Privacy Policy and Data Protection (LGPD)

1. Controller and DPO

Controller: YakshaTech, responsible for decisions regarding personal data processing on the Gyeniusx platform.

Data Protection Officer (DPO): privacidade@yakshatech.com.

General support: contato@gyeniusx.com.

2. Personal data we collect

We may process the following categories:

• Registration data: name, email, password (stored encrypted), and language preferences.
• Usage data: access logs, IP address, device/browser identifiers, pages visited, timestamps, and feature interactions.
• Subscription data: plan, usage limits, consumption history, and payment data processed by payment providers when applicable.
• User Content: documents, videos, transcripts, chat messages, flashcards, quizzes, and other study materials you upload.
• Support data: information voluntarily provided when contacting our team.

3. Purposes and legal bases (LGPD, Art. 7)

We process personal data for the purposes below with the corresponding legal bases:

• Service delivery and contract performance (registration, authentication, material processing, chat, flashcards, quizzes): contract performance (Art. 7, V).
• Platform security, fraud prevention, and legal compliance: legal/regulatory obligation and legitimate interest (Art. 7, II and IX).
• Operational communications (confirmations, limit notices, terms updates): contract performance and legitimate interest.
• Product improvement and aggregated performance metrics: legitimate interest with minimization and anonymization when possible.
• Marketing communications: consent when required, with opt-out options.

4. Sharing and processors

We do not sell your personal data. We may share it with processors and partners strictly necessary to operate the Platform, including:

• Cloud hosting and infrastructure providers.
• File storage services (e.g., Cloudflare R2 or equivalent).
• AI model providers for content processing and response generation.
• Payment processors when paid plans are available.
• Monitoring, security, and analytics tools when used.
• Public authorities when required by law or court order.

5. International data transfers

Some processors may process data on servers outside Brazil. In such cases, we adopt contractual clauses, impact assessments, and security measures compatible with LGPD, including mechanisms under LGPD Arts. 33–36.

6. Retention and deletion

We retain personal data as long as necessary for the purposes described, legal obligations, rights enforcement, and dispute resolution.

User Content remains stored while the Account is active or according to product retention settings. After account deletion, we apply deletion or anonymization timelines compatible with backups and legal requirements.

Security logs may be retained longer for incident investigation.

7. Information security

We implement technical and administrative measures proportional to risk, including password encryption, HttpOnly authentication cookies, access controls, environment segregation, and monitoring.

No system is 100% secure. In case of a relevant incident, we will take mitigation and notification measures as required by LGPD.

8. Cookies and similar technologies

We use essential cookies for authentication, session maintenance, language preference, and security. These cookies are necessary for Platform operation.

Analytics or marketing cookies, if implemented, will be disclosed via a specific banner with consent options when required.

You may manage cookies in your browser; disabling essential cookies may prevent use of parts of the Platform.

9. Data subject rights (LGPD, Art. 18)

Under LGPD, you may request:

• confirmation of processing;
• access to data;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary or non-compliant data;
• portability, when applicable;
• deletion of consent-based data, subject to legal retention exceptions;
• information about sharing;
• information about the possibility of withholding consent and consequences;
• withdrawal of consent;
• objection to processing based on legitimate interest, when applicable.

10. How to exercise your rights

Send requests to privacidade@yakshatech.com with your name, registered email, and request description. We may ask for additional identity verification.

We will respond within legal deadlines. If we deny a request, we will explain reasons and complaint channels.

You may also file a complaint with Brazil's National Data Protection Authority (ANPD).

11. Children and adolescents

The Platform is not intended for children under 13. Users aged 13–18 should use the service with supervision and guardian authorization when required.

If we identify improper processing of minors' data, we will take steps to delete data or obtain appropriate consent.

12. Changes to this Policy

This Policy may be updated periodically. The last revision date appears at the top of this page.

Material changes may be communicated by email or in-app notice.

13. Contact

DPO: privacidade@yakshatech.com

Support: contato@gyeniusx.com