Privacy Policy

Clazzye is the name of the product operated by Edison Cristovao Codes Ltda, registered under CNPJ 43.758.252/0001-97, headquartered in São José/SC, Brazil ("Clazzye", "we").

We act in two distinct roles: (i) as CONTROLLER of the account data of whoever contracts the service (the "owner"), of website visitors and of technical usage data; and (ii) as PROCESSOR of the data the owner enters about third parties in their workspace (teachers and students), which we process under the owner's instructions, the owner being the controller of that data.

Data Protection Officer (DPO): Edison Cristóvão Junior, at edison@cristovao.codes.

Owners: people who create an account and contract the platform to organize their lessons.

Teachers and students (and their legal guardians): people registered by an owner in a workspace.

Website visitors: people browsing clazzye.com.

When you are a teacher, student or guardian, the owner who registered you is the controller of your data; in those cases Clazzye acts as processor and your rights requests may be handled through the owner.

Personal data: information relating to an identified or identifiable natural person.

Sensitive personal data: data on racial/ethnic origin, religious belief, political opinion, health, sex life, genetic or biometric data, among others. Clazzye does not request sensitive data; please do not enter it in free-text fields (such as notes).

Data subject: the natural person the data refers to. Processing: any operation with personal data (collection, use, storage, sharing, deletion, etc.). ANPD: Brazil's National Data Protection Authority.

Account and profile data (owner): name, email, phone, password (stored hashed/encrypted), profile photo, color and language preference.

Workspace content entered by the owner: name, email, phone, subjects, notes and lesson history of teachers and students; and, for underage students, the legal guardian's name, email and phone.

Usage and operational data: lessons, bookings, invoices, payment status, uploaded receipts and records of acceptance of the Terms and Policy (date/time, version, IP and user-agent).

Technical and log data: IP address, device/browser identifiers, access dates/times and security events, retained also to comply with Brazil's Internet Civil Framework (Marco Civil da Internet).

Payment data: processed directly by the payment provider. Clazzye does not collect or store full card numbers; we process only data needed for reconciliation (e.g., transaction id, status, amount and, where applicable, the owner's receiving PIX key).

Google data (when you connect Google Calendar): authorization tokens and the calendar data strictly necessary to create and manage lesson events and Google Meet links.

Directly from you, when you create the account, fill in forms, set up the workspace or contact us.

Automatically, through cookies and technical logs, when you use the website and the platform.

From third parties: data the owner enters about teachers and students; status information returned by the payment provider; and Google calendar data when you authorize the integration.

Performance of contract (art. 7, V): create and maintain your account, operate the schedule, issue invoices, process charges and provide support.

Compliance with a legal or regulatory obligation (art. 7, II): retention of access logs, tax and accounting obligations and responses to legal requests.

Legitimate interest (art. 7, IX): information security, fraud prevention, maintenance, internal metrics and continuous service improvement, always balanced against your rights and expectations.

Consent (art. 7, I): marketing communications (where applicable) and, in the owner's flow, the legal guardian's consent for processing underage students' data (art. 14).

Regular exercise of rights (art. 7, VI): defense in judicial, administrative or arbitration proceedings.

We do not sell personal data and do not use it for third-party advertising. We share data only with providers that help us operate the service (sub-processors), under contract and only as necessary:

Supabase — database, authentication and file storage (data infrastructure hosting).

Vercel — hosting and execution of the website and application, including queues and scheduled tasks.

Resend — delivery of transactional emails (invites, confirmations and notices).

Google — Google Calendar and Google Meet, when you connect the integration.

Pagou — payment processing (subscriptions, PIX and card) and split.

We may also share data to comply with a legal obligation or order from a competent authority and, in a corporate reorganization (merger, acquisition or asset sale), subject to confidentiality and continuity of this Policy.

The list of sub-processors may change; material changes will be reflected in this Policy and, where required, communicated.

Clazzye's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

We use Google data exclusively to provide and improve user-facing scheduling features (event creation and meeting links). We do not use this data to train generalized AI/ML models, do not use it for ads, and do not allow humans to read it except with your consent, for support, security, to comply with the law, or as strictly necessary for an internal operation in line with Google's policy. You can revoke access at any time by disconnecting the integration.

Clazzye subscription charges and student payments are processed by the payment provider (Pagou). The full card number is provided directly to the provider and neither passes through nor is stored on our servers.

When split is enabled, the amount paid by the student is automatically divided between the owner and Clazzye according to the disclosed fees. The commercial and tax relationship between the owner and their students is the owner's responsibility.

We use cookies and local storage essential to operation, authentication and security (e.g., to keep your session and your language and theme preferences).

Should we introduce non-essential cookies (such as third-party analytics), we will request your consent via a specific notice that you can manage.

Some sub-processors (e.g., Supabase, Vercel and Google) may process data on servers located outside Brazil. In such cases we ensure the transfer occurs with the adequate safeguards provided by arts. 33 et seq. of the LGPD, such as data protection contractual clauses.

The platform is contracted by adults (owners). Data of underage students is entered by the owner, who declares and warrants having the specific, prominent consent of at least one parent or legal guardian, under art. 14 of the LGPD.

Processing of children's and adolescents' data always observes their best interest and is limited to what is necessary to provide the service. The guardian may request access, correction or deletion of the minor's data through the owner or our contact channel.

We adopt technical and organizational measures to protect data against unauthorized access and accidental or unlawful situations, including encryption in transit (HTTPS), role-based access control, logical isolation of data per workspace, least-privilege principle and audit logs.

No system is entirely risk-free; we work continuously to mitigate vulnerabilities and preserve the integrity and confidentiality of data.

We keep personal data for as long as necessary to fulfill the purposes of this Policy and while the account is active.

After the account is closed, we delete or anonymize the data, except where retention is required to comply with a legal or regulatory obligation (e.g., access logs and tax documents) or for the regular exercise of rights.

If a security incident occurs that may pose relevant risk or harm to data subjects, we will notify the ANPD and the affected data subjects within a reasonable time, with the information required by art. 48 of the LGPD, and take appropriate measures to mitigate the effects.

You may, at any time, request: confirmation that processing exists; access to the data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary, excessive or non-compliant data; portability; deletion of data processed based on consent; information about sharing; information about the possibility of withholding consent and its consequences; and withdrawal of consent.

To exercise your rights, contact the DPO at edison@cristovao.codes. We may request information to confirm your identity. If you are not satisfied, you have the right to file a complaint with the ANPD.

Clazzye does not make solely automated decisions that produce legal effects or significantly affect data subjects. Should that occur, you may request a review under art. 20 of the LGPD.

We send transactional communications necessary to the service (e.g., invites, confirmations and billing and security notices), which do not depend on consent as they are inherent to performance of the contract.

Marketing communications, where they exist, depend on consent and can be opted out of at any time.

We may update this Policy to reflect changes in the service or in the law. The current version is identified by the update date shown at the top; material changes will be communicated and, where applicable, will require renewed acceptance on your next access to the platform.

Questions about this Policy or about the processing of your data may be sent to the DPO at edison@cristovao.codes or to Edison Cristovao Codes Ltda (CNPJ 43.758.252/0001-97), in São José/SC, Brazil.