Documents
Privacy policy
Updated on .
This policy explains which personal data O Casulo collects, why it collects it, who it is shared with, how long it is kept, and how you can exercise the rights in Brazil's General Personal Data Protection Law, Law no. 13,709/2018 (LGPD).
It applies to anyone who visits the site, creates an account, buys an experience, books a conversation, comments on a lesson, or receives an email. Use of the service also follows the Terms of use.
1. Who the controller is
The controller of the personal data handled on this platform is the person responsible for operating O Casulo, the same one identified on payment receipts and on the tax documents of purchases. In this policy, that operation is called O Casulo.
Processors are those who handle data on behalf of the platform, such as hosting, email delivery, and Stripe in payment processing. They follow instructions and their own legal duties.
2. Who this policy applies to
This policy covers the site, the student area, registration, the cart, checkout, lessons, comments, lives, conversation booking, and emails sent by O Casulo.
Third-party pages and players opened from the site — for example, a YouTube video or Stripe checkout — have their own notices. When you leave the site, handling is also that third party’s.
3. Data we collect
Data you provide
- identification and contact: first name, last name, email, and phone or WhatsApp, with the country code;
- address: postal code, street, number, complement, neighborhood, city, and state, according to the country chosen at registration;
- access password, stored only as a cryptographic hash, never as plain text;
- the choice to receive the newsletter or not;
- the preferred site language;
- comments written on lessons;
- the chosen experience, cart items, and purchase orders;
- the reserved conversation time, when you book;
- messages you send to ask for support, a refund, or the exercise of a right.
Data generated by use
- account identifier, profile (student or administration), access status, and creation and update dates;
- email confirmation, the verification code as a hash, its validity, and the number of attempts;
- a password-reset request and the matching token, until it is used or expires;
- orders, amounts, currency, payment status, payment date, and checkout session identifiers;
- the link between the account and the experiences purchased;
- conversation reservations, with start, end, and status;
- a record that the welcome email was already sent, so the message is not repeated.
Technical data
- a session cookie, needed to keep you signed in;
- a cart cookie, when a cart is created before or during the visit;
- the language indicated by the browser, used only to choose the site text while no account is logged in;
- IP address, used to limit abusive verification, booking, and captcha attempts, and sent to Google when reCAPTCHA is active;
- the date and time of those security events.
Data the platform does not keep
The full card number, the expiry date, and the security code are handled by Stripe in its own environment. O Casulo does not store that data in its own database. We also do not ask for racial origin, religion, health, biometrics, or political opinion. If you write that kind of information in a comment or a message, you sent it on your own initiative and it may be deleted when it is not needed.
4. Purposes and legal bases
Each use below names the LGPD basis that supports it.
- Create and keep the account, verify the email, store the chosen language, and recover the password. Performance of a contract and of preliminary steps at your request (article 7, V).
- Process the cart, the payment, the unlocking of access, and the booking. Performance of a contract (article 7, V).
- Send essential account and purchase emails. Performance of a contract (article 7, V).
- Show the site in the device language for people who are not logged in. Legitimate interest in making the content understandable (article 7, IX). That data is not stored as a profile.
- Publish and moderate comments on lessons. Performance of a contract and legitimate interest in keeping the space safe (article 7, V and IX).
- Send the newsletter. Consent, which you may withdraw whenever you want (article 7, I). The newsletter is not a condition of buying.
- Prevent fraud, registration abuse, brute force, and improper reservation of times. Legitimate interest and, when it applies, credit protection and fraud prevention (article 7, IX and X).
- Confirm that a form was sent by a person, through reCAPTCHA. Legitimate interest in registration security (article 7, IX), only when that check is active.
- Keep purchase records for tax, accounting, and consumer-defense duties. Compliance with a legal obligation (article 7, II).
- Answer requests for access, correction, deletion, and complaints. Compliance with a legal obligation and the exercise of rights (article 7, II and VI).
- Improve site security and investigate an incident. Legitimate interest and, if there is a security incident with relevant risk, the duty to communicate it under the LGPD (article 7, IX, and article 48).
When the basis is legitimate interest, use is limited to what is necessary for the account, the purchase, and security. You may object when the law allows it, through the contact on this page.
We do not sell personal data, we do not build third-party advertising lists, and we do not use account data to decide credit, employment, or health.
6. Who we share with
Sharing happens only as far as it is needed:
- Stripe. Receives checkout data in order to charge, confirm payment, and notify the platform by webhook. Stripe’s policy is at stripe.com/privacy.
- Email provider. Receives the destination address, the name, and the content of the operational message or of the newsletter you accepted.
- Hosting and database provider. Stores the application and the records described in this policy.
- Google. When reCAPTCHA is active, it receives the verification token and the IP, under Google’s policy.
- Video platform. When you watch an embed, the player may receive the IP and technical data from the device.
- Authorities. When there is a legal duty, a court order, or a valid request. Records are produced only within what the order asks for.
Comments are not sold and are not published outside the lesson area. The team that operates the site can read them in order to moderate and reply.
7. International transfer
Some processors may handle data outside Brazil. Stripe and Google may process data in the United States and in other countries where they operate. The video player may do the same.
When that happens, the transfer relies on the cases in article 33 of the LGPD, especially performance of the contract you requested, compliance with a legal obligation, and the safeguards those suppliers offer in the clauses and mechanisms they use for international transfer. Use stays limited to the purposes of this policy.
8. How long we keep data
Data stays only for the time needed for the purpose or for the period the law requires it to be kept.
- Account, address, phone, and language. While the account exists. After a deletion request, they are erased or anonymized, except what must remain under the next item.
- Orders, payments, and purchase documents. For the period tax, accounting, and consumer-defense duties require, generally 5 (five) years, and longer if a case or a limitation period is running.
- Comments. While the account and the lesson exist, or until you ask for removal, whichever comes first.
- Conversation reservations. For the life of the account and of the purchase records tied to the time. Unpaid reservations expire and stop occupying the schedule.
- Verification code and password token. Until use or expiry, plus the short technical-audit time tied to that record.
- Attempt limits with an IP. Rate records are deleted within 2 (two) days.
- Cart cookie. Up to 30 days, or until you delete it.
- Newsletter. Until you withdraw consent. From then on the address stops receiving that kind of message, without deleting the account.
The Civil Rights Framework for the Internet requires application providers organized as legal entities, operating in an organized, professional, and economic way, to keep application access logs under confidentiality for the legal period of 6 (six) months. If that retention is active in the operation, the period and the confidentiality of article 15 of Law no. 12,965/2014 are respected. Those records are not used for a commercial profile.
9. Security
The password is stored as a hash. Session and cart cookies use HttpOnly. Over HTTPS, the cart cookie is marked Secure. Account and purchase forms use a check against cross-site submission. Repeated attempts at codes, bookings, and sensitive actions are limited.
No transmission on the internet is free of risk. Use a password of your own, do not share the login, and tell the platform if you notice strange access. In an incident that may cause relevant risk or harm, the affected people and the Brazilian National Data Protection Authority will be notified as article 48 of the LGPD requires.
10. Data-subject rights
Under article 18 of the LGPD, you may ask, regarding your data:
- confirmation that the platform handles your data;
- access to the data;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of unnecessary, excessive, or non-compliant data;
- portability to another provider, observing commercial and industrial secrets and the authority’s regulation;
- deletion of data handled on the basis of consent, when that is the basis;
- information about the entities with which the data was shared;
- information about the possibility of not consenting and about the consequences, when handling depends on consent;
- withdrawal of consent, without erasing handling done before and without stopping handling that has another legal basis;
- objection to handling based on legitimate interest, when there is excess or non-compliance;
- review of a decision made solely on automated handling, if one ever exists and affects your interests.
You make part of the correction yourself in the account area, where you change email, phone, address, language, and password. Changing the email asks for a new confirmation.
Deleting the account does not reach data the law requires to be kept, such as the purchase history. In those cases, the data stops being used for another purpose and stays limited to the legal duty and the defense of rights.
11. How to ask
Requests about your account, purchases, these documents, or personal data can be sent to O Casulo at no-reply@somosocasulo.com. Include your account email so the registration can be found.
To protect the account, the request may need confirmation that it comes from the registered email. Requests from third parties are answered only with proof of representation. The reply follows the deadlines of the LGPD and of the regulation of the National Data Protection Authority.
If the reply does not resolve it, you may petition the National Data Protection Authority and consumer-protection bodies.
12. Children and teenagers
The site is not directed at children or teenagers. Registration is for people aged 18 or older. We do not intentionally collect children’s data.
If you are responsible for a child or teenager and believe their data was sent, ask for deletion through the contact on this page. The account will be closed and the data erased, except for the minimum legal retention if a purchase was completed.
13. Emails and newsletter
Verification, password, purchase, and access messages exist to perform the contract. They continue even if you do not want the newsletter.
The newsletter depends on the acceptance control at registration or on a later request. Acceptance can be withdrawn from the link in the message, when there is one, or through the platform contact. Withdrawal takes effect for the following sends.
14. Automated decisions
There is no automated decision that sets credit, a personalized price, or a personality profile. Automatic limits only block, for a short period, too many attempts at a code, a booking, or similar actions, in order to reduce abuse. A block of that kind can be reviewed through the contact on this page.
reCAPTCHA, when active, only distinguishes an automated form submission from a human one. It does not decide whether you can buy.
15. Data protection officer and ANPD
Data-subject requests and privacy messages are received at the contact at the end of this page, which acts as the officer’s channel for data subjects until a specific officer is published here.
The supervisory authority is the Brazilian National Data Protection Authority (ANPD): www.gov.br/anpd.
16. Changes to this policy
This policy may be updated when the site, the processors, or the law change. The date at the top shows the current version. The new version applies on the published date.
If a change requires new consent, it will be asked for in a clear way, before the corresponding use. A purchase history already made continues to be handled under the law and the purposes that justified the collection.
Contact
Requests about your account, purchases, these documents, or personal data can be sent to O Casulo at no-reply@somosocasulo.com. Include your account email so the registration can be found.