Privacy Policy — Cursa

1. Who we are

Cursa is an educational platform that provides free online courses, exercises, digital certificates, study tools, Artificial Intelligence features and other functionalities related to education and personal and professional development.

For the purposes of applicable data protection laws, the controller of personal data directly processed by Cursa is:

Medeiros Tecnologia LTDA
CNPJ (Brazilian Company Registration Number): 24.471.978/0001-08
Brazil
Privacy and contact email: contato@cursa.app

2. Who this Policy applies to

This Policy applies to personal data processed when using:

• the Cursa website;
• the Cursa applications for Android and iOS;
• the user account;
• courses, exercises and other educational resources;
• digital certificates;
• Artificial Intelligence features;
• support and customer service channels;
• other functionalities made available by Cursa.

Services, websites, applications, videos or content operated by third parties may have their own privacy policies.

3. Personal data we may collect

The data collected depends on the features used by the user.

3.1. Registration and identification data

We may process data such as:

• name;
• email address;
• password or credentials required for authentication, when applicable;
• internal account identifiers;
• language;
• areas, categories, subjects or topics of interest;
• information provided by authentication providers when the user chooses to sign in using third-party services such as Google or Apple.

This data is mainly used to create and manage the account, authenticate the user, personalize the experience and issue certificates.

3.2. Google Sign-In

When the user chooses to create an account or sign in to Cursa using a Google Account, Cursa may receive information made available by Google according to the permissions shown during authentication, such as name, email address, account identifier and basic profile information.

This information is used to create or identify the user's Cursa account, enable authentication and provide features associated with the account.

Cursa does not sell data obtained through a Google Account and does not use it for purposes incompatible with those disclosed to the user.

3.3. Study-related data

To allow users to continue their studies across different sessions and devices, we may store information such as:

• courses started and completed;
• course progress;
• learning history;
• study time;
• lessons or chapters accessed;
• favorite courses;
• exercises completed;
• answers and performance in exercises;
• topics of interest;
• study plans and schedules;
• interactions with educational features;
• other information necessary to provide and improve the learning experience.

This information may also be used to recommend courses and resources that are more relevant to the user.

3.4. Certificate-related data

When a user completes a course and requests a certificate, we may use and store information such as:

• student name;
• account identification;
• course completed;
• course workload;
• completion date;
• information required to issue and validate the certificate;
• identifiers or codes used to verify certificate authenticity.

The certificate may be sent to the user's email address and, depending on the feature and operating system permissions, saved on the device.

3.5. Technical and device data

Cursa and the technology services used by the platform may automatically collect certain technical information, such as:

• IP address;
• device model or characteristics;
• operating system;
• application version;
• language and regional settings;
• device or installation identifiers;
• advertising identifiers, when permitted;
• technical logs;
• error, crash and performance information;
• date and time of access and interactions;
• data related to security and abuse prevention.

3.6. Usage and analytics data

We may collect information about how users interact with Cursa, including:

• screens accessed;
• buttons or features used;
• courses viewed;
• searches performed;
• interactions with products and features;
• usage events;
• approximate usage time;
• application performance and stability.

3.7. Advertising-related data

Cursa is a free platform and may display advertising provided by specialized services.

Depending on device settings, the user's region, permissions granted and applicable rules, advertising services may process information such as:

• device advertising identifier;
• IP address;
• technical information;
• events related to ad impressions;
• interactions with ads;
• information required for measurement, fraud prevention, frequency capping and, when permitted, ad personalization.

Cursa does not sell its users' personal data.

3.8. Data used in Artificial Intelligence features

Cursa may provide Artificial Intelligence-based features for purposes such as:

• creating study plans or schedules;
• recommending courses;
• helping organize studies;
• generating educational content;
• creating summaries or learning tools;
• providing recommendations related to professional development;
• other AI-powered features.

To provide these features, information supplied by the user and certain data related to the use of the platform may be processed by Artificial Intelligence systems and, when necessary, by technology providers responsible for those services.

We recommend that users do not provide passwords, identification documents, financial information, medical information or other sensitive personal data in fields intended for interactions with Artificial Intelligence, unless a feature expressly indicates that such information is required.

4. How we collect data

We may receive data:

• directly from the user;
• during account creation or updates;
• while courses and features are being used;
• automatically through the website or application;
• through the device being used;
• through authentication services;
• through analytics, diagnostics or advertising tools;
• through communications sent to our support team;
• through service providers required to operate the platform.

5. How we use personal data

• create and manage accounts;
• authenticate users;
• maintain study history and progress;
• synchronize information across devices;
• issue, send and validate certificates;
• provide courses and exercises;
• personalize the experience;
• recommend content;
• generate study plans;
• provide Artificial Intelligence features;
• send notifications related to use of the platform;
• respond to support requests;
• analyze Cursa's operation and performance;
• develop and improve products and features;
• identify and fix errors;
• protect users and the platform;
• prevent fraud, abuse and unauthorized access;
• comply with legal or regulatory obligations;
• exercise or defend legal rights;
• display, measure and manage advertising;
• produce aggregated statistics and analyses.

6. Legal bases for processing

Personal data processing may rely on different legal bases under applicable data protection laws, including the Brazilian General Data Protection Law (LGPD), depending on the purpose and context, such as:

• performance of a contract or procedures related to services requested by the user;
• compliance with legal or regulatory obligations;
• exercise of legal rights;
• legitimate interests, when applicable;
• consent, when required or considered the appropriate legal basis;
• other legal grounds authorized by applicable law.

Where consent is used as the legal basis, users may withdraw it in accordance with applicable law.

7. Personalization and recommendations

Cursa may use information about interests, history, courses accessed and other interactions to organize and recommend content that may be relevant to the user.

8. Artificial Intelligence and automated decisions

Some features may use automated processing and Artificial Intelligence to produce recommendations or personalized results.

Results generated by Artificial Intelligence systems may contain errors or inaccuracies and should not be considered human decisions or guarantees of outcomes.

9. Analytics, diagnostics and platform improvement

We may use technological tools to measure usage, identify failures and understand how people interact with Cursa.

These tools may include analytics, diagnostics and infrastructure services provided by companies such as Google and other technology providers.

10. Advertising

Cursa's free availability is supported, among other sources, by advertising.

Specialized advertising companies may process certain technical data and identifiers to deliver ads, measure impressions and interactions, avoid excessive repetition, fight advertising fraud and personalize ads when permitted.

11. Cookies and similar technologies

The Cursa website may use cookies, local storage and similar technologies for essential functionality, security, preferences, analytics and advertising.

Where required by applicable law, non-essential cookies and similar technologies will depend on the user's choices made through the consent or preference management mechanism provided on the website.

12. Sharing and processing by third parties

Cursa does not sell personal data.

However, certain data may be processed by or shared with service providers that are necessary to operate the platform, including providers responsible for:

• hosting and cloud computing;
• databases and storage;
• email delivery;
• authentication;
• analytics;
• performance and error monitoring;
• advertising;
• notifications;
• content playback;
• security;
• technology support;
• Artificial Intelligence.

Depending on the feature being used, services and companies involved in the operation of the platform may include:

• Google, including services related to Firebase, advertising, authentication and YouTube;
• Apple, including authentication and services related to the iOS ecosystem;
• Amazon Web Services — AWS, used for infrastructure, storage, processing and communications;
• advertising providers and networks integrated with or mediated by services used by Cursa;
• technology and Artificial Intelligence providers required for the relevant features.

13. Third-party content and services

Some courses, videos and materials available through Cursa may be produced or hosted by third parties, such as content played through YouTube.

When a user interacts with third-party content or services, the relevant provider may process data in accordance with its own policies and terms.

14. International data transfers

Some technology providers used by Cursa have infrastructure or servers located outside Brazil.

Where an international transfer of personal data is subject to the LGPD, Cursa will seek to use mechanisms permitted by applicable law and regulations issued by Brazil's National Data Protection Authority (ANPD).

15. How long we retain data

Data is retained for as long as necessary to provide services, fulfill the purposes described in this Policy, comply with legal or regulatory obligations, prevent fraud and exercise or defend legal rights.

After account closure or the end of the relevant purpose, data may be deleted or anonymized, except where retention is permitted or required by law.

16. Account and data deletion

Users may request account deletion directly in the application:

Menu → My Profile → Delete my account

Deletion may also be requested by emailing contato@cursa.app.

After the request is processed, account-related data will be deleted or anonymized, except for information whose retention is necessary or permitted under applicable law.

17. Data subject rights

Subject to the conditions established by applicable law, users may request rights including:

• confirmation of whether personal data is being processed;
• access to personal data;
• correction of incomplete, inaccurate or outdated data;
• anonymization, blocking or deletion of unnecessary, excessive or unlawfully processed data;
• data portability, where applicable;
• deletion of data processed on the basis of consent, subject to legal retention requirements;
• information about entities with which data has been shared;
• withdrawal of consent;
• objection to processing, where provided by law;
• rights related to certain automated decisions, where applicable.

To exercise your rights, contact us at contato@cursa.app.

18. Children and teenagers

Cursa is an educational platform that may be used by people of different age groups.

Personal data relating to children and teenagers must be processed in their best interests and in accordance with applicable law.

Parents or legal guardians may contact us at contato@cursa.app.

19. Information security

We adopt technical, administrative and organizational measures intended to protect personal data against unauthorized access, loss, destruction, improper alteration, unauthorized disclosure, fraud and other uses incompatible with the purposes described in this Policy.

Despite our security efforts, no system connected to the internet is completely immune from security incidents.

20. Security incidents

If a security incident involving personal data occurs, Cursa will adopt the technical and administrative measures considered appropriate.

Where required by applicable law, the incident will be reported to the relevant data protection authority and affected users.

21. Communications and notifications

Cursa may send communications necessary for the operation of the service, such as account recovery or security notices, certificates, important service information, study-related notifications and support responses.

22. Changes to this Policy

This Policy may be updated to reflect new features, technological changes, new providers, changes in data processing practices or legal and regulatory developments.

The date of the latest update will be shown at the beginning of this page.

23. Privacy contact and Data Protection Officer

Requests relating to personal data, privacy, account deletion or the exercise of rights may be sent to:

contato@cursa.app

The identity and contact details of any formally appointed Data Protection Officer will be disclosed and kept up to date in an easily accessible location, as required by applicable law.

24. Applicable law

This Policy will be interpreted in accordance with applicable law, including Brazil's Law No. 13,709/2018 — the General Data Protection Law (LGPD) — and other applicable data protection rules.