Privacy Policy

1. Introduction

tudy (tudyapp.com) is a productivity and study web app, available at tudyapp.com.br. This Privacy Policy describes how we collect, use, store and protect your personal data, in compliance with Brazil's General Data Protection Law, LGPD (Law No. 13,709/2018).

By using tudy, you agree to the practices described in this document. If you do not agree, please do not use the service.

This policy is a translation of the original Portuguese version (Política de Privacidade). If the two versions differ, the Portuguese version prevails.

2. Data we collect

2.1 Account data

• Email address, used for logging in and for communications about your account
• Name or nickname, optional, provided by you
• Profile photo, optional. For accounts created with Google, the photo from your Google account
• Subscription information: active plan and renewal date

2.2 Usage data

• Content you create in the app: subjects, tasks, deadlines, notebooks, notes, flashcards and topics
• Progress data: recorded study time, XP, streak and badges
• Access logs: IP address, browser type, operating system, pages visited and times
• Preferences and settings saved in the app
• If you allow notifications, your device's address for sending push notifications

2.3 Payment data

Credit card data and other financial information are collected and processed exclusively by Stripe (card) and Mercado Pago (Pix), our payment processors. When you use tudy in English, payments are by card only, through Stripe. Pix is available only in the Portuguese version. tudy does not store card data on its servers.

2.4 Cookies and similar technologies

We use cookies and similar technologies to:

• Keep you logged in to the app
• Save your browsing preferences
• Measure traffic and understand how the site and the app are used
• Measure the results of our ads

You can set your browser to refuse cookies or to warn you when cookies are sent. Some features of the app may not work properly without cookies.

3. Usage measurement and ads

We use PostHog to understand how people find tudy and how they use the product: pages visited, where the visit came from (campaign parameters in the URL) and usage events, such as creating an account or finishing a study session. This measurement is used to improve the product, not to sell data.

We use the Meta Pixel to measure the results of the ads we run on Facebook and Instagram. It records visits and conversions, such as starting a sign-up, and allows Meta to show ads to people with similar profiles. You can manage this in the ad preferences of your Meta account.

tudy does not show third-party ads in the app today, on any plan. If ads are ever introduced, this policy will be updated beforehand and you will be notified.

4. How we use your data

• To provide, operate and improve tudy's services
• To manage your account and subscription
• To process payments and issue charges
• To send account communications: email confirmation, renewal notices, password recovery
• To send reminders you turned on, such as a heads-up for a deadline due tomorrow
• To send news about tudy, which you can unsubscribe from at any time
• To comply with legal and regulatory obligations
• To prevent fraud and keep the platform secure

5. Third-party services that process your data

To run tudy, we share data with the following providers:

These third parties have their own privacy policies and are responsible for how data is handled in their systems. We do not sell your personal data to any company.

6. Legal basis (LGPD)

We process your personal data based on the following legal grounds set out in the LGPD:

• Performance of a contract: to provide the service you signed up for (art. 7, V)
• Consent: for marketing communications and non-essential cookies (art. 7, I)
• Legitimate interest: for platform security, fraud prevention and service improvements (art. 7, IX)
• Compliance with a legal obligation: when required by law (art. 7, II)

7. Your rights as a data subject

Under the LGPD, you have the right to:

• Access: confirm that your data is being processed and get a copy of it
• Correction: ask us to correct incomplete, inaccurate or outdated data
• Deletion: ask us to delete your personal data
• Portability: receive your data in a structured format
• Withdrawal of consent: withdraw your consent at any time
• Objection: object to processing based on legitimate interest

To exercise any of these rights, email contato@tudytech.com.br. We will reply within 15 business days.

8. Data retention and deletion

Your data is kept while your account is active. When you ask us to delete your account, your personal data is removed from our systems within 30 days, except when we need to keep it to comply with a legal obligation.

To request deletion of your data, email contato@tudytech.com.br with the subject line "Data deletion".

9. Security

We take technical and organizational measures to protect your data against unauthorized access, loss, disclosure or improper alteration, including encryption in transit (HTTPS), row-level access rules in the database and access control for internal systems.

Despite our security efforts, no system is completely secure. If an incident could affect your data, we will notify the affected users as required by the LGPD.

10. Users in other jurisdictions

tudy is a service based in Brazil and subject to the LGPD. If you use the service from another country, please be aware that your data will be processed in Brazil and that data protection laws may differ from those in your country of residence. Some of the providers listed in section 5 may also process data in other countries.

10.1 European Union, European Economic Area and United Kingdom

If you are in the EU, the EEA or the UK, the General Data Protection Regulation (GDPR, or the UK GDPR) also gives you rights over your personal data. tudy, based in Brazil, is the controller of your data. You have the right to:

• Access: get a copy of the personal data we hold about you
• Rectification: have inaccurate or incomplete data corrected
• Erasure: have your personal data deleted
• Portability: receive your data in a structured, commonly used format
• Objection: object to processing based on legitimate interest, and to direct marketing at any time
• Withdrawal of consent: withdraw consent at any time, without affecting processing done before
• Complaint: lodge a complaint with the data protection authority in your country

The legal grounds in section 6 correspond to those in the GDPR: performance of a contract, consent, legitimate interest and compliance with a legal obligation. To exercise your rights, email contato@tudytech.com.br.

10.2 California

If you live in California, you can ask us what personal information we have about you, ask us to correct or delete it, and you will not be treated differently for using these rights. We do not sell your personal information. To make a request, email contato@tudytech.com.br.

11. Changes to this policy

We may update this Privacy Policy from time to time. When there are relevant changes, we will notify you by email or with a notice in the app. The date of the last update is always shown at the top of this page.

12. Contact

For questions, requests or to exercise your privacy rights, get in touch:

• Email: contato@tudytech.com.br
• Instagram: @tudyapp