Privacy Policy

1. Data Controller and Collection

Data Controller: Lumina Serviços de Consultoria LTDA, CNPJ 57.150.909/0001-43, Santa Bárbara d'Oeste, SP, Brazil.

Data collected:
• Account and session: Firebase Authentication for sign-in, sync, and continuity of use.
• Learning Profile: editing patterns, response times, hint usage, and challenge events to adapt the experience.
• Web: local storage and essential cookies for session state, preferences, and local progress.
• Payment: data processed by Stripe (web) and RevenueCat (mobile), as described in section 5.
• Analytics: aggregated usage events to improve the service.

2. Use of AI (Google Gemini) and BigQuery

We use the Google Gemini AI model to generate debugging challenges, analyze code you submit, and produce educational hints and feedback. When you submit code for analysis, it is sent to Google Gemini via our secure proxy (Cloud Function) for processing.

Important:
• Your code is NOT used to train AI models.
• Processing is automated for educational purposes.

Operational and event data may be processed in Google Cloud and BigQuery to improve difficulty algorithms, product quality, security, and aggregated metrics.

3. Data Sharing

We share data only with essential providers needed to operate the service:
• Firebase/Google Cloud: authentication, storage, and hosting
• BigQuery: aggregated event analysis
• Stripe: payment processing (web)
• RevenueCat: subscription management (mobile)

We do not sell your personal data. Data may be shared when required by law or court order.

4. Storage and Retention

Data is stored on infrastructure used to operate the service. Retention periods:
• Account data: retained while the account exists and deleted immediately upon account deletion.
• Analytics and behavior events: 24 months.
• Payment data: per fiscal obligations (up to 5 years).
• User feedback: 12 months.
• Shared code: as defined by the user or until account deletion.

5. Your Rights (LGPD)

Under the LGPD (Art. 18), you have the right to:
• Confirmation of data processing
• Access to your personal data
• Correction of incomplete or outdated data
• Anonymization, blocking, or deletion of excessive data
• Data portability
• Deletion of data processed with consent
• Information about entities with whom data was shared
• Revocation of consent

Deadline: requests are fulfilled within 15 days.
Channels: email support@doesithold.ai or via Settings > Privacy.

6. Contact and Data Protection Officer (DPO)

Data Protection Officer (DPO):
Lumina Serviços de Consultoria LTDA
Email: support@doesithold.ai
Address: Santa Bárbara d'Oeste, SP, Brazil

To exercise your data subject rights or report security incidents, contact us at the email above.

7. Legal Basis for Processing

We process your data based on the following legal bases (Art. 7, LGPD):
• Contract performance (Art. 7, V): to provide the core service, including progress sync and account management.
• Consent (Art. 7, I): for sending code to Google Gemini for analysis, non-essential cookies, and marketing communications.
• Legitimate interest (Art. 7, IX): for security, fraud prevention, service improvement, and aggregated analytics.
• Legal obligation (Art. 7, II): for retention of fiscal and payment data.

8. International Data Transfers

Your data may be transferred to and processed in the United States of America by the following providers:
• Google Cloud / Gemini: AI code analysis processing
• Stripe: payment processing
• RevenueCat: mobile subscription management

As the U.S. does not have an adequacy decision from the ANPD, we adopt the following safeguards:
• Standard Contractual Clauses (SCCs) per ANPD Resolution CD/ANPD No. 19/2024
• Data Processing Agreements (DPAs) with each provider
• Data minimization for transferred data

We use the southamerica-east1 (São Paulo) Google Cloud region for data storage whenever possible.

9. Children's Data

DoesItHold is not directed at children under 16 years of age. We do not knowingly collect data from children or adolescents. If we learn that we have collected data from a minor without parental consent, we will take steps to delete that data. Parents or guardians who believe a minor has provided personal data should contact: support@doesithold.ai.

10. Data Security

We adopt technical and organizational measures to protect your data:
• Encryption in transit (TLS) and at rest
• Firebase App Check for request authenticity
• Prompt injection protection for AI interactions
• Rate limiting to prevent abuse
• Role-based access control
• Security event monitoring

No system is 100% secure. In the event of a security incident affecting your personal data, we will notify the ANPD and affected data subjects as required by Art. 48 of the LGPD.