Privacy Policy

1. Controller and contact

The data controller is TurtAI. For any privacy matter, including exercising your rights, write to suporte@turtai.ai.

2. Data we collect

Account: name, email and password (stored encrypted by our authentication provider; we have no access to it).

Preferences: language and time zone, so your training day starts and ends at the right time.

Training: challenge answers, scores, evaluations, AI Score, XP, level, streaks and achievements.

Technical data: IP address and approximate country (for security and to show your region's price), browser type and access logs.

Payments: plan, status and the purchase reference code. Payment details stay with Paddle or Mercado Pago; we never receive your card number.

3. How we use it

To provide the service: create your account, show challenges, evaluate answers and track your progress (legal basis: performance of contract).

Billing and legal obligations: process payments and keep tax records (legal basis: contract and legal obligation).

Security and improvement: prevent fraud and abuse, fix bugs and understand, in aggregate, how the service is used (legal basis: legitimate interest).

Emails: we send messages required for your account (confirmation, password, billing). Marketing messages only with your consent, which you can withdraw at any time.

We do not sell your data and we do not use your answers for advertising.

4. Who we share it with

We use providers that process data on our behalf and only to deliver the service: Supabase (database and authentication), Vercel (hosting), Anthropic (AI model that evaluates answers), Resend (email delivery), Paddle and Mercado Pago (payments).

Answers sent for evaluation are not used by the AI provider to train models, under the provider's commercial terms.

We may also share data when required by law or to protect users' rights and safety.

5. International transfers

Some providers are located outside Brazil and the European Union. In those cases, we rely on the safeguards provided by the LGPD and GDPR, such as standard contractual clauses.

6. How long we keep it

We keep your data while your account exists. If you ask for deletion, we delete or anonymize your data within 30 days, except what the law requires us to keep (such as payment records, for the applicable tax period).

7. Your rights

You can: confirm whether we process your data; access it and receive a copy; correct it; request deletion; request portability; object to processing; and withdraw consent. Just write to suporte@turtai.ai. We reply within 15 days.

You may also complain to the data protection authority in your country (in Brazil, the ANPD).

8. Cookies

We only use essential cookies: the login session cookie and the one that stores your language choice. We do not use advertising cookies.

9. Public profile and leaderboard

The leaderboard and the share link only show your short name (first name and last initial) and training numbers. Your email and answers are never public. You can leave the leaderboard in your profile.

10. Security

We use encrypted connections (HTTPS), per-user access control in the database and restricted staff access. No system is 100% secure; if a significant incident occurs, we will notify you and the authorities as required by law.

11. Children

The service is not intended for anyone under 16. If we learn that we collected data from someone under 16 without permission, we will delete it.

12. Changes

We may update this Policy. The date at the top shows the version in force; significant changes will be announced by email or in the service.