Privacy Policy

1. Data we collect

Account data: email, username, hashed password, OAuth identifier (if you sign in with Google).

Usage data: lessons completed, XP, streak, Bug Hunt solves, flashcard reviews. We use this to power gamification.

Payment data: handled by Paddle, our Merchant of Record. Paddle collects your name, billing address, tax information, and payment method to process the transaction; DataForge never sees or stores your card number. We only receive a Paddle customer ID, subscription status, and the country/currency needed to keep your access in sync.

Analytics: aggregated page views and events (via Google Analytics 4) to understand which features are useful.

2. How we use it

Provide the Service (track progress, unlock content, show your level and streak). Legal basis: performance of the contract with you.

Process payments and manage your subscription (via Paddle as Merchant of Record). Legal basis: contract performance and legal obligations (tax/invoicing).

Send transactional emails (welcome, receipts, password reset, re-engagement). Legal basis: contract performance and legitimate interest in supporting active users. We do not send marketing without opt-in.

Improve the platform — fixing bugs, prioritizing new content, debugging issues. Legal basis: legitimate interest.

Comply with legal obligations and prevent fraud. Legal basis: legal obligation and legitimate interest.

3. Who we share with

Paddle.com Market Ltd (Merchant of Record for payments, billing, tax, invoicing, refunds and fraud prevention) — see https://www.paddle.com/legal/privacy.

Google (analytics and 'Sign in with Google').

Supabase / Lovable Cloud (database, authentication and hosting infrastructure).

Our AI tutor provider (only the question you submit is sent, no account identifiers).

Professional advisers and authorities where required by law.

We do not sell or rent personal data. Period.

4. International transfers

Some processors above are located outside your country (e.g. the EEA, UK, or Brazil). Where transfers occur, we rely on the safeguards our processors provide (standard contractual clauses, adequacy decisions, or equivalent).

5. Cookies

We use strictly necessary cookies and local storage to keep you signed in and remember your language preference, plus analytics cookies (Google Analytics 4). You can clear or block them in your browser settings at any time.

6. Your rights

Under GDPR and LGPD you have the right to access, rectify, erase, restrict, port, and object to processing of your personal data, and to withdraw consent at any time. You may also lodge a complaint with your local supervisory authority (in Brazil, the ANPD; in the EU, your national DPA). To exercise your rights, email luk14236@gmail.com; we respond within 30 days.

For payment-related data, you can also contact Paddle directly at privacy@paddle.com.

7. Data retention

We keep account and progress data while your account is active. If you delete your account, we remove personal data within 30 days, except for records we must keep for tax, accounting or legal reasons (e.g. invoices, kept by Paddle for the period required by law).

8. Security

Passwords are hashed. All traffic is encrypted in transit (HTTPS). Database access uses Row-Level Security so only you can see your data. Access to production systems is restricted. We still recommend a strong, unique password and 2FA on your Google account if you sign in with Google.

9. Contact

Privacy questions or data requests? Email luk14236@gmail.com. Controller: Lucas Santos de Oliveira, trading as DataForge.