
Some suppliers, such as infrastructure and content delivery providers, may store or process data outside Brazil. In these cases, we adopt the safeguards set out in Chapter V of the LGPD.
11. Changes to this policy
This policy may be updated periodically. The date of the last update is always shown at the top of this page, and relevant changes will be communicated through the platform's channels.
12. Contact the data protection officer
Questions, requests or complaints about privacy and data protection: [email protected].