1. Summary (1 minute)
- We collect only what is necessary for the analysis (athletic profile + contact information).
- We do not sell your data to third parties.
- Minors' data is handled with enhanced protection and requires the consent of a guardian.
- You may request a copy or the deletion of your data at any time.
2. Data we collect
- Identification: name, date of birth, email.
- Athletic profile: position, height, club, graduation year, competition level, English proficiency level.
- Origin: country of birth, country and state of residence.
- Guardian (if the athlete is a minor): name, email and relationship to the athlete.
- Achievements and videos (optional): free text and a link to a highlight reel.
- Technical: IP address, user agent, date and time of access (security).
3. How we use it
The data is used exclusively to: (a) calculate the probability of a match between your profile and American university programs; (b) communicate results and updates about your analysis; (c) improve the product's accuracy (in aggregated and anonymized form); (d) comply with legal obligations.
4. Legal basis (Brazil's General Data Protection Law — LGPD)
Adult athletes: consent and performance of a contract (Art. 7, items I and V). Minor athletes: specific and prominent consent given by at least one parent or the legal guardian (Art. 14, § 1).
5. Sharing
We do not sell data. We share it only with providers that process data on our behalf (hosting on Vercel, database on Supabase, AI model at Anthropic, transactional email delivery), under contracts that require confidentiality and compliance with the LGPD.
At no time do we hand over your personal data to coaches or universities without your explicit authorization.
6. Cookies and analytics technologies
Cookies are small files that the site stores in your browser. We use three types, and you control the non-essential ones:
- Essential (always active): necessary for the site to work — keeping you signed in (Supabase session) and remembering preferences such as language. The service does not work without them, so they do not depend on consent.
- Aggregate measurement: we use Vercel Analytics to measure traffic volume and page performance in aggregate, without cookies that identify you individually and without building a profile about you.
- Usage analytics (optional, only with your acceptance): if you authorize it in the cookie notice, we use PostHog to understand how the platform is used (pages visited, clicks and session recording) and to improve it. This data is hosted on servers in the European Union. What you type — such as email, password and other sensitive fields — is masked and is not captured.
Usage analytics is only turned on if you click “Accept” in the cookie notice. If you choose “Essential only”, the site keeps working normally, without this tracking. Your choice is stored in your browser and can be changed or withdrawn at any time (just clear the site's data or make your choice again in the notice).
We do not use this data for advertising, nor do we sell it. Because PostHog processes data outside Brazil, the transfer is based on Art. 33 of the LGPD, under contractual clauses that require equivalent protection.
7. Retention
We keep the data while your account is active. After 24 months of inactivity or upon a deletion request, we remove personal data within 30 days (keeping only anonymized aggregate records for statistical purposes).
8. Your rights
You may, at any time:
- Request a copy of the data we store.
- Correct inaccurate data.
- Request the deletion of your data.
- Withdraw your consent (this ends the processing).
- File a complaint with the ANPD (Brazil's National Data Protection Authority).
To exercise any of these rights: [email protected]. We respond within 15 business days.
9. Security
We use encryption in transit (HTTPS/TLS) and at rest, role-based access control and auditing of sensitive operations. No system is 100% secure — we will report any material incident to the ANPD and to affected users as required by the LGPD.
10. Updates
Changes to this policy will be communicated by email to registered users at least 30 days in advance.
11. Data Protection Officer (DPO)
Contact for the officer in charge of personal data processing: [email protected]