Privacy policy

1. What data is processed

From the teacher or school that subscribes: name, email, phone and the details needed to bill the subscription. Card data is tokenized by Stripe and is never stored by Aulency.

From the student, registered by the teacher or the school: name, contact details, guardian details where applicable, phone in international format where there is authorization to receive WhatsApp messages, class history, invoices and class reports, which may include a photo.

From use of the system: access logs, IP address, date and time of actions, and technical browser information. On aulency.com.br, also what is described in the cookies section.

2. What each piece of data is used for, and who answers for it

Performance of the contract: account details, schedule, invoices and reports are processed to deliver the service you subscribed to. Legal basis: article 7, item V, of the LGPD.

Consent: WhatsApp messages to the student or guardian and analytics tools on the site operate only with prior consent, which can be withdrawn at any time. Legal basis: article 7, item I.

Legal obligation: billing records are kept for the period the law requires. Legal basis: article 7, item II.

Who answers for what: for the data of the teacher or school that subscribes, Aulency is the controller. For student data, the controller is the teacher or the school that registered them, and Aulency acts as processor, handling that data under the instruction of the controller.

3. Who the data is shared with

The list is by name, not generic. Supabase: database, authentication and file storage. Stripe: card, boleto and subscription processing. Meta: message delivery through the WhatsApp Cloud API, only where the recipient has authorized it. Amazon Web Services: transactional email delivery. Google: writing lessons into Google Calendar, only if the teacher connects their own account. Vercel: hosting for aulency.com.br. Sentry: technical error logging for the application. PostHog: product usage measurement.

On aulency.com.br, Google Analytics 4 and the Meta Pixel load only after you accept in the cookie notice. Before that, neither one runs.

The data is not sold and is not used for third-party advertising.

International transfer: the Aulency database sits in the São Paulo region, in Brazil. Some of the providers above process data outside the country, which article 33 of the LGPD permits where the provider offers adequate safeguards.

4. Data subject rights (LGPD, article 18)

You can request access, correction, deletion, anonymization, portability and information about who your data has been shared with. You can also withdraw consent at any time.

The channel is contact@aulency.com.br and the response time is up to 15 days. There is no self-service button for this: a person handles the request.

If you are a student, your record was created by the teacher or the school, which is the controller of that data. Talk to whoever registered you first. If you get no answer, write to us and we forward the request to the controller.

5. Security

The measures in place: row-level isolation in the database (Row Level Security on PostgreSQL), so a query returns only the rows of the authenticated teacher or school; encryption in transit over TLS and encryption at rest in storage; managed authentication, with passwords never stored in plain text; and provider credentials separated per environment.

Card data never touches Aulency servers at any point: the payment happens inside the Stripe environment.

The database sits in the São Paulo region, in Brazil.

No system is immune to incidents. If a security incident occurs with relevant risk to data subjects, we notify those affected and the Brazilian Data Protection Authority, as article 48 of the LGPD requires.

6. Cookies and measurement

The site uses essential cookies to remember the language you chose, the light or dark theme and your answer to the cookie notice. These do not depend on consent because without them the site does not behave the way you asked it to.

Analytics tools (Google Analytics 4, Meta Pixel and PostHog) load only after you accept. If you decline, none of them runs, and the refusal is recorded in your browser.

Origin parameters (UTM), with no personal data, are kept temporarily in the session to identify which channel brought you here and accompany your request. Using them in analytics tools and writing them to a cookie depend on your acceptance.

7. Requests from teachers and schools

Our contact forms collect your name, WhatsApp number, email and student range. For individual teachers, we also collect your plan of interest, how you found us and a description when you select Other. For schools, we collect the school name. Submissions include the language, available origin parameters (UTM) and, for teachers, the button that led to the form. We use these details only to respond to your request and discuss access to Aulency. Legal basis: consent (article 7, item I, of the LGPD).

Web3Forms processes form submissions and delivers the request to the Aulency team by email. Submissions work even if you decline analytics tools. You can request data removal at contact@aulency.com.br.

8. Channel for data protection matters

The LGPD calls for naming a data protection officer. Resolution CD/ANPD no. 2/2022 exempts a small-scale processing agent from that appointment, as long as it keeps a communication channel open with data subjects. That is where Aulency stands today.

The channel is contact@aulency.com.br. Requests for access, correction and deletion of data go through it, and it is also how the Brazilian Data Protection Authority reaches us. If the exemption stops applying, we appoint an officer and publish the name on this page.