Privacy Policy
Last updated: 11 de setembro de 2026 / September 11, 2026
App Mestre Tecnologia — Brazilian CNPJ 48.844.509/0001-47 ("App Mestre", "we", "our") is committed to protecting the personal data of its users. This Policy describes our privacy practices in compliance with:
- Brazil: Lei Geral de Proteção de Dados Pessoais (LGPD — Law No. 13.709/2018) and ANPD regulations.
- European Union / EEA: General Data Protection Regulation (GDPR — Regulation 2016/679).
- United Kingdom: UK GDPR and Data Protection Act 2018.
- California, USA: California Consumer Privacy Act / California Privacy Rights Act (CCPA/CPRA).
1. Data Controller and Data Protection Officer (DPO)
App Mestre acts as a Data Processor (LGPD Art. 5, VII / GDPR Art. 4(8)) for Student data — processing it under the instruction of Creators, who are the Data Controllers. For Creator and platform user data, App Mestre acts as Data Controller.
- Company: App Mestre Tecnologia
- CNPJ (BR Registration): 48.844.509/0001-47
- DPO: App Mestre Tecnologia
- DPO Email: privacidade@appmestre.app
- Address: Florianópolis, SC, Brazil.
2. Data We Collect
2.1 Data you provide directly
- Registration: Full name, email, password (bcrypt-hashed — never plain text), phone (optional), CPF/CNPJ for Brazilian Creators.
- Payment: Card data is processed directly by PCI-DSS Level 1 certified gateways (Stripe, Asaas) — we never store full card numbers.
- Profile: Profile picture, biography, social media links, app settings.
- Communications: Messages sent to support, tickets, contact forms.
2.2 Data collected automatically
- Browsing: IP address (stored as SHA-256 hash — we do not track raw IPs), device type, browser, OS, referral URL.
- Platform usage: Pages visited, features used, session duration, conversion flows.
- Geolocation: Country and approximate region (via Cloudflare headers — never precise GPS without explicit consent). Latitude/longitude only with analytics consent.
- Cookies and similar technologies: As described in our Cookie Policy.
3. Purposes and Legal Basis for Processing
| Purpose | Legal Basis (LGPD) | Legal Basis (GDPR) |
|---|---|---|
| Service delivery | Art. 7, V (Contract) | Art. 6(1)(b) |
| Payment processing | Art. 7, V (Contract) | Art. 6(1)(b) |
| Transactional communications | Art. 7, V (Contract) | Art. 6(1)(b) |
| Fraud prevention & security | Art. 7, IX (Legitimate interest) | Art. 6(1)(f) |
| Analytics & product improvement | Art. 7, IX (Legitimate interest) | Art. 6(1)(f) |
| Session telemetry (support/bugs) | Art. 7, IX (Legitimate interest) | Art. 6(1)(f) |
| Marketing & promotional communications | Art. 7, I (Consent) | Art. 6(1)(a) |
| Legal & tax obligations | Art. 7, II (Legal obligation) | Art. 6(1)(c) |
4. Data Sharing
We share personal data only with:
- Payment gateways (Stripe — USA; Asaas — Brazil): For transaction processing. PCI-DSS certified.
- Transactional email providers (Resend — USA; Brevo — France): For sending communications.
- Hosting infrastructure (OVH — France; Coolify): For platform operation, within the EU/EEA.
- Analytics (PostHog — with IP anonymization; Google Analytics 4 — with consent).
- AI providers (OpenAI, Google): Only prompts sent by the user to the AI Tutor, without personal identification.
- Competent authorities: When required by law, court order, or legitimate government request.
We never sell personal data to third parties for commercial purposes.
5. Your Rights
5.1 LGPD Rights (Brazilian residents — Art. 18)
- Confirmation and access to data being processed.
- Correction of incomplete, inaccurate, or outdated data.
- Anonymization, blocking, or deletion of unnecessary data.
- Data portability to another service provider.
- Deletion of consent-based data.
- Revocation of consent at any time.
- Filing a complaint with the ANPD.
5.2 GDPR Rights (EU/EEA residents — Chapter III)
- Access (Art. 15), Rectification (Art. 16), Erasure / Right to be Forgotten (Art. 17).
- Restriction of processing (Art. 18), Data portability (Art. 20).
- Objection (Art. 21), including objection to automated decision-making and profiling.
- Lodge a complaint with your Member State's supervisory authority. UK residents: Information Commissioner's Office (ICO) at ico.org.uk.
5.3 CCPA Rights (California residents)
- Right to know what personal data is collected, used, disclosed, and sold.
- Right to delete personal data.
- Right to opt-out of the sale or sharing of personal data (App Mestre does not sell personal data).
- Right to non-discrimination for exercising CCPA rights.
- Right to correct inaccurate personal information (CPRA).
To exercise any right: privacidade@appmestre.app. We will respond within 15 business days (LGPD) or 30 calendar days (GDPR/CCPA).
6. Data Retention
- Active account data: Retained for the duration of the account.
- After cancellation: Anonymized within 90 days, except data required for: (a) legal and tax obligations — retained for 5 years; (b) legal proceedings — retained until final judgment.
- Access logs: Stored for 6 months per Brazil's Internet Act (Lei 12.965/2014, Art. 15).
7. Information Security
- Encryption in transit: TLS 1.2+ / HTTPS on all communications.
- Password encryption: bcrypt with individual salt.
- Access control: RBAC with least-privilege principle.
- Authentication: Two-factor authentication (2FA) available.
- Monitoring: Audit logs for critical actions and anomaly detection.
- Backups: Daily, automated and encrypted, sent to S3 storage, with 30-day retention.
In the event of a security incident affecting your rights and freedoms, we will notify the ANPD and affected data subjects within legal timeframes (LGPD Art. 48; GDPR Art. 33: 72 hours).
8. International Data Transfers
- Stripe (USA): PCI-DSS Level 1; EU-US Data Privacy Framework participant.
- OVH (France): Platform servers. Within EU/EEA — automatic adequate protection (GDPR).
- Resend/Brevo (USA/France): EU Standard Contractual Clauses (SCCs).
- OpenAI (USA): SCCs approved by the European Commission; LGPD Art. 33 compliant.
- PostHog: EU storage option; IP anonymized before any transfer.
9. Cookies
We use cookies and similar technologies. For full details, see our Cookie Policy.
10. Children
The Platform is not directed at children under 13. For users aged 13–17 (Students), we require parental or legal guardian consent, in compliance with LGPD Art. 14 and GDPR Art. 8.
11. Changes to This Policy
This Policy may be updated periodically. We will notify material changes by email and/or Platform notification with at least 15 days' advance notice.
12. Contact and Complaints
- DPO / LGPD Officer: privacidade@appmestre.app
- Supervisory authority (Brazil): ANPD — gov.br/anpd
- Supervisory authority (EU): Your Member State's data protection authority.
- Supervisory authority (UK): Information Commissioner's Office — ICO (ico.org.uk)
- Supervisory authority (USA/CA): California Privacy Protection Agency (cppa.ca.gov)
App Mestre Tecnologia • CNPJ 48.844.509/0001-47 • Florianópolis, SC, Brazil • privacidade@appmestre.app