Privacy Policy

Sukinho is the personal data controller in Brazil (Law 13.709/2018, LGPD Art. 5, §I).

You are the data subject.

Data Protection Officer (DPO): Guilherme Escarabel, contactable at [email protected] (LGPD Art. 41).

The database and primary infrastructure (application server, PostgreSQL database) are hosted in Brazil.

Session and configuration cache (Redis) are also in Brazil.

No personal data is stored outside Brazil, except necessary transfers to processors per Art. 33 (see section 7 below).

Audio you speak is processed in real-time only to generate the tutor's response and pronunciation feedback.

Immediately after analysis, the audio recording is permanently deleted.

We do not retain your voice recording or raw conversation transcript.

What we keep is a structured summary of each lesson (topic, level, skills practiced, common errors detected), used to track progress and personalize future lessons. Summaries do not contain direct quotes from your speech.

Registration data: name, email, age band (13-17, 18-24, 25-39, 40-59, 60+).

Operational data: language pairs (L1→L2 chosen), achieved levels, lesson history, scores, vocabulary progress.

Context data: learning goal (optional).

We never ask for: full date of birth, CPF, phone, residential address, sensitive PII.

We respect the minimization principle. We ask only for broad age band, never full date of birth.

We do not retain raw audio or text transcripts (only summaries).

Age band and language identifiers are additive (improve personalization without re-identification risk).

Production logs do not include conversation content or sensitive PII (full names are scrubbed from distributed traces).

We process your data based on your explicit consent at signup (LGPD Art. 7, I).

Some processing is also based on legitimate interest (improve the platform via anonymized analytics).

For users aged 13-17, consent observes LGPD Art. 14 and ANPD Statement 01/2023, always in the minor's best interest.

To provide the service, we transfer text and/or audio to sub-processors located in the United States:

• OpenAI (STT = speech recognition; LLM = tutor response generation; TTS = tutor voice audio generation);

• Microsoft Azure (pronunciation assessment and scoring).

These transfers occur under Standard Contractual Clauses (SCCs) and Data Processing Addendums (DPA), per LGPD Art. 33.

Sukinho has signed DPAs with both parties (copies available upon request).

Under the OpenAI DPA, OpenAI does not use data sent via API to train or improve its models.

Sukinho operates today with Brazil as the primary jurisdiction (Brazil infrastructure).

Should the platform expand to EU, California, or South Korea, additional compliance policies will be published (GDPR, CCPA, PIPA).

Users in those jurisdictions will be notified of changes before they are affected.

Sukinho works with the following sub-processors who process personal data on our behalf:

• OpenAI, Inc. (San Francisco, USA), STT, LLM, TTS, DPA signed;

• Microsoft Azure / Cognitive Services (USA), pronunciation assessment, DPA signed;

• Payment gateway, transaction data, when paid plans are active, does not process pedagogical data.

You may request at any time:

• Confirmation of whether your data is being processed;

• Access to the data we hold about you;

• Correction of incomplete or inaccurate data;

• Deletion or anonymization of your data;

• Data portability in structured format;

• Withdrawal of consent (we will cease new processing shortly, but already-processed data is not retroactive).

To exercise any right, write to [email protected].

You may request deletion of your account and all your data at any time via Profile or by requesting support.

We complete deletion within 7 business days of your request (LGPD Art. 16 timeframe).

Data we must retain by legal obligation is excepted (e.g., transaction records for tax compliance, maximum 5 years).

We use essential cookies to maintain your authenticated session and service operation.

Analytics and tracking cookies are used only with your explicit consent, via a consent banner (scheduled for Phase 4).

You can withdraw cookie consent at any time via Settings.

Transmission: TLS 1.3 in transit (end-to-end encryption with valid certificate).

Storage: data at rest in PostgreSQL encrypted (LUKS block-level).

Access: role-based access control (RBAC); users see only their own data (RLS, Row-Level Security).

Attack surface reduction: we do not retain audio recordings; production logs contain no PII.

In case of personal data breach affecting your rights or freedoms, Sukinho will notify ANPD and you without undue delay (maximum 72 hours), per LGPD Art. 48.

Any questions about this Policy: [email protected].