Privacy Policy

1. Who the controller is

The controller of your data is Dedux, [legal name, CNPJ and address to be filled in].

For any request about your data, write to contato@usededux.com.

Data protection officer (encarregado): [name to be defined]. For now, the officer is reachable at the same address.

2. Data we receive from Google

When you use “Sign in with Google”, Dedux asks Google only for the openid, email and profile scopes. With them, we receive:

• your name;
• your e-mail address;
• the address (URL) of your profile photo;
• your Google account identifier (called sub), used to recognise your account even if your e-mail changes;
• whether Google has verified your e-mail.

We use this data to create and keep your account, recognise you when you sign in and address you by name. The photo is stored with your account and is not shared.

Dedux does not receive your Google password, your contacts, your Drive files, your Gmail messages or anything beyond these scopes.

Dedux's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can remove Dedux's access to your Google account at any time at myaccount.google.com/permissions. To delete your Dedux account and your data, see section 8.

3. Other data we process

• Date of birth. Dedux asks for it at sign-up, to know whether you can have an account of your own (see section 4).
• E-mail for code sign-in. As an alternative to Google, you can sign in with a one-time code we send to your e-mail.
• Learning records. Each of your interactions with a task: answers, errors, hints used, time and abandonment. From these records, the platform estimates your learning state, and that estimate is stored too.
• Technical data. The device description your browser provides, the IP address and time of each access, and errors that happen during use.

4. People under 18

Only people aged 18 or over create an account on their own. People under 18 use Dedux through a parent or guardian or through an educational institution. In those cases, the guardian or the institution gives consent and answers for it (LGPD, art. 14).

5. What we use the data for

• Running the service: choosing your next task, showing your progress to you and, when you are part of a class, to the teacher or the institution.
• Security: limiting the number of requests and preventing abuse.
• Billing: when there is a paid plan.
• Improving the platform: revising maps and tasks.

6. Legal bases

Each processing activity relies on a legal basis from art. 7 of the LGPD:

• Performance of a contract (item V): the account and the service.
• Compliance with a legal obligation (item II): billing records and access records, required by Brazil's Internet Civil Framework (Marco Civil da Internet, Lei 12.965/2014, art. 15).
• Legitimate interest (item IX): security and service logs.
• Consent of the guardian or the institution (art. 14): use by people under 18.
• Improving maps and tasks: [legal basis to be confirmed in the legal review].

7. How long we keep data

• Account data: while the account exists. After you delete your account, your personal data is deleted within 30 days.
• Learning records: they are not deleted, but they are irreversibly unlinked from you. They get a new identifier with no way back to you; the institution is replaced by a broad group; the date is cut down to the month; no free text is kept. These anonymised records are still used to improve the platform. Anonymised data is no longer personal data (LGPD, art. 12).
• Billing and audit records: 5 years.
• Access records (IP, date and time): 6 months.
• Service logs: 14 to 30 days.
• Browser error reports: 90 days.
• Backups: follow each provider's retention cycle.

These periods are provisional and depend on legal review.

8. Your rights

Under art. 18 of the LGPD, you can ask for:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate or outdated data;
• anonymisation, blocking or deletion of data that is unnecessary, excessive or processed against the law;
• portability of your data;
• information about whom we share your data with;
• withdrawal of consent, where consent is the legal basis;
• objection to processing you consider unlawful.

You can also ask for a review of decisions taken only on the basis of automated processing (LGPD, art. 20). This matters here: the platform estimates your learning state automatically and uses that estimate to choose your next tasks. If you disagree, you can ask for a person to review the estimate.

How to ask

• In the app, under Conta → Seus dados (Account → Your data), you export your data and delete your account.
• For any other request, write to contato@usededux.com.

We answer within 15 days. You can also petition Brazil's National Data Protection Authority (ANPD).

9. Processors and international transfer

To work, Dedux uses providers that process data on its behalf (processors). Some are outside Brazil:

• Cloudflare: hosts the site and the app, handles network and security, and stores media files (R2). Company in the United States, with a global network.
• Fly.io: runs the API on servers in São Paulo, Brazil. Company in the United States.
• Neon: database, hosted in São Paulo (AWS, region sa-east-1). Company in the United States.
• Resend: sends e-mail, such as sign-in codes. United States.
• Google: sign-in with Google. United States.
• Bunny.net: video delivery. Company in Slovenia (European Union), with servers in Frankfurt and a replica in São Paulo.

International transfers rely on art. 33 of the LGPD, with contractual clauses under the ANPD regulation (Resolução CD/ANPD nº 19/2024). [each provider's mechanism to be confirmed]

Dedux does not sell personal data and does not use it to train third-party models.

10. Cookies and browser storage

We use only what the service needs to work. We do not use advertising or tracking cookies.

• __Host-dedux_session: keeps you signed in. It is HttpOnly, Secure and SameSite=Lax. It lasts up to 30 days, is renewed from time to time and is removed when you sign out.
• __Host-dedux_google: exists only during sign-in with Google: up to 10 minutes while you are at Google, and up to 15 minutes if Dedux asks for your date of birth to create the account. It protects the sign-in against forgery.
• __Host-dedux_guardian: exists only when a guardian enters as the child, and keeps the guardian's own session aside.
• CF_Authorization: Cloudflare Access cookie on app.usededux.com, used during the testing phase to limit access to invited people.
• The browser's local storage: keeps your preferences and remembers who is signed in on that device.

These cookies are strictly necessary and do not depend on consent. If you block them, you will not be able to sign in.

11. Changes to this policy

We announce relevant changes in the app and by e-mail, in advance [notice period to be defined]. The current version is always the one on this page.