Privacy Policy
Version 2026-11-07 · Effective November 7, 2026
1. Controller. [RAZÃO SOCIAL], CNPJ [CNPJ], [ENDEREÇO], is responsible for your personal data. Contact for any privacy request: [E-MAIL DE CONTATO].
2. What we collect and why.
| Data | Examples | Why we use it |
|---|---|---|
| Account | Name, email, password (stored hashed), photo, time zone, language | To create your account and show times in your time zone |
| Guardian and children | Guardian's phone; child's name, date of birth, level, goals, musical interests | To let a parent manage a child's lessons and adapt teaching to the child |
| Lessons | Bookings, teacher notes and comments, attendance proof, materials, activities | To deliver and follow up your lessons, also when you change teacher |
| Your files | Photos or PDFs of completed activities | So your teacher can review your work |
| Payments | Plan bought, amounts, payment status | To sell lessons and manage refunds. Card details are handled by Stripe and never stored by Artual |
| Google (optional) | Google sign-in; calendar events if you connect your calendar | To let you sign in with Google and add lessons to your calendar |
| Consent records | Who consented, version, date, IP address, browser | To prove a parent's consent for a child |
| Technical | Session and language cookies, security logs | To keep you signed in and protect the service |
We do not sell personal data and do not use it for advertising.
3. Who we share it with. Only service providers that run Artual for us, under contract: Stripe (payments), Google (sign-in and calendar, if you choose), [PROVEDOR DE E-MAIL] (emails), [PROVEDOR DE ARMAZENAMENTO] (file storage) and [PROVEDOR DE HOSPEDAGEM] (servers). Your current teachers see your learning history; a former teacher only sees what they created. We may disclose data when required by law.
4. International transfers. Artual is based in Brazil and our providers may process data in the United States and other countries, with safeguards required by law.
5. How long we keep it. Account data is kept while your account is active. Files submitted for activities are deleted 365 days after the activity is closed, and you can delete them earlier. Payment and tax records are kept for the period required by law. When you close your account, we delete or anonymize the rest.
6. Children. Children's data is collected only through a parent or guardian's account and with the guardian's consent (see Parental Consent). For a child, only the guardian can upload files, and only after giving consent and making a card payment. A guardian can review, correct or delete a child's data, or withdraw consent, at any time.
7. Your rights. You can ask to access, correct, delete or receive a copy of your data, and to withdraw consent, under Brazil's LGPD and the laws of the place where you live. Write to [E-MAIL DE CONTATO]; we answer within 15 days.
8. Security. Passwords are hashed, files are private and opened only through short-lived links after a permission check, and payment data stays with Stripe.
9. Changes. We will notify you of material changes and ask you to accept the new version.