Privacy Policy

Name, email, password protected by cryptographic mechanisms, optional profile picture, preferred language, plan information, account status, and user preferences.

When you log in through external providers, such as Google or other authentication services, we may receive your name, email, profile picture, provider identifier, and technical data necessary for authentication.

Files, PDFs, videos, links, texts, prompts, questions, answers, notes, tutor conversations, imported materials, file names, document metadata, transcripts, extracted excerpts, and other content provided or generated while using the platform.

In the app, you can also photograph notebook pages or exercises with your phone camera or choose images from your gallery to create materials, summaries, or questions for the tutor. Access to the camera and photos is only requested when you use these features, and we only send the images you choose or take. The app does not record audio or use the microphone.

Summaries, flashcards, quizzes, exercise answers, explanations, study recommendations, interaction history, materials created, edited, saved, or deleted, and results from use of the features.

Features accessed, frequency of use, interaction time, navigation events, clicks, quiz answers, activity performance, preferences, language, settings, and study progress, when applicable.

IP address, approximate location derived from IP, device type and identifiers, operating system, browser, application version, pages visited, clicks and interactions, access records, logs, performance data, errors, failures, cookies, localStorage, the Android advertising identifier (GAID; on iOS, the app does not access the IDFA), app installation data, and in-app events such as opens, actions, and conversions.

In the app, we also process a random installation identifier, created by the app itself and stored on the device, used to control the free preview; the device push notification token; and the device time zone, used to send messages and reminders at suitable times.

Messages sent to support, feedback, survey responses, support requests, email interactions, and records necessary to resolve questions or issues.

Email, name, receipt preferences, consents, campaign source, message opens, clicks, and interactions with communications, when applicable.

We also process data about how you found Supernapse: install attribution data received from AppsFlyer (attribution status, media source, campaign, ad set, and campaign parameters af_sub1 to af_sub5) and your answer to “How did you hear about Supernapse?”, including the optional free text of up to 80 characters. For the messages described in sections 3.5, 3.6, and 14, we record when you closed the plans screen without subscribing, the time zone used for sending, and the history of messages sent. When you subscribe to or unsubscribe from promotional emails, we record the date, the source of the choice, and, when available, the IP address and the browser or app used. When you accept or stop offer push notifications, we record the choice, the screen where it was made, and the date.

Subscribed plan, subscription status, transaction identifiers, tax information, billing data, and data processed by payment providers. Supernapse does not seek to store full card numbers when payment is processed by specialized third parties.

Supernapse does not ask users to submit sensitive personal data, such as health data, biometrics, racial or ethnic origin, political opinion, religion, sex life, genetic data, or union membership. If the user enters this type of information in study materials, prompts, or files, we will process the content only to the extent necessary to provide the service, protect the platform, comply with legal obligations, or respond to the user’s own requests. We recommend not entering unnecessary sensitive data or third-party data without authorization.

After creating your account and before subscribing, you can send a PDF for a free preview. To create 3 questions, we use the text of the first pages of the file or, when the text cannot be read, images of up to 3 pages. We store the questions, the excerpts of your material used in them (up to 400 characters each), your answers, the number of correct answers, and the date and time you confirmed the AI processing notice.

The PDF sent in the preview is kept in your account and used to prepare a free study kit (for example, summary, questions, flashcards, and mind map) from its first pages, within the limits shown in the app. The file and the kit remain available until you delete the material or the account.

So that the free preview is used once per device, the server keeps a code derived from the app installation identifier, protected by a cryptographic hash with a secret key. The record used for this control keeps only this code and its creation date, with no name, email, or link to the account. While the account exists, the code is also kept in the account’s preview record, which is deleted together with it. See section 10.6.

We use name, email, protected password, login data, and preferences to create, authenticate, maintain, and administer your account. Main legal basis: performance of a contract or preliminary procedures related to the service.

We use study content, prompts, files, answers, interactions, and data generated by the platform to produce summaries, flashcards, quizzes, explanations, contextual tutor features, and other resources. Main legal basis: performance of a contract.

We use prompts, files, extracted texts, study context, questions, and answers to activate integrated AI models and providers. Main legal basis: performance of a contract; for accessory uses involving security, improvement, and abuse prevention, we may use legitimate interest while respecting data subject rights.

We use usage data, language, preferences, study history, and interactions to adapt the interface, organize content, suggest next steps, and improve the experience. Main legal basis: performance of a contract and legitimate interest.

We use email and account data to send essential messages related to the operation of the service, including registration confirmation, authentication, password reset, security alerts, usage notifications, support, relevant platform changes, and administrative communications.

These communications are considered part of the provision of the service and cannot be disabled while the account is active.

Main legal basis: performance of a contract, legitimate interest, or legal obligation.

Service communications about the subscription also include the store billing failure notice (by push notification and email), with how to fix the payment, and the email sent about 2 days before the free trial ends, with the end date, the information that the store will automatically charge the chosen plan, and how to cancel before the charge.

We use name, email, preferences, and campaign interaction data to send news, educational content, offers, and promotional communications related to Supernapse.

Promotional emails about Supernapse itself are sent based on our legitimate interest in promoting the service to people who already have an account (art. 7, IX, and art. 10, I, of the LGPD). At sign-up, we tell you that we may send study tips and offers by email and how to stop receiving them.

You can object to these emails at any time, free of charge: use the unsubscribe link in any email (it works with a single tap and takes effect immediately), turn off “Email updates” in the app’s notification settings, or write to suporte@supernapse.app. We do not use this data for other purposes or share it with advertisers; sending is handled by a contracted email provider acting only as a processor.

Unsubscribing from promotional communications does not affect the sending of essential operational communications.

Main legal basis: legitimate interest (art. 7, IX, of the LGPD), with the safeguards described in this section and the right to object at any time.

When no choice is recorded, the account is treated as subscribed to promotional emails, except for accounts that indicate in the app that they are studying for the ENEM or a vestibular, which receive no promotional emails until they turn on “Email updates” (section 12). Promotional push notifications follow a different rule: they are only sent to people who agreed to receive them in the app, as explained below and in section 14.

If you close the plans screen without subscribing, we may send reminders about the plans and your kit by push notification and email: at most 5 of each, over about 14 days, only between 9 a.m. and 9 p.m. in your time zone. One of these reminders may include a special offer with an end date: the plans screen in the app shows that date while the offer is valid, and the offer email states the date and time. The reminders stop when you subscribe. By email, they are only sent to accounts created after the email notice started appearing at sign-up, and each email includes an unsubscribe link. By push, they are only sent if you agreed when turning on notifications in the app, and you can stop them with the link to stop offer notifications on the plans screen or in your phone settings. These reminders are not sent, through any channel, to accounts that indicate they are studying for the ENEM or a vestibular.

We use IP, logs, device identifiers, usage events, authentication data, and technical records to prevent abuse, improper access, fraud, attacks, malicious automated use, policy violations, and security incidents. Main legal basis: legitimate interest, compliance with legal obligation, and regular exercise of rights.

We use usage data, errors, performance, and aggregated or pseudonymized metrics to understand operation, fix failures, prioritize improvements, develop resources, and measure quality. Main legal basis: legitimate interest; for non-essential cookies or technologies, we may depend on consent as required by law.

We use billing, subscription, transaction, and tax information to process payments, issue documents, prevent financial fraud, and comply with accounting and legal obligations. Main legal basis: performance of a contract and legal obligation.

We use data necessary to respond to data subject requests, comply with legal or regulatory obligations, cooperate with competent authorities, protect the rights of Supernapse, users, or third parties, and conduct audits, investigations, or defenses. Main legal basis: legal obligation and regular exercise of rights.

When we use legitimate interest, we seek to limit processing to what is necessary, assess impacts on data subjects, adopt safeguards, and respect objection requests when applicable. Legitimate interest will not be used as the sole basis for processing sensitive personal data.

We use the PDF, excerpts, questions, and answers from the preview to generate the questions, show the result, and prepare the free kit you requested. Main legal basis: performance of a contract or of preliminary procedures related to the contract.

We use the protected device code to prevent the free preview from being obtained repeatedly on the same device, for example by deleting and recreating accounts. Main legal basis: Supernapse’s legitimate interest in preventing fraud and abuse of the free offer, with measures to reduce the impact on the data subject (the code does not directly identify the person and is not linked to the deleted account).

We use AppsFlyer attribution data and the answer to “How did you hear about Supernapse?” to understand which channels and campaigns bring new users, measure results (in aggregate on iOS; on Android, also through the device advertising identifier, as explained in section 6.4), and adjust initial onboarding suggestions. Main legal basis: legitimate interest; for marketing technologies that depend on consent, see section 6.

Necessary for login, security, account operation, fraud prevention, routing, stability, remembering privacy choices, and basic use of the website or application. Because they are strictly necessary, they may be used without marketing consent, based on performance of the service and, where applicable under the LGPD, Supernapse’s legitimate interest in keeping the platform secure and functional. Disabling them may prevent or impair the service.

Used to understand audience and feature usage, measure performance, diagnose errors, and improve the experience. Non-essential analytics technologies are activated only after consent where required by applicable law.

They are used for campaign measurement and attribution of conversions and installs. Supernapse does not use them to create custom audiences or for remarketing. On the website and in the web app, these non-essential technologies depend on the user’s prior, free, informed, and unambiguous consent and remain disabled until that choice is made. In the mobile app, the current operation is described in section 6.4.

On the Supernapse website, Google Analytics is only enabled after you accept analytics in the cookie banner, with advertising signals disabled. In the web app, the TikTok Pixel and the AppsFlyer script are only loaded on the app access pages, after your consent. In the mobile app, Firebase Analytics (Google) and AppsFlyer start working when the app is opened, without a dedicated consent screen, based on Supernapse’s legitimate interest in measuring app usage and knowing which channels and campaigns bring in new students. On iOS, the app does not request tracking permission (ATT), does not access the advertising identifier (IDFA), keeps Firebase advertising signals turned off, and advertising platforms receive only aggregated campaign results (for example, through Apple’s AdAttributionKit/SKAdNetwork), never data that identifies you or your device. On Android, ad personalization through Firebase is turned off, and the device advertising identifier (GAID) may be used to attribute installs, sign-ups, and subscriptions to TikTok Ads, Meta Ads (Facebook and Instagram), and Google Ads campaigns; you can delete or reset it in Android settings. This data may be associated with an internal identifier of your account, never with your email or name. We do not use this data to create custom audiences or for remarketing, or to target ads at minors. When you choose the ENEM or a vestibular as your exam in the app, from that choice on and in the app installation where you made it, AppsFlyer stops passing events to advertising platforms and Firebase advertising signals are turned off, on both iOS and Android (section 12).

These providers may combine data received from Supernapse with information they already hold, acting as independent controllers for some activities under their own terms and privacy policies. Supernapse does not send private study content to these platforms for advertising purposes.

You may accept or reject non-essential categories in the cookie banner, manage preferences at any time through the privacy or cookie settings made available by Supernapse, and withdraw consent as easily as you gave it. Refusal or withdrawal does not affect access to essential functions and does not invalidate processing already carried out lawfully before withdrawal.

You can also restrict cookies and tracking through browser settings and reset or limit IDFA/GAID and ad personalization in the privacy settings of your iOS or Android device. Browser or device controls may not remove choices already recorded by providers, so you may also need to use their opt-out tools. A new consent choice may be requested if cookies are deleted, a different browser or device is used, or the purposes or providers materially change.

In the mobile app, you can reset or delete the advertising identifier and limit ad personalization in Android settings; on iOS, the app does not request tracking permission (ATT), does not access the advertising identifier (IDFA), and does not track you across other companies’ apps and websites. You can also request information about, or object to, the use of app analytics and attribution data by writing to suporte@supernapse.app, and we will review the request in accordance with the law.

Retained while the account is active and for the necessary period after closure for legal compliance, security, fraud prevention, auditing, or defense of rights.

When you delete your account, we erase the data linked to it, except for the records described in the next paragraph. This includes materials, kits, conversations with the AI tutor, and the photos sent to it. We also ask RevenueCat to delete your customer record. Deleting the account does not cancel subscriptions purchased in the app stores: cancel them in the App Store or Google Play.

After the account is deleted, some records may be kept to prove that the request was handled, comply with legal obligations, prevent fraud, and defend rights: the confirmed deletion request record, with the dates and the email kept only as a cryptographic code (a keyed hash) that does not reveal the address; email delivery and unsubscribe records (including email, IP, and browser, when available); subscription events received from the stores and RevenueCat; and usage and cost records of AI features associated with an internal identifier. Unconfirmed deletion requests are erased within 30 days. These records do not include your study materials. The app stores keep purchase history under their own policies.

Retained while the account is active, while necessary to make features available to the user, or until deleted by the user, except for retention required by law, security, backup, auditing, or regular exercise of rights.

Retained for the period necessary for security, fraud prevention, monitoring, auditing, and legal compliance, including minimum periods applicable to internet application access records when required by Brazilian law.

Retained until consent withdrawal, objection, unsubscribe, or while there is a valid legal basis for communication.

Retained for the periods required by tax, accounting, consumer, regulatory rules, or as needed to defend rights.

After the retention period ends, data will be deleted, anonymized, or aggregated, except when preservation is permitted or required by law. Anonymized data that no longer identifies the data subject may be retained for statistics, security, analysis, and service improvement.

Preview data (questions, excerpts, answers, and the AI notice record) is deleted together with the account. The PDF and the free kit follow the rule for study content (section 10.2).

The protected device code used to prevent a second free preview is kept after the account is deleted, with no link to it, only for the fraud-prevention purpose described in section 3.11. It is kept while the free preview is offered, for no longer than 12 months from its creation, and then deleted.

On the device itself, the installation identifier and the AppsFlyer attribution data remain in the app’s storage until the app is uninstalled, even after you sign out or delete the account, together with an internal identifier of the last account that received this data.

Sign-up source data (AppsFlyer and “How did you hear about Supernapse?”), the record of closing the plans screen, the time zone used for sending, and the history of messages sent are kept while the account exists and deleted together with it. Data held by AppsFlyer, Firebase, and advertising platforms follows those providers’ retention periods.

Include messages about account, authentication, security, support, relevant changes, transactions, payments, and service operation. These communications are essential and cannot be disabled while the account is active.

In the app, service push notifications include content-ready notices, study reminders, and subscription notices, such as billing failures. Study reminders, streak-at-risk alerts, and content-ready notices can be adjusted in the app’s notification settings. These notices are separate from offers: stopping offer notifications does not turn off service notices or study reminders.

Include news, campaigns, educational content, offers, and feature announcements. Promotional emails are sent based on legitimate interest, as described in section 3.6, and you can object at any time. Promotional push notifications are only sent to people who agreed to receive them in the app.

The user may unsubscribe from promotional emails at any time through the unsubscribe link in each email, which works with a single tap, in the app’s notification settings (“Email updates”), or by contacting suporte@supernapse.app.

Supernapse may use third-party providers to send these communications, sharing only the necessary data and requiring appropriate security and confidentiality measures.

Unsubscribing from promotional communications does not prevent the sending of communications essential to platform use.

Reminders about plans and offers sent by push after you close the plans screen (section 3.6) are also promotional. These reminders are only sent by push if you agreed when turning on notifications in the app: the permission request (for example, on the reminder screen or with “Let me know when the kit is ready”) states that, in addition to notices, we also send reminders about plans and offers. To stop them, use the link to stop offer notifications on the plans screen, or turn off Supernapse notifications in your phone settings. People who turned on notifications before this notice was shown do not receive these reminders by push.

You can manage your communication preferences at any time: turn off “Email updates” in the app’s notification settings or use the unsubscribe link in any promotional email. Promotional push notifications are sent only to people who agreed to receive them in the app.

You can also turn off Supernapse notifications in your device settings.

Even with adjusted preferences, essential communications related to the account, security, and service operation will continue to be sent.

Supernapse — Privacy as the foundation of innovation.